Bruce Nikkel search_sort.pdf

Challenges:

• too many hits
• hidden content (steganography) is not found
• protectet content (steganography) is not found
• compund files (zip, tar, attachments, embedded) are harder to serach - need to extracted first
• proprietary file formats - hard to search because unknown of how to search

fls 

fls outputs a large file list, deleted file, multiple partitions/drives/PCs

GNU grep

GNU find

UNIX Strings

• strings -td image.dd
• strings -td -e l image.dd
• strings -td partition.dd |grep keyword

Sleuthkit has the "srch_strings" version of strings command.

The offset is in bytes, can calculate the block and find the inode.

You can feed meta data into an SQL database for fast searching:

• tsk_loaddb image.dd

Searching and indexing is very advanced in commercial tools

In a hash database the hashes of individual files are stored. This can be used to:

• find or ignore matching file sets using hash values
• There are lists available of hashes of system files so they can be excluded from searches and analysis
  • NSLR is an example of a list of known "good" files.
• Own custom databases of hashes of good and bad files can be created.

Some agencies have special hash databases to find illegal materials

The sleuthkit sorter :

• creates a report of identified files (incl. deleted)
  • sorter -d . partition.dd
• Sorted extraction of files
  • sorter -s -d . partition.dd
• Sorter only includeing hash database
  • sorter -a contraband.db -d . partition.dd
• Sorter excluding NSRL database
  • sorter - nsrl_db -d . partition.dd

It is configurable perl script that uses multiple TSK tools.