Lab V: File Recovery: Data Layer Revisited

Transcription

1 New Mexico Tech Digital Forensics Fall 2006 Lab V: File Recovery: Data Layer Revisited Objectives - Perform searches based on file headers - Data Carving with Foremost - Zip password recovery Procedures Step 1 An image file (image.dd) is located on /dev/hdb1 as usual. Launch your Linux - Forensics virtual machine. Mount /dev/hdb1 to /mnt/recover. The image.dd file is located in /mnt/recover/lab5. This image contains deleted files from a FAT12 floppy disk. Your search may not always be based on evidence in the form of plaintext that is found in the content of a file. For example, you may wish to search for all Word documents without having knowledge of their content. As another example, think of an image file. All the data in an image is binary so a search list is of no use. You are going to learn another method for recovering deleted files at the data layer. This method will recover files based on their file types. Computers recognize files types by a binary header contained at the beginning of the file. Linux does not care about file extensions because it simply reads these headers to dertermine the type of file. Some files will have a footer as well. Different file types will have unique headers. You are going to determine what the header is for a Word document. Begin by going to the KMenu and then the Office Menu. Launch OpenOffice Writer. Create a document with any arbitrary text and go to Save As. Make sure you change the file type to Microsoft Word 97/2000/XP. Save the document to /tmp/test.doc. Start KhexEdit and open your test.doc file. View the file's hex representation. Create an additional Word document to compare with if you wish. Question 1: What hex sequence do you think represents the header of a

2 Word document? Note, 8 to 10 bytes is significant enough. D0 CF 11 E0 A1 B1 1A E Step 2 You are now going to perform a search with the header of the file type you're interested in as your keyword. Extract unallocated space from the image to /mnt/recover/lab5/image.unalloc.dls NOTE: Windows formatted floppies are FAT12 You need to search for a header from the hex contents of the dls file. To view the file in hex a utitlity called hexdump can be used. Use the -C option to list the contents in hex-ascii form, similar to the view in KhexEdit. Finally, grep will be used to search for the header (just use 8 bytes for the header). # hexdump -C /mnt/recover/lab5/image.unalloc.dls grep - i XX XX XX XX XX XX XX XX NOTE: XX XX XX XX XX XX XX XX is the header you identified in Question 2. Notice in the output that the byte offset of the match is in hex. You can use kcalc, located on your toolbar, to convert this number to decimal. Make sure the hex radio button is selected and enter the hex number. Then select the decimal radio button. The number is converted to decimal. Convert that number to a block offset for unallocated space. Use dcalc to find the block offset in the original image file. Question 2: What was the entire process for determining the block offset in the original image? Show your choice of commands. What block in the original image file does the Word document start? Use fsstat to determine the cluster (block) size of the image. # fsstat -f fat12 /mnt/recover/lab5/image.dd The header was found at byte offset 23040; divided by the cluster size found with fsstat (512) results in a block offset of 45 in the dls file. Dcalc is used to find the block offset in the original image file. # dcalc -f fat12 -u 45 /mnt/recover/lab5/image.dd The Word document starts in block 78. Remember the last argument in dcat can be used to specify the number of sequencial blocks you wish to extract (Note: This file was noncontiguous in Labs

3 III and IV, but is contiguous in this lab). Use dcat to extract the file. Hint: Don't write the output of dcat to a file first thing. Use the -h option with dcat and view the hex-ascii representation on the screen first by piping to less. Use this to try and find the ending block of the Word file. Get familiar with how these files look in hex. With a little bit of trial and error you should be able to guess the number of blocks to extract the whole file. You'll know you extracted the correct number of blocks if it opens in OpenOffice Writer. If you have no idea where to start, try determining the minimum filesize for a small or blank Word document. Question 3: How many blocks did you need to extract to recover the Word document? Is this method of data carving (locating the file header) helpful for recovering plaintext files? Why or why not? 44 blocks were needed to recover the Word Document. Plaintext files have no binary header information so this method would not work. They contain pure ascii data. Foremost: A Data Carving Utility Step 3 Now that you understand how to perform data carving with common linux tools, you will learn a tool that is specifically designed to make data carving easy. This tool is foremost. Foremost operates from a configuration file that you edit based on your search needs. The configuration file will contain a file extension, whether the header is case sensitive, followed by a default max size, followed by the header and a footer if there is one. The configuration file has been saved to /mnt/recover/foremost.conf View the configuration file and read the beginning comments for a more thourough description. # less /mnt/recover/lab5/foremost.conf Scroll down in the configuration file to where doc files are specified. You should recognize the header sequence. In fact, Microsoft Office Powerpoint and Excel documents have this same header, so actually you may be recovering any one of these three types. Take a look at the configuration for jpg files.

4 Notice jpgs have a footer as well, which is ideal for recovering complete files. Foremost allows you to edit the configuration file to add more file types. You are going to add the information needed to recover a zip file. Under the Miscellaneous heading of the configuration file specify the extension as zip, yes the header is case sensitive, a max file size of bytes, and a header that is \x50\4b\x03\x04. NOTE: Hex 50 4B is 'PK' in ascii which came from the original pkzip utility. You are interested in recovering Microsoft Office files, jpegs, and zip files. Uncomment the appropiate lines in the configuration file to make this possible. Save the configuration file and exit. Run foremost and specify the configuration file you are using. # foremost c /mnt/recover/lab5/foremost.conf /mnt/recover/lab5/image.dd Step 4 After foremost completes you will find a directory /mnt/recover/lab5/foremostoutput/. NOTE: You will not be able to run foremost again if the foremost-output directory is not empty. View the contents of this directory. Inside the foremost-output directory is a file named audit.txt. This file reports the byte offsets of the files it found. Question 4: Try opening the files recovered. You can use unzip at the command line for any zip files found. Which files opened? Why do you think some of the files are corrupt and not opening? The jpeg file opens because it is the correct filesize. Since jpeg files contain footers, foremost can extract the proper amount of bytes. The Word document opened even though foremost extracted extra bytes for this file because there is no footer and foremost had to use the max bytes field in the configuration file. For the zip file, foremost extracted extra bytes as well, but this did corrupt the file to where it won't open. Question 5: Use Khexedit to view the Word document you restored with

5 foremost. There appears to be a lot extra data in the file because of the max file size field in the configuration file. With regards to whether the file opens in Office or not, what can you conclude about restoring Word documents? As long as the entire data belonging to a Word document is present it appears that an Office application will open it. It does not matter that there is extra data appended to the document. The Office application is able to ignore the garbage data. This makes foremost pretty effective for recovering Word documents as long as the max file size is large enough. Use Khexedit to modify the files that did not open so that they do. You do not have the original file s sizes or hash value so don t worry about restoring the file exact. They just have to open. Be sure to save the file with a different name in case you need to start over. (Note: being prompted for a password on the zip file means it has been restored correctly). HINT: Areas of the disk that have not been written to on FAT12 are filled with hex F6. Question 5: Explain how you determined what to modify to make the files open correctly. The recovered zip file was appended with a bunch of F6s. These represent unwritten blocks on a FAT12 file system so they do not belong to the actual zip file and can be deleted. Question 6: You are stopped from decompressing the zip file because of a password. After viewing the file in the hex editor what do you know about the file that is contained in the zip file? With a hex editor you can see the names of the files that are in the zip file. This zip file contains what appears to be a Word document call guide_to_prog_lang.doc. Bonus Question: A footer actually exists for zip files as well. Create some zip files ( # zip zipfile-name files) and analyze the data in a hex editor to determine a footer. (Hint: Read about the wildcard character in the configuration file). What is the footer you found? Modify the configuration file to extract zip files of their original size. All zip files appear to end with '50 4B 05 06' followed by more bytes that are different with each zip file. The number of bytes appears to always be 18 following the '50 4B 05 06'. Therefore, the footer, '\x50\x4b\x05\x06??????????????????' was added to the foremost configuration file. Zip Password Recovery

6 Step 5 An investigator may be faced with lots of password obstacles. There may be passwords on the BIOS, the OS, Office documents, zip files etc. Therefore, password crackers are a common tool for the forensic investigator to carry around. Zipcracker is a linux tool designed to specifially crack zip files. Run zipcracker from the command line. # zipcracker /mnt/recover/lab5/foremost-output/zip-file NOTE: zip-file is the name of the zip file you recovered after modifing it in khexedit. Choose your character set to be a-z. Click Next to begin cracking the zip file. Once you have the password use it to decompress the zip file. Bonus Question: If you use ifind for the deleted files or ils on the disk, there appears to be no meta data information and there are no new files. What is your theory for how these file were deleted? Normally the directory entries would still contain meta data for these file if they were simply deleted. Instead it looks like the disk was formatted with the quick erase option. This method of formatting erases all the directory entries. Step 6 It is very important to do these next steps so that the lab is properly set up for the person who uses the computer after you. Unmount any drives you mounted and shutdown the VMWare system. In VMWare, revert 'Linux - Forensics' back to the snapshot by clicking the 'Revert' button. From the c:\vmware-images\linux - Forensics\ directory remove all files beginning with 'Linux Forensics-Image'. Question 7: What are your comments and suggestions for this lab?