Welcome to new students seminar!! Security is a people problem. forensic proof.com JK Kim

Transcription

1 Welcome to new students seminar!! Data Recovery Security is a people problem proneer.tistory.com JK Kim

2 Outline Data & Recording Method Definition & Classification Recovering data after physical damage Recovering data after logical damage Recovering data after deletion Studies : the trends in the field

3 Data Data is information that can be stored and used by a computer program. In computer science, data is anything in a form suitable for use with a computer. Data is often distinguished from programs. Wikipedia

4 Recording Method Magnetic Recording Hard drive, Recoding tape, credit cards Optical Recording Compact Disk or Digital Versatile Disc Electronic Recording Memory type

5 Definition Data recovery is theprocess ofsalvaging datafromdamaged damaged, failed, corrupted, or inaccessible secondary storage media when it cannot be accessed normally. Primary Storage? Often the data are being salvaged from storage media such as hard disk drives, storage tapes, CDs, DVDs, RAID, and other electronics.

6 Classification Recovering dataafter after physical damage Recovering data after logical damage Recovering data after deletion

7 Recovering data after physical damage A wide variety of failures can cause physical damage to storage media. Physical damage always causes at least some data loss. Most physical damage cannot be repaired by end users.

8 Recovering data after physical damage Recovery techniques Hardware repair Removing a damaged PCB (printed circuit board) and replacing it with a matching PCB from a healthy drive. Removing the hard disk platters from the original damaged drive and installing them into a healthy drive.

9 Recovering data after logical damage Power outages Problems with hardware (especially RAID controllers) System Crashes

10 Recovering data after logical damage Recover techniques A mechanism to prevent logical damage Journaling function of file systems Battery backup UPS

11 Recovering data after deletion File System Meta Area Data Area FAT(FAT12, FAT16, FAT32, exfat), NTFS ext2/ext3/ext4, XFS, UFS, HFS/HFS+ HPFS, ISO 9660, Veritas File System(VxFS) ZFS, Embedded File System(EFS)

12 Recovering data after logical damage Recovery techniques Recovery using File System metadata Data carving Overwritten data Recovery

13 Recovery using File System metadata Meta Area Data Area

14 Data carving

15 Recovering overwritten data When data have been physically overwritten on a hard disk it is generally assumedthat the previousdata are nolonger possibleto recover. In 1996, Peter Gutmann, a respected computer scientist, presented a paper that suggested overwritten data could be recovered through the use of Scanning TransmissionElectron Microscopy (STEM).

16 Scanning transmission electron microscopy (STEM)

17 Wiping techniques Fast (1 pass) Russian GOST P (2 passes) British HMG IS5 (Enhanced) (3 passes) US Army AR (3 passes) NAVSO P (RLL) (3 passes) NAVSO P (MFM) (3 passes) DoD M (ECE) (7 passes) Bruce Schneier (7 passes) Peter Gutmann (35passes)

18 Studies : the trends in this field Foremost Linux based program data for recovering deleted files and first published in Uses a configuration file to specify headers and footers to search for. Scalpel Open source program for recovering deleted data originally based on foremost. Presented at the DFRWS conference in 2005.

19 Studies : the trends in this field DFRWS 2006 Challenge 50 MB raw file and has no file system, but it contains file fragments. Extract as many full JPEG, ZIP, HTML, Text, and Office files as possible from it. DFRWS 2007 Challenge 330 MB raw file and has no file system, but it contains many files and file frag (JPEG, ZIP, HTML, Text and Microsoft Office) and multimedia, document, e mail format.

20 Studies : the trends in this field SL Garfinkel, Carving contiguous and fragmented files with fast object validation, SJ Veenman, Statistical disk cluster classification for file carving, G Richard, V Roussev, L Marziale, Ml Cohen, In place File Carving, Advanced carving techniques, Effective Carving (reduce false positive), Smart Carving

21 Question & Answer