David Cowen Matthew Seyer G-C Partners, LLC



Similar documents
Windows NT File System. Outline. Hardware Basics. Ausgewählte Betriebssysteme Institut Betriebssysteme Fakultät Informatik

Outline. Windows NT File System. Hardware Basics. Win2K File System Formats. NTFS Cluster Sizes NTFS

File System Forensics FAT and NTFS. Copyright Priscilla Oppenheimer 1

New Technologies File System (NTFS) Priscilla Oppenheimer. Copyright 2008 Priscilla Oppenheimer

FORENSIC INSIGHT; DIGITAL FORENSICS COMMUNITY IN KOREA. NTFS Log Tracker. blueangel. forensic-note.blogspot.kr.

TRIFORCE ANJP. THE POWER TO PROVE sm USER S GUIDE USER S GUIDE TRIFORCE ANJP VERSION 3.10

Open Source Data Recovery

Encrypting MySQL data at Google. Jonas Oreland and Jeremy Cole

This text refers to the 32bit version of Windows, unfortunately I don't have access to a 64bit development environment.

REPORT DOCUMENTATION PAGE

NTFS Documentation. Richard Russon Yuval Fledel

Windows OS File Systems

The Windows File Articles -> Software Oct , 00:45 (UTC+0)

A Forensic Investigation of PL/SQL Injection Attacks in Oracle 1 st July 2010 David Litchfield

Lecture 18: Reliable Storage

Prof. Dr. Ing. Axel Hunger Dipl.-Ing. Bogdan Marin. Operation Systems and Computer Networks Betriebssysteme und Computer Netzwerke

ZFS On-Disk Data Walk (Or: Where's My Data) OpenSolaris Developer Conference, June 25-27, 2008 Prague

Caml Virtual Machine File & data formats Document version: 1.4

File Systems for Flash Memories. Marcela Zuluaga Sebastian Isaza Dante Rodriguez

InnoDB Database Forensics: Reconstructing Data Manipulation Queries from Redo Logs

File System Design and Implementation

Volume Serial Numbers and Format Date/Time Verification

Storage Efficient Backup of Virtual Machine Images

RECOVERING FROM SHAMOON

Information Systems. Computer Science Department ETH Zurich Spring 2012

Algorithms and Methods for Distributed Storage Networks 7 File Systems Christian Schindelhauer

PSM/SAK Event Log Error Codes

File Systems Management and Examples

SQL Server Transaction Log from A to Z

Deleted File Recovery Tool Testing Results

Review NTFS Basics. Behzad Mahjour Shafiei, Farshid Iranmanesh, Fariborz Iranmanesh. Bardsir Branch, Islamic Azad University, Bardsir, Iran

FORENSIC ANALYSIS OF USB MEDIA EVIDENCE. Jesús Alexander García. Luis Alejandro Franco. Juan David Urrea. Carlos Alfonso Torres

3. USB FLASH DRIVE PREPARATION. Almost all current PC firmware permits booting from a USB drive, allowing the launch

FAT32 vs. NTFS Jason Capriotti CS384, Section 1 Winter Dr. Barnicki January 28, 2000

Xbox 360 File Specifications Reference

CHAPTER 17: File Management

Incident Response and Computer Forensics

The Linux Virtual Filesystem

Oracle Cluster File System on Linux Version 2. Kurt Hackel Señor Software Developer Oracle Corporation

Storage and File Systems. Chester Rebeiro IIT Madras

Just EnCase. Presented By Larry Russell CalCPA State Technology Committee May 18, 2012

EnCase 7 - Basic + Intermediate Topics

CTNET Field Protocol Specification November 19, 1997 DRAFT

Windows 7: Current Events in the World of Windows Forensics

Application Note. Introduction AN2471/D 3/2003. PC Master Software Communication Protocol Specification

Crash Recovery. Chapter 18. Database Management Systems, 3ed, R. Ramakrishnan and J. Gehrke

How to recover partitions and files. (Freeware Guide) Step by step with examples

Analysis of Evidence in Cloud Storage Client Applications on the Windows Platform

Linux Kernel Architecture

Module 2: Database Architecture

COSC 6374 Parallel Computation. Parallel I/O (I) I/O basics. Concept of a clusters

Chapter 12 File Management

OCFS2: The Oracle Clustered File System, Version 2

Chapter 13 File and Database Systems

Chapter 13 File and Database Systems

File System Reliability (part 2)

Flexible Storage Allocation

Review. Lecture 21: Reliable, High Performance Storage. Overview. Basic Disk & File System properties CSC 468 / CSC /23/2006

Introduction to The Sleuth Kit (TSK) By Chris Marko. Rev1 September, Introduction to The Sleuth Kit (TSK) 1

COS 318: Operating Systems. File Layout and Directories. Topics. File System Components. Steps to Open A File

COS 318: Operating Systems

Preface. DirX Document Set

FILEMAKER SERVER 12 BACKUPS FREQUENTLY ASKED QUESTIONS

File-System Implementation

1. Introduction to the UNIX File System: logical vision

Forensic Imaging and Artifacts analysis of Linux & Mac (EXT & HFS+)

Extensible Storage Engine (ESE) Database File (EDB) format specification

A Forensic Comparison of NTFS and FAT32 File Systems

UNDELETE Users Guide

Automating the Computer Forensic Triage Process With MantaRay

The Curious Case of Database Deduplication. PRESENTATION TITLE GOES HERE Gurmeet Goindi Oracle

How to Troubleshoot the Remote Backup Client log Error Message:

UVA. Failure and Recovery. Failure and inconsistency. - transaction failures - system failures - media failures. Principle of recovery

XFS File System and File Recovery Tools

Supporting ZDOs with the XBee API

[ X OR DDoS T h r e a t A d v i sory] akamai.com

Command Param1 Param2 Return1 Return2 Description. 0xE9 0..0x7F (id) speed pos_high pos_low Set servo #id speed & read position

Determining VHD s in Windows 7 Dustin Hurlbut

EWF specification. Expert Witness Compression Format specification. By Joachim Metz

WIZnet S2E (Serial-to-Ethernet) Device s Configuration Tool Programming Guide

Forensically Determining the Presence and Use of Virtual Machines in Windows 7

HARD DISK MANAGER 14 / FULL FEATURES LIST. HDM 14 Suite. Features. HDM 14 Pro. Drive Partitioning. Data Backup & Restore

Backup Exec 12.5 Icons Glossary

Maximizing VMware ESX Performance Through Defragmentation of Guest Systems. Presented by

Digital Investigation

Dolphin In-Circuit programming Updating Firmware in the field

CX-Supervisor CX-MODBUS TCP

UNDELETE Users Guide

Using the HFSD journal for deleted file recovery

Dr Michael Cohen. This talk does not represent my Employer. April 2005

Introduction to BitLocker FVE

MUSCLE Cryptographic Card Edge Definition for Java 1 Enabled Smartcards

Enterprise Manager Performance Tips

TestDisk Step By Step CGSecurity

Ans.: You can find your activation key for a Recover My Files by logging on to your account.

Finding a needle in Haystack: Facebook s photo storage IBM Haifa Research Storage Systems

ECE 7650 Scalable and Secure Internet Services and Architecture ---- A Systems Perspective

Digital forensic implications of ZFS

Data recovery Data management Electronic Evidence

Practice Exercise March 7, 2016

Transcription:

David Cowen Matthew Seyer G-C Partners, LLC

Records File System Metadata Changes Optionally Can Retain More Depending on File System Options Allows File System to Return to a Clean State Allows an examiner to determine prior states of files, a forensic time machine.

NTFS Ext3 Ext4 HFS+ JFS

Transaction Based NTFS Redo and Undo Operations (Before and After) Block Based Ext3, Ext4, HFS+ Blocks with Changes (Redo Operations Only)

Journal Depicts Recent Events Only as far back as the journal records Use Volume Shadow Snapshots to extend timeframe Events are Determined Via Operation Signatures Determine Application Signatures

$LogFile is split into pages Generally 4096 bytes Two Sections: Restart and Logging Great Paper on the $LogFile s Structure A Dig into the $LogFile http://forensicinsight.org/wp-content/uploads/2012/05/insight_a-diginto-the-logfile.pdf

Restart Header 0x00 0 1 2 3 4 5 6 7 8 9 A B C D E F RSTR 0x10 System Page Size Update Seq. Offset Update Seq. Count Log Page Size Restart Offset Check Disk LSN Minor Version Major Version 0x20 Update Sequence Array 0x30 Current LSN Log Client Client List Flags 0x40 0x50 UNKNOWN 0x60 0x70 Oldest LSN Restart LSN

Page Header 0 1 2 3 4 5 6 7 8 9 A B C D E F 0x00 0x10 0x20 0x30 RCRD (signature) Flags Update Sequenc e Offset Page Count Last End LSN Update Sequenc e Count Page Position Next Record Offset Update Sequence Array Last LSN or File Offset Word Align DWord Align Page Count: Number of pages that are used for the transaction run. Page Position: The current page number of a transaction run. Next Record Offset: Offset of last LSN on the page. Last LSN: Last overall LSN on page (includes the overlapping LSNs). Last End LSN: Last complete LSN on page. Update Sequence Array: Array containing the update sequences for replacement. The first two bytes of the value is the Update Sequence Value. These are used every 512 bytes.

LSN Record Header 0 1 2 3 4 5 6 7 8 9 A B C D E F 0x00 Current LSN Previous LSN 0x10 Client Undo LSN Client Data Length Client ID 0x20 Record Type Transaction ID Flags Alignment or Reserved Redo Redo Undo Undo Target 0x30 Redo OP Undo OP Offset Length Offset Length Attribute MFT Alignment Record Attribute Alignment or 0x40 Cluster or Target VCN Offset Offset Reserved Index Reserved 0x50 Target LCN Alignment or Reserved LCNs to Follow

LSN Record Header Current LSN: The LSN of the current record. Previous LSN: The LSN of the previous record. Client Undo LSN: Usually the same as Previous LSN. Client Data Length: Length of the LSN record starting at Record Offset. Record Type: 0x01 is a General Record, and 0x02 is a Check Point Record. Flags: 0X00 Record does not overlap next page, 0x01 Record does overlap. Redo Op: Redo operation code. Undo Op: Undo operation code. Redo Offset: Offset to start of redo data (starting from Redo Op offset). Redo Length: Length of redo data. Undo Offset: Offset to start of undo data (starting from Redo Op offset). Undo Length: Length of undo data. LCNs to Follow: 0x01 LCNs follow LSN Header, 0x00 no LCNs follow LSN Header. Record Offset: The MFT record offset if change affects an MFT record, otherwise 0x00. Attribute Offset: The offset of the attribute effected if an MFT record. Target LCN: Redo/Undo data s logical cluster number on disk.

Determined by Redo and Undo Operation Noop 0x00 DeleteDirtyClusters 0x0A ClearBitsInNonresidentBitMap 0x16 CompensationLogRecord 0x01 SetNewAttributeSizes 0x0B PrepareTransaction 0x19 InitializeFileRecordSegment 0x02 AddIndexEntryRoot 0x0C CommitTransaction 0x1A DeallocateFileRecordSegment 0x03 DeleteIndexEntryRoot 0x0D ForgetTransaction 0x1B WriteEndOfFileRecordSegment 0x04 AddIndexEntryAllocation 0x0E OpenNonresidentAttribute 0x1C CreateAttribute 0x05 DeleteIndexEntryAllocation 0x0F DirtyPageTableDump 0x1F DeleteAttribute 0x06 SetIndexEntryVcnAllocation 0x12 TransactionTableDump 0x20 UpdateResidentValue 0x07 UpdateFileNameRoot 0x13 UpdateRecordDataRoot 0x21 UpdateNonresidentValue 0x08 UpdateFileNameAllocation 0x14 UpdateMappingPairs 0x09 SetBitsInNonresidentBitMap 0x15 References: A Dig into the $LogFile Recoverability Support in Windows NT File System (NTFS)

Structure Examples Index Entries Redo Op 0x0E : Undo Op 0x0F Redo AddIndexEntryAllocation and Undo DeleteIndexEntryAllocation Redo Op 0x0F : Undo Op 0x0E Redo DeleteIndexEntryAllocation and Undo AddIndexEntryAllocation Whole MFT Entry Redo Op 0x02 : Undo Op 0x00 Redo InitializeFileRecordSegment and Undo Noop Redo Op 0x00 : Undo Op 0x02 Redo Noop and Undo InitializeFileRecordSegment Update Resident Value $SI Changes Redo Op 0x07 : Undo Op 0x07 Redo UpdateResidentValue and Undo UpdateResidentValue (Record contains Undo (original) and Redo (new) data)

0x1B098 0x1B228 InitializeFileRecordSegment Transaction at 0x1B228 AddIndexEntryAllocation Transaction at 0x1B098 *Redo InitializeFileRecordSegment contains whole MFT Record Entry

0x1E910 0x1EB78 DeleteAttribute Operation at 0x1E910 Create Attribute Operation at 0x1EB78

0x20FB8 0x21178 DeallocateFileRecordSegment Operation at 0x21178 DeleteIndexEntryAllocation Operation at 0x20FB8 *Redo DeallocateFileRecordSegment only contains 24 bytes of MFT Entry

Consists of five block types and file system blocks Descriptor Block The descriptor block contains the entries that list which file system block a given journal block corresponds to. Seen as FS Block # in JLS. Commit Block Only contains the standard header which gives you the block type and sequence number for the committing transaction. Superblock v1 The journal superblock v1 contains static information about the journal such as the journal block size, size of the journal, and the first block of log information. It also contains information that describes the current state of the log such as the first commit ID expected in the log and the block number of start of the log. Superblock v2 The journal superblock v2 contains the same information as the v1, along with some extra information such as feature sets, the journal s UUID, the number of file systems sharing the log, journal block limits, and file system IDs using the journal. Revoke Block This block lists the file system blocks that have been revoked.

Create File - System Changes 5: 66 -> Inode Bitmap 6: 1 -> Group Descriptor Table 7: 67 -> Inode Table 8: 577 -> Data Block 9: 65 -> Data Bitmap Journal Block 8: FS Data Block 577

Rename File - System Changes 12: 67 -> Inode Table 13: 577 -> Data Block Journal Block 13: FS Data Block 577

Delete File - System Changes 16:577 -> Data Block 17:67 -> Inode Table 18:0 -> Super Block 19:65 -> Data Bitmap 20:1 -> Group Descriptor Table 21:66 -> Inode Bitmap Journal Block 16: FS Data Block 577

A block/redo only journal much like Ext3/4 Used in both OSX and ios Apple has a built in journal utility but we need to expand it much like Ext3

In preliminary research of this journal In ios 4/5/6/7 we can decrypt deleted files as the journal will contain the inode and cipher block to apply Much like in Ext3 we will need to mine the previous blocks for prior states and file names as well as find artifacts that point to inodes

NTFS Resources: blueangel. A Dig into the $LogFile. May 2012. http://forensicinsight.org/wpcontent/uploads/2012/05/insight_a-dig-into-the-logfile.pdf. Singireddy, Pramada. Recoverability Support in Windows NT File System (NTFS). March 10th, 2010. http://www.docstoc.com/docs/28691891/ntfs_mod HFS+ Resources: Using the HFS+ journal for deleted file recovery http://www.dfrws.org/2008/proceedings/p76-burghardt.pdf

Follow us on Twitter @hecfblog Read the blog http://hackingexposedcomputerforensicsblog.blogpost.com Email us: dcowen@g-cpartners.com