![\"Partition](\"https://assets.ine.com/content/labs/cybersecurity-labs/jason/LAB-3527/partitions_badsector.jpg\")
The Kids Greenland Garden (KGG) is a place where parents take their kids to play in its wonderful green gardens. There were a lot of complaints about Mr.X, the KGG gardener. An official dispute was filed by one of the parents (Sally) when she was positive that something weird was going on by Mr.X and it was time to put an end to it. The police were informed, and a team of first responders was sent to the garden. The day before Sally filed an official dispute, she confronted Mr.X about his weird activity, and that he is doing something wrong. Because of that, what Mr.X did, was ruin his disk drives so he can cover whatever data he is hiding on his disks.
\nIn this case, you are required to understand the disk partition schema and recover if any of the disks on Mr.X's machine were corrupted.
\nHex Workshop, FTK Imager or Disk Editor
", "tasks": "## Tasks\n\n### Task 1: Recovering a Corrupted Disk\nMr.X corrupted his disk before you managed to issue a warrant and acquire his media for investigation. You need to restore the disk to a fully working state to proceed with your investigation.\n\nYou can find the forensic image at C:\\DFP\\Labs\\Module04\\Lab7\\Lab7.001 .\n\nLook at the end of the first sector, which is the sector of the MBR. We are supposed to find an end of sector marker or sector signature which should hold some specific bytes. Are those specific bytes there?\n\n### Task 2: Analyzing The MBR\nNow after you managed to recover the acquired disk, you need to analyze the Master Boot Record (MBR) for the disk, and answer the following:\n* How many partitions are in this disk?\n* Which partition if any, is marked as bootable?\n* For each partition found, identify the following:\n * Starting Sector (or First LBA)\n * No. of sectors in partition\n * Partition Size\n * Partition Type\n\nA variety of forensic tools in c:\\DFP\\Tools\\Disks will help you answer the questions above.", "tasks_html": "Mr.X corrupted his disk before you managed to issue a warrant and acquire his media for investigation. You need to restore the disk to a fully working state to proceed with your investigation.
\nYou can find the forensic image at C:\\DFP\\Labs\\Module04\\Lab7\\Lab7.001 .
\nLook at the end of the first sector, which is the sector of the MBR. We are supposed to find an end of sector marker or sector signature which should hold some specific bytes. Are those specific bytes there?
\nNow after you managed to recover the acquired disk, you need to analyze the Master Boot Record (MBR) for the disk, and answer the following:\n* How many partitions are in this disk?\n* Which partition if any, is marked as bootable?\n* For each partition found, identify the following:\n * Starting Sector (or First LBA)\n * No. of sectors in partition\n * Partition Size\n * Partition Type
\nA variety of forensic tools in c:\\DFP\\Tools\\Disks will help you answer the questions above.
", "published_date": "2020-10-20T15:32:26Z", "solutions": "## SOLUTIONS\n\n### Task 1: Recovering a Corrupted Disk\nWe are going to use Hex Workshop to solve this case, but feel free to use any hexadecimal editor that you like.\n\n[Analysis:]\n\nFirst, open the forensic image \"[Lab7.001]\" file [located at C:\\DFP\\Labs\\Module04\\Lab7\\Lab7.001] using Hex Workshop. You will see something similar to the below:\n\n\n\nUsing FTK Imager, observe that it is only able to show you the raw physical disk space. It is unable to interpret the Master Boot Record (MBR), and display the partitions.\n\n\n\nTake a moment, review the hexadecimal data in the boot record and MBR. Can you see the problem?\n\nIf you look at the end of the first sector, which is the sector of the MBR, we are supposed to find an end of sector marker or sector signature which should hold the bytes 55 AA in hexadecimal.\n\nWhat you see is that instead it is hexadecimal DF DF as we see in the figure above.\n\n[DIY:] By the way, I recommend you check it with another tool as well, just to make sure that it truly cannot identify the disk. In forensics, we always verify.\n\n[Solution:]\n\nSo, what we need to do now, is change those two bytes back to 55 AA and save the disk (for example Lab7-SOL.001).\n\nWe cannot edit images in FTK Imager, but you can in Hex Workshop. Open the image in Hex Workshop\n\nFirst things first, Hex Workshop's display is defaulted to sizing the hexadecimal view to the window size. Resize the Hexadecimal view to show 16 byte rows, by showing columns 0-F (remember we are in hexadecimal!). You can do this by dragging the line between the hex and ASCII data left or right. See image below.\n\nVerify that you see hex DF DF at the end of the sector.\n\nYou now should be looking at row offeset 1FO and column E. Click the first bit \"D\" at offset 0x1E, and then type 55AA (no spaces). If you do this you should see 55 AA in red, ending the row.\n\n\n\nUsing \"Save As\" save this image file as a new image file. Remeber we never want to alter the original evidence, and you want to document the steps you took to do this and why,\n\nNow If what you did was done properly, you should be able to open the newly created disk image in FTK Imager and it should interpret the partitions correctly.\n\n\n\nSo that's it, we managed to recover the disk that Mr.X corrupted by modifying those two bytes on his disk. This proves that digital forensics tools won't be able to identify the disk without those two bytes found at the end of the sector. By the way, I recommend you check it using FTK Imager for example too, just to make sure that it truly cannot identify the disk.\n\nThis type of corruption is not very common, but if you do encouter problems always check for the 55 AA, then begin checking for errors in the partition table it self. You can always compare them to the Volume Boot Record and see if they match up.\n\n### Task 2: Analyzing The MBR\nNow since we managed to recover the corrupted disk, I believe answering the questions below won't be a big problem. Let us move on and answer each one of them.\n\n1. How many partitions are in this disk?\nWe found that the disk has four partitions, and we have proof that could be seen in the figure below:\n\n\n\nWhich partition if any, is marked as bootable?\nNow to answer this question, we need to check the Boot Code in the MBR entries of the disk. Let's use FTK Imager to review them. You need to check for the active partition to see if any are marked as bootable. Refering to highlighted partitions in this images MBR.\n\n\n\nThe boot code is indicated in the first byte in byte of each partition. An active partition will have the status set to 0x80. A non-bootable partition will be set to 0x00\n\nIf we review each partition, refering to the above figure, you will find that all of them are non-bootable partitions.\n\nSo, the answer is there are no bootable partitions on this disk.\n\nLet us move on to the final question.\n\n1. For each partition found, identify the following:\n a. Starting Sector (or First LBA)\n b. No. of sectors in partition\n c. Partition Size\n d. Partition Type \n\nYou can answer these questions using different techniques, let's use FTK Imager.\n\nFrom the first question, we found that there are four partitions, so let us interpret each one of them. Click on the first partition. Then in the details pane, click on properties. The first partition and its details are below:\n\n\n\nOur answers would be:\n a. Starting Sector (or First LBA) = 128\n b. No. of sectors in partition = 1024000\n c. Partition Size = (No. of sectors) X (size of sector)\n\n```\n= 1024000 X 512\n= 524288000 Bytes\n= 500 Megabytes\n```\nIs this equal to you expected result? Compare you calculated size to your expected size in the Evidence Tree. Now this is forensics!\n\n d. Partition Type = 07 which means we have an NTFS partition.\n\n\n\n[Click here for more information on partitions](http://www.tldp.org/HOWTO/Partition-Mass-Storage-Definitions-Naming-HOWTO/x190.html)\n\nUsing the previous directions as a guide, can you determine the remaining partitions?\n\nOur answers would be:\n a. Starting Sector (or First LBA) = 1024128\n b. No. of sectors in partition = 512000\n c. Partition Size = (No. of sectors) X (size of sector)\n\n```\n= 512000 X 512\n= 262144000 Bytes\n= 250 Megabytes\n```\n\n d. Partition Type = 0B which means we have a FAT32 partition.\n\nOn to the third partition, we find the details below:\n\nOur answers would be:\n a. Starting Sector (or First LBA) = 1536128\n b. No. of sectors in partition = 512000\n c. Partition Size = (No. of sectors) X (size of sector)\n\n```\n= 512000 X 512\n= 262144000 Bytes\n= 250 Megabytes\n```\n\n d. Partition Type = 0C which also refers to a partition with FAT32.\n\nAnd finally, the fourth partition we find the details below:\n\nOur answers would be:\n a. Starting Sector (or First LBA) = 2048128\n b. No. of sectors in partition = 2142208\n c. Partition Size = (No. of sectors) X (size of sector)\n\n```\n= 2142208 X 512\n= 1096810496 Bytes\n= 1046 Megabytes\n```\n\n d. Partition Type = 05 which means we have an Extended partition type holding a NTFS file system.\n\nTo better summarize our results and add them to a report in the future, I'm going to create a table and add the final results to the table below:\n\n|Partition|Starting Sector (First LBA)|Number of Sectors|Partition Size in Bytes|Partition Type|\n|---------|---------------------------|-----------------|-----------------------|--------------|\n|First|128|102400|524288000|NTFS|\n|Second|1024128|512000|262144000|FAT32|\n|Third|1536128|512000|262144000|FAT32|\n|Fourth|2048128|2142208|1096810496|NTFS|\n\n[DIY]: I highly recommend you verify these results we obtained using another tool.\n\n(Here is a great reference to bookmark from our friends at Invoke-ir.com)[http://www.invoke-ir.com/2015/05/ontheforensictrail-part2.html]\n\nPartition Type Information:\n\n[http://www.tldp.org/HOWTO/Partition-Mass-Storage-Definitions-Naming-HOWTO/x190.html](http://www.tldp.org/HOWTO/Partition-Mass-Storage-Definitions-Naming-HOWTO/x190.html)\n\n[https://en.wikipedia.org/wiki/Partition_type](https://en.wikipedia.org/wiki/Partition_type)", "solutions_html": "We are going to use Hex Workshop to solve this case, but feel free to use any hexadecimal editor that you like.
\n[Analysis:]
\nFirst, open the forensic image \"[Lab7.001]\" file [located at C:\\DFP\\Labs\\Module04\\Lab7\\Lab7.001] using Hex Workshop. You will see something similar to the below:
\n
Using FTK Imager, observe that it is only able to show you the raw physical disk space. It is unable to interpret the Master Boot Record (MBR), and display the partitions.
\n![\"No](\"https://assets.ine.com/content/labs/cybersecurity-labs/jason/LAB-3527/ftkimager_nopartitions.jpg\")
Take a moment, review the hexadecimal data in the boot record and MBR. Can you see the problem?
\nIf you look at the end of the first sector, which is the sector of the MBR, we are supposed to find an end of sector marker or sector signature which should hold the bytes 55 AA in hexadecimal.
\nWhat you see is that instead it is hexadecimal DF DF as we see in the figure above.
\n[DIY:] By the way, I recommend you check it with another tool as well, just to make sure that it truly cannot identify the disk. In forensics, we always verify.
\n[Solution:]
\nSo, what we need to do now, is change those two bytes back to 55 AA and save the disk (for example Lab7-SOL.001).
\nWe cannot edit images in FTK Imager, but you can in Hex Workshop. Open the image in Hex Workshop
\nFirst things first, Hex Workshop's display is defaulted to sizing the hexadecimal view to the window size. Resize the Hexadecimal view to show 16 byte rows, by showing columns 0-F (remember we are in hexadecimal!). You can do this by dragging the line between the hex and ASCII data left or right. See image below.
\nVerify that you see hex DF DF at the end of the sector.
\nYou now should be looking at row offeset 1FO and column E. Click the first bit \"D\" at offset 0x1E, and then type 55AA (no spaces). If you do this you should see 55 AA in red, ending the row.
\n![\"Fixed](\"https://assets.ine.com/content/labs/cybersecurity-labs/jason/LAB-3527/partitionfixed.jpg\")
Using \"Save As\" save this image file as a new image file. Remeber we never want to alter the original evidence, and you want to document the steps you took to do this and why,
\nNow If what you did was done properly, you should be able to open the newly created disk image in FTK Imager and it should interpret the partitions correctly.
\n![\"Partitions](\"https://assets.ine.com/content/labs/cybersecurity-labs/jason/LAB-3527/ftkpartitions.jpg\")
So that's it, we managed to recover the disk that Mr.X corrupted by modifying those two bytes on his disk. This proves that digital forensics tools won't be able to identify the disk without those two bytes found at the end of the sector. By the way, I recommend you check it using FTK Imager for example too, just to make sure that it truly cannot identify the disk.
\nThis type of corruption is not very common, but if you do encouter problems always check for the 55 AA, then begin checking for errors in the partition table it self. You can always compare them to the Volume Boot Record and see if they match up.
\nNow since we managed to recover the corrupted disk, I believe answering the questions below won't be a big problem. Let us move on and answer each one of them.
\n
Which partition if any, is marked as bootable?\nNow to answer this question, we need to check the Boot Code in the MBR entries of the disk. Let's use FTK Imager to review them. You need to check for the active partition to see if any are marked as bootable. Refering to highlighted partitions in this images MBR.
\n
The boot code is indicated in the first byte in byte of each partition. An active partition will have the status set to 0x80. A non-bootable partition will be set to 0x00
\nIf we review each partition, refering to the above figure, you will find that all of them are non-bootable partitions.
\nSo, the answer is there are no bootable partitions on this disk.
\nLet us move on to the final question.
\nYou can answer these questions using different techniques, let's use FTK Imager.
\nFrom the first question, we found that there are four partitions, so let us interpret each one of them. Click on the first partition. Then in the details pane, click on properties. The first partition and its details are below:
\n![\"Partition](\"https://assets.ine.com/content/labs/cybersecurity-labs/jason/LAB-3527/partition1properties.jpg\")
Our answers would be:\n a. Starting Sector (or First LBA) = 128\n b. No. of sectors in partition = 1024000\n c. Partition Size = (No. of sectors) X (size of sector)
\n= 1024000 X 512\n= 524288000 Bytes\n= 500 Megabytesd. Partition Type = 07 which means we have an NTFS partition.
\n![\"NTFS](\"https://assets.ine.com/content/labs/cybersecurity-labs/jason/LAB-3527/FTKntfsPart.jpg\")
Click here for more information on partitions
\nUsing the previous directions as a guide, can you determine the remaining partitions?
\nOur answers would be:\n a. Starting Sector (or First LBA) = 1024128\n b. No. of sectors in partition = 512000\n c. Partition Size = (No. of sectors) X (size of sector)
\n= 512000 X 512\n= 262144000 Bytes\n= 250 Megabytesd. Partition Type = 0B which means we have a FAT32 partition.
\nOn to the third partition, we find the details below:
\nOur answers would be:\n a. Starting Sector (or First LBA) = 1536128\n b. No. of sectors in partition = 512000\n c. Partition Size = (No. of sectors) X (size of sector)
\n= 512000 X 512\n= 262144000 Bytes\n= 250 Megabytesd. Partition Type = 0C which also refers to a partition with FAT32.
\nAnd finally, the fourth partition we find the details below:
\nOur answers would be:\n a. Starting Sector (or First LBA) = 2048128\n b. No. of sectors in partition = 2142208\n c. Partition Size = (No. of sectors) X (size of sector)
\n= 2142208 X 512\n= 1096810496 Bytes\n= 1046 Megabytesd. Partition Type = 05 which means we have an Extended partition type holding a NTFS file system.
\nTo better summarize our results and add them to a report in the future, I'm going to create a table and add the final results to the table below:
\n| Partition | \nStarting Sector (First LBA) | \nNumber of Sectors | \nPartition Size in Bytes | \nPartition Type | \n
|---|---|---|---|---|
| First | \n128 | \n102400 | \n524288000 | \nNTFS | \n
| Second | \n1024128 | \n512000 | \n262144000 | \nFAT32 | \n
| Third | \n1536128 | \n512000 | \n262144000 | \nFAT32 | \n
| Fourth | \n2048128 | \n2142208 | \n1096810496 | \nNTFS | \n
[DIY]: I highly recommend you verify these results we obtained using another tool.
\n(Here is a great reference to bookmark from our friends at Invoke-ir.com)[http://www.invoke-ir.com/2015/05/ontheforensictrail-part2.html]
\nPartition Type Information:
\nhttp://www.tldp.org/HOWTO/Partition-Mass-Storage-Definitions-Naming-HOWTO/x190.html
\n", "flags": [], "min_points_to_pass": null, "access_type": "default", "user_status": "unstarted", "user_lab_status": null, "user_status_modified": null, "user_flags": [], "global_running_session": null }