Hey everyone welcome to the section artifacts extraction and analysis with Selye tools in the previous
section we covered the image acquisition phase of the digital forensic process.
In this section we'll focus on the extraction and analysis phase taking advantage of the appropriate
command line tools installed on Kalli Linux.
First we'll take an overview of the sleuth kit a set of CSI tools to analyze file systems.
We will cover Reg Ripper a tool specifically written to analyze the Windows registry will also show
various tools to extract and analyze browser and e-mail artifacts and various tools to analyze different
kinds of files.
Finally we'll see how to build a super timeline with log to timeline Plaxo.
Let's move on to the first video the section overview of the sleuth kit and file system analysis in
the previous video introduction to forensic imaging.
We covered the physical structure and addressing of a hard disk.
We're going to recall the most important concepts about disk partitioning volumes and biosystems.
We're also going to introduce the sleuth kit explaining the function of its categories of tools.
Finally we're going to show their usage to analyze the file system of an acquired image.
The first sector of a hard disk is called Master Boot Record or MVR which contains the bootstrap code.
And the partition table which contains the entries with the information about each partition on the
disk a partition can be defined as a set of contiguous sectors of the disk that are formatted with the
same file system.
Older computers that rely on MPR can have a maximum of four primary partitions though extended partitions
can be created.
Newer computers that come with the unified extensible firmware interface or UGF I use is globally unique
ID or ID partition table that allows up to 128 primary partitions.
The partition table itself is not usually of great interest to the forensic examiner unless there are
some partitions to be recovered due to the partition table corruption.
A great tool to recover partitions is test disk installed on Kelly Linux which also works on raúl disk
images a volume can be defined as a logical set of data formed by one or more disk partitions of all
you may even span several physical disks while a partition can only reside on a single disk.
Each volume is associated with a file system a file system defines the storage organization and management
of the data on the volume data on a file system is structured in files and directories.
A file can be formed by one or several blocks or clusters which are the smallest data units available
generally on modern file systems.
Blocks have a size of over 4 kilobytes the furbished associated with a file or directory is associated
on three layers.
The file main data and meta data the file names stores the name of the file and the pointers to the
relative metadata the metadata contains all the other information about the file or directory such as
the owner timestamps permission and the pointers to the data blocks.
These are where the actual contents of the file is stored.
Having introduced the fundamental concepts about disk partitioning volumes of Biosystems Let's show
how to practically analyze a file system using sleuthed kit.
The sleuth kit or TS K is a suite of biosystem forensic Seelye tools developed by Brian carrier one
of the major experts in biosystem forensic analysis.
It's based on part of the code of the coroner's toolkit or TCT created in the late 90s by wheat's Venetia
and Dan farmer while TCT can only run and be used to analyze Unix derived osis TS K is multi-platform
and now supports many different file systems.
It can analyze different image formats like raw disk DWF And at that than the edges.
DSK is installed by default on Kelly Linux and the latest version at the moment is for Dot 3.0.
The tools included in TS k are divided into groups depending on the layer on which they operate and
the type of function they carry on the prefixes of the names of the tools indicate the letters and M
is for tools that operate at the volume.
Media management layer f s operates on file system structures be L.K. operates at the data unit or block
layer.
I operates the metadata or inode layer.
F operates at the file name layer.
Now the suffixes indicate their function and take the names of the respective Unix commands.
For example stat displays general information about the queried item LS list the contents of the query
layer.
Cat dumps and extracts dumps or extracts the content of the query letter.
There are also other tools that don't follow this naming convention.
Now we're ready to analyze the file system.
Now we're ready to analyze a file system and we're going to use the image of the disk that we acquired
in the video drive imaging with DC 3D from the previous section.
As a practical example remember that the image we acquired was split in 13 files so we could ask ourselves
how to deal with this issue.
Don't worry.
TS K tools can also work on split images.
Don't worry because TS K tools can also work on split images.
The highest layer is the volume layer and the first tool we introduce is and then LS which displays
the layouts of the partitions in a volume we move in the directory where the split image files are stored
and list the content of the directory.
We then execute and then ls with the argument which is the name of the image followed by an asterisk
to include all the split image files.
As you can see the output shows the partition type D.O. S until the sector size 512 bytes and the partition
table.
The output is very similar to that of the F disk tool with the difference and then LS also shows unallocated
sectors of the disk and displays the partition offsets in number sectors.
In this case we have only one partition formatted with the NTFS file system.
We leave the analysis of the unallocated sectors of the disk when we will cover file carving and data
recovery to display information about the file system a tool the prefix can help us at the stat
from the MLS output.
We see that the NTFS file system starts at sector number 63 so we have to specify the offset with the
o option.
The stat output shows very detailed information about the file system such as the type volumes name
ID
OS version and the last written checked amount of times the second part of the output shows the file
systems metadata that's the location of the master file table or NFTE the size of the MFT entries the
entry associated with root directory which is number five is shows other information such as the sector
and cluster size and below the dibber file attributes the NFTE contains the file systems metadata and
the entries for each file and directory.
These meta data are stored in special files in the root directory that begin with a simple dollar sign
which are not visible using Windows Explorer to list these files.
We can use F.L. stool instead
by default.
It lists the root directory.
The output shows one row for each file or directory on the very left of the row.
We had the file type.
The R stands for regular file while the D for directory.
Next we have the metadata address Bearse number on the left indicates the NFTE entry.
Next is the attribute type.
1:28 is for data which means the corresponding files are deleted.
The first 16 entries are reserved for special files starting with dollar sign for example entry number
0 is the dollar sign.
NFTE file that stores the meta data about the MFT itself.
At the OS is also able to display only deleted files and to recurse into directories to extract all
the deleted entries of the file system.
We execute this command
where the option is for also displaying the full path of each file and the output is redirected to the
deleted text file.
There's also an option to create a body file for the generation of a timeline with a Mack time tool.
Another tool that could generate a body file is I guess that list the structure of the MFT entries.
To display the details about a single MFT entry we can execute the ice at tool for example we could
display the metadata of the MFT entries 0 the dollar sign and F.T. file
else that shows information such as the ownership SIMD time stamps file attributes and also the nonresident
resident data clusters associated.
We can also stream to the output data.
We can also stream to the data output of a single cluster with the real k cat tool.
And then pipe the output to the X XTi data viewer to display the contents
another useful tool the block layer is be L.K..
By default it copies the content of all unallocated blocks the volume the output should be redirected
a file and used as input for data carving tools to recover deleted files as we'll see later in the course.
The recovery of deleted files could also be done manually with the TS K tools.
Finally just a few words about the Mac type tool.
It generates a timeline of a file system activity taking as input a body file created as as we've seen
with FLSA and or eyeless.
For example we execute MacT time with the body file previously created with less we would execute this
command.
We'll see another way to generate a timeline later in the course.
Well done.
In this video we've covered the most important concepts about disk partitioning volumes and biosystems.
We introduced ourselves.
The sluffed kit explaining the function of its categories of tools then how to use the most important
ones to analyze the NTFS file system of a Windows image in the next video will cover another important
topic in Windows forensics registry analysis will use a tool designed for this reg Ripper.