Hey everyone welcome to file carving and data recovery and this section will introduce the file carving
process and important concepts such a slack unallocated space and deleted files will also cover the
recycle bin on Windows and a tool to examine it.
Refuter too.
Next we will cover file carving tools a tool to automatically recover deleted files from a disk image
like for most scalpel and photo rack then will show how to use bulk extractor a tool that extracts much
information including deleted ones from a disk image.
Now we move on to the first video of the section file carving overview.
We're going to take a look at the file carving process and important concepts like slack unallocated
space and deleted files will also cover refuted to a tool to examine the recycle bin on windows in the
first video section 3 overview of the sleuthed kit and file system analysis.
We solve with the smallest addressable data units on file systems are called blocks or clusters.
They could be of different sizes.
Also depending on the file system but generally blocks of 4 kilobytes are used the block size is therefore
the smallest disk space that a file can use if a file is larger than the block size.
Then various blocks are allocated to that file.
The number of blocks depending on the file size.
If the file size is not an exact multiple of the block size the last allocated block is only partially
used to store the files data.
The space slipped between the logical end of the file and the end of the block is called slack space.
For example as we could see in this diagram if a file size occupies only two kilobytes of the last block
and the block size is 4 kilobytes it uses only the first two kilobytes and the remaining two of the
Block are unused and forms the file slack space.
The analysis of slack space is important for a forensic examiner because some tools for example be map
on Linux allowed to hide data in a file slack space.
Select space could also contain remnants from a previously deleted file.
Indeed one of byelaws deleted the relative directory entry is removed but the master file table entry
on Windows and the i node on Linux still remain.
Also its allocated blocks remain intact but are marked as free.
Which are not used and could be allocated to another file.
These blocks are part of the so-called UN allocated space unallocated space could also reside between
two disk partitions and could be revealed by the end and LS tool as we've seen in the previous section
covering the sleuthed kit until they are not allocated again and overwritten the blocks contents could
be recovered using the sleuthed kit tools or with specific data carving tools as we're going to see
in the next video data carving is the process of identifying and extracting meaningful data out of the
unallocated and slack space.
It's usually performed to recover those deleted files that no longer have an entry in the files table
that could tell which data blocks were allocated to them.
In previous sections we've seen that files are identifiable through the magic numbers included in the
files header data carving relies on located the magic number of a certain type of file and copying all
the binary data between it and the corresponding end of file marker or FOAF if the files data are stored
on contiguous blocks then the process is straightforward.
If the file is fragmented i.e. its blocks are scattered on the disk then Carbin becomes more challenging.
Algorithms that use houris stick techniques and can also handle files fragmentation had been developed
and used in carving tools on modern operating systems.
Files are not permanently deleted on a first instance unless the user explicitly does so instead their
first moved to the recycle bin or trash depending on the OS.
They could be restored in its original locations or permanently deleted when the recycle bin is emptied.
The data blocks are left untouched and are not marked as free until the file remains in the recycle
bin.
On Windows XP on Windows XP systems or earlier deleted files are moved to the recycle or folder into
the sub folders named after the security identifiers of the users.
The original file names paths and deletion times are stored in an index file called info to Windows
Vista.
Newer stores deleted files into a hidden dollar sign recycle bin folder with the same suppled or structure
as Windows XP.
But information about the files are not stored in info to instead they're stored in a pair of files
for each deleted file whose name begins with Dollar Sign Dollar sign one and Dollar Sign are the first
type is an index file that stores the original information while the letter type contains a copy of
the file refuted to is a tool installed on Kelly Linux that allows to examine the contents of the recycle
bin.
Indeed refuse to refute who is an Italian word that means trash refuter to is made up of two tools for
you to analyze info to files and you to Vista to analyze the new dollar sign recycle bin files on Windows
Vista or newer the usage of Rifi to is straightforward.
We simply run the tool with the info to file as the unique parameter
the output displays each files in the recycle bin.
It shows the deleted time original path and the size worthy to Vista is instead usually executed to
scan and analyze recycle bin subaltern's
the recycle bin begins with a security identifier of the user run the tool in the sample folder.
And we can see the output is similar to that of the refuse to put the info to file because it displays
the index with the deleted time original path and the size of each file.
In this video we covered the file carving process.
We introduced concepts like unallocated disk space and file slacke space.
Even the theory behind the identification of deleted files.
Then we introduced the windows recycle bin and saw how to examine it with refuter to tool in the next
video file carving tools were going to cover how to recover a deleted file with a sleuthed kid.
Then some automated file carving tools like for most scalpel and photo rec.