Hey Guys welcome to file carving tools in the previous video we introduced.
File carving concepts and the windows recycle bin.
We're first going to show how to recover deleted files from a disk image using the sleuthed kit tools.
Ikat in particular that we're going to cover three command line carving tools that we're going to cover
three CLID tools then we're going to cover three Selye carving tools included by default on Kalli Linux
which are for most scalpel and photo rack before covering automated carving tools.
Let's see an example of how to recover a deleted file using the sleuthed kit tools.
Recall the first video of the previous section overview of TS K and file system analysis.
We can use the FLSA tool to scan an image for deleted files.
We execute this command on a sample image.
The output shows a deleted file with name renamed without the initial letter after the deletion which
has 5 as the MFT entry number to give more info about this file.
We can run the ice stat tool specifying the MFT entry.
The file is not allocated and there is a list of all the sectors where its data resides.
To recover the file.
Here's the ikat tool that by default displays the content of a file identified by the master file table
entry to the standard output.
I can also has a specific option for file recovery which is the r option.
We will execute this option specifying the master file entry and redirect the output to a file named
recover.
Doc we can examine the files metadata with XXIV tool and see that it's actually an N S word document
titled Jimmi jungle.
We're now going to introduce the three Selye carving tools included by default on Kelly Linux for most
scalpel and photo rec.
All these tools car files from raw disk sectors on a lower level than the file system.
Relying on databases of headers and footers of many different types of files and could also work directly
on disk image files to see these three tools in action.
We use a sample image of a fat 32 file system created for this file carving exercise will download this
on the digital forensics tool testing images page.
The exercise is named basic data carving test number one and the image is available as a zipped file
of 11 megabytes of size it contains deleted files of only 61 megabytes of size.
In this way the file size is not so big.
So the carving process is fast but on large images it can take a very long time.
The first carving tool we cover is foremost which has been developed at the Air Force Office of Special
Investigations later updated at Naval Postgraduate School.
The default configuration file for foremost is ATC for most scup which we usually edit only to enable
the recovery of file formats not included in the default configuration.
Let's take a look at our foremost file.
We could see that for each of these formats the headers and footers are provided to enable format.
We simply uncomment the corresponding line.
In this case we don't modify C for most stock comp and we use the default configuration we execute the
foremost on the sample image.
We've downloaded the minatory options are so that specify the output directory where to save the recovered
files and the option that specifies the input image file.
We then execute this command.
We look at the output directory.
In particular at the audit dot text file that reports the extracted files each file is named from the
starting sector number on the image followed by the extension the size in the starting offset and bytes
are also reported at the bottom.
There's a summary of the formats with the numbers of files recovered.
The output directory also contains a subdirectory for each type of file with the corresponding recovered
files.
Now we execute the for most help option to see all the available options if we want to recover only
specific file formats.
There's the option fall by the type of file separated by commas.
We've already seen the option to specify the input file.
If we do not want to save the recovered files to the disk but simply write the audit file we shelfs
specify the w option the V or verbose option also displays the audit file on the standard output.
The second tool we cover is scalpel which is derived from formost the current latest version available
from Cali Linux repositories is 1.6 0.
The latest version is 2.0 and the source is available at the sleuthed can't get hub repository version
2.0 includes interesting new features like multi-threading.
Also on GPS use regular expressions support for headers footers an embedded header FOTR matching scalpels
configuration file is located at ATC scalpel scalpel D-cup.
It's very similar to that for most but the difference is that we first have to uncomment all the lines
relative to the file formats we want to enable because they are not built in once.
In this case we use a configuration file with all the formats enabled scalpels usage is also very similar
to foremost.
We run the scalpel tool on the same image specify in the o option for the output directory and the name
of the image scalpel requires that the output directory be either empty or nonexistent.
We run the tool after the execution of the tool.
Let's look at the output directory.
We have an audit not text file.
As for the foremost look at the audit file we notice here the deleted files extracted are more than
those recovered by foremost.
Scalpel seems to report duplicate files with the same extensions and starting at the same offset.
For example these files blast carving tool we cover is photo rack developed by the same developer of
test disk despite its name.
This utility is not only capable of recovering image files but like the other carby tools can recover
many different file formats.
It's more intuitive to use compared to Formosan scalpel since it provides a text base user interface
like text disk to execute it.
We run the command photo rec with the same simple test image
it shows the textual interface with the available media to analyze.
We hit the Enter key on proceed and select the only available partition.
We could also change the programs options here.
Paranoid means that recovered files are verified and invalid files rejected.
While the expert mode allows us to force the file system block size and the offset.
In this case we leave the default options unchanged file option is useful if we want to modify the list
of file formats to recover checking or unchecking the corresponding boxes.
If we want to modify the list of file formats to recover checking or unchecking the corresponding boxes
again we use the default list.
So we go back and hit search then on other to select the file system.
Then we have to choose the output directory where to stored the recovered files and hit see when the
destination folder is correct.
The program starts scanning the image and displays the recovery progress showing a summary with the
number of recovered files were terminated.
The files are saved in the recoupment der subdirectory as we could see with the file manager we notice
there are two documents photo Trek also recovered the file name from the meta data Boatright does not
organize files and subdirectories based on their formats like the other carving tools.
In this case we have a lot of extracted files under many subdirectories.
The photo Reyk web site provides some scripts to sort these files according to different criteria.
Great job in this video we've covered the recovery of deleted files from a disk image using the sleuthed
kit tools then how to use 3 cm lifestyle carving tools prayed stalled on Kelly Linux for most scalpel
and photo rec in the next video extracting data with bulk extractor.
We're going to show how to use the bulk extractor utility to extract a lot of useful info from a raw
disk image.
See there.