Unit 2: Hard Disks, File Systems and Data Acquisition - Subjective Questions

Disk drives are storage devices used to store digital data. The major types include:

• Hard Disk Drive (HDD): Uses rotating magnetic platters and read/write heads. Characteristics include mechanical moving parts, higher capacity at lower cost, but slower access speeds and susceptibility to physical shock.
• Solid State Drive (SSD): Uses NAND flash memory with no moving parts. Characteristics include faster read/write speeds, lower power consumption, silent operation, and higher cost per GB. Data recovery is complex due to TRIM and wear-leveling.
• Hybrid Drive (SSHD): Combines an HDD with a small SSD cache to balance capacity and speed.
• Optical Drives (CD/DVD/Blu-ray): Use lasers to read/write data on optical media.
• USB Flash Drives & Memory Cards: Portable flash-based storage.

Key characteristics to consider in forensics:

• Capacity (measured in GB/TB)
• Rotational speed (RPM for HDDs, e.g., 5400/7200 RPM)
• Interface (SATA, PATA/IDE, SCSI, NVMe, USB)
• Access time and data transfer rate
• Volatility — most are non-volatile storage.

The logical structure of a disk organizes how data is physically and logically stored:

• Tracks: Concentric circles on the surface of a platter where data is written.
• Sectors: The smallest addressable unit on a track, traditionally 512 bytes, though modern drives use 4096-byte (4K) Advanced Format sectors.
• Cylinders: The set of tracks located at the same position across all platters, forming a vertical cylinder.
• Clusters (Allocation Units): A group of contiguous sectors treated as a single unit by the file system. This is the smallest unit the OS uses to allocate space to files.

Addressing methods:

• CHS (Cylinder-Head-Sector): Older addressing using physical geometry.
• LBA (Logical Block Addressing): Modern linear addressing where each sector has a unique number starting from 0.

Slack space arises when a file does not completely fill its allocated cluster, leaving forensically significant residual data (RAM slack and drive/file slack).

The Windows boot process (for modern UEFI-based systems) proceeds through several stages:

1. Firmware Phase (BIOS/UEFI): On power-on, firmware runs POST (Power-On Self Test) to check hardware, then locates the bootable device.
2. Boot Loader Phase:
   • BIOS systems: The MBR (Master Boot Record) is loaded, which contains the boot code and partition table. It transfers control to the VBR (Volume Boot Record).
   • UEFI systems: Firmware reads the EFI System Partition (ESP) and launches the Windows Boot Manager (bootmgfw.efi).
3. Windows Boot Manager (bootmgr): Reads the BCD (Boot Configuration Data) store and loads the OS loader winload.exe.
4. Windows OS Loader: Loads the kernel ntoskrnl.exe, the HAL (Hardware Abstraction Layer), and boot-critical drivers.
5. Kernel Initialization: The kernel initializes drivers, starts the Session Manager (smss.exe), then wininit.exe and winlogon.exe.
6. Login Phase: The user logs in and the desktop/shell loads.

Forensic relevance: Boot files, the registry, and event logs created during boot help establish system timelines.

Linux Boot Process:

1. BIOS/UEFI + POST: Hardware initialization.
2. Boot Loader (GRUB/GRUB2): Loaded from the MBR or ESP; presents a boot menu and loads the kernel.
3. Kernel Loading: The compressed kernel (vmlinuz) is decompressed and loaded; it mounts the initramfs/initrd temporary root filesystem.
4. init/systemd: The first process (PID 1), traditionally init (SysV) or now systemd, starts system services and target runlevels.
5. Runlevel/Target: Services and the login manager start.

Mac (macOS) Boot Process:

1. Boot ROM: Runs POST and initializes hardware (uses UEFI-like EFI firmware).
2. boot.efi: The boot loader loads the kernel.
3. XNU Kernel: Loads kernel extensions (kexts).
4. launchd: The first process that manages all services and daemons.
5. Login window (loginwindow): User authentication.

Key Differences:

• Windows uses bootmgr + winload, Linux uses GRUB, and macOS uses boot.efi.
• First process: Windows = smss.exe, Linux = systemd/init, macOS = launchd.
• Linux and macOS are UNIX-based; Windows uses NT architecture.
• macOS is tightly coupled to Apple hardware and includes Secure Boot / T2 chip protections.

Windows primarily uses FAT and NTFS file systems:

FAT (File Allocation Table):

• Variants: FAT12, FAT16, FAT32, exFAT.
• Uses a File Allocation Table to track cluster chains for files.
• FAT32 supports volumes up to 2 TB but a maximum file size of 4 GB.
• Simple, widely compatible, used on removable media.
• exFAT was designed for flash drives, removing the 4 GB file limit.

NTFS (New Technology File System):

• Default file system for modern Windows.
• Uses the Master File Table (MFT) where every file/folder has a record.
• Features:
  • Journaling for reliability and crash recovery.
  • Access Control Lists (ACLs) and permissions.
  • Encryption (EFS) and compression.
  • Alternate Data Streams (ADS) — forensically important for hiding data.
  • Support for very large files and volumes.

Forensic relevance: The MFT contains rich metadata (FILE_NAME timestamps) crucial for timeline analysis.

Linux File Systems (ext family):

• ext2: A non-journaling file system using inodes to store metadata. Simple but risks corruption on crash.
• ext3: Adds journaling to ext2 for reliability, with backward compatibility.
• ext4: Modern default with extents (efficient contiguous block allocation), larger volume/file support, delayed allocation, and improved performance.
• Key concept — inodes: Each file has an inode storing metadata (permissions, ownership, timestamps, pointers to data blocks), but not the filename, which is stored in the directory entry.

macOS File Systems:

• HFS+ (Hierarchical File System Plus): Older default; uses a Catalog File (B-tree) to organize files and folders. Supports journaling.
• APFS (Apple File System): Modern default (since 2017), optimized for SSDs. Features:
  • Copy-on-write metadata.
  • Snapshots and space sharing.
  • Strong encryption support.
  • Nanosecond timestamp resolution.

Forensic relevance: Inode timestamps (Linux) and APFS snapshots (macOS) provide valuable investigative artifacts.

The Sleuth Kit (TSK): A collection of command-line forensic tools for analyzing disk images and file systems. Key tools include:

• fls: Lists files and directories, including deleted ones.
• icat: Extracts file content by inode number.
• istat: Displays metadata of a specific inode.
• mmls: Displays the partition/volume layout.
• fsstat: Shows file system details.
• blkls / blkcat: Extracts and displays data blocks.

Autopsy: A graphical user interface (GUI) front-end built on top of TSK, making forensic analysis more accessible.

Using them for file system examination:

1. Create/ingest a disk image (e.g., E01 or raw dd).
2. Analyze partitions using mmls or Autopsy's data source view.
3. Recover deleted files through file system metadata analysis.
4. Keyword searching, hash filtering, and timeline analysis.
5. File carving to recover files without metadata.
6. Generate reports for documentation.

Autopsy supports modules for web artifacts, email, EXIF data, and registry analysis, making it a comprehensive investigation platform.

MBR (Master Boot Record) and GPT (GUID Partition Table) are two disk partitioning schemes:

Forensic relevance:

• MBR contains bootstrap code that can harbor boot sector malware/rootkits.
• GPT's backup partition table can help recover partition information if the primary is damaged.
• GPT includes a Protective MBR at sector 0 to prevent legacy tools from misinterpreting the disk.

Modern storage systems go beyond single drives:

RAID (Redundant Array of Independent Disks): Combines multiple disks for performance and/or redundancy.

• RAID 0 (Striping): Data split across disks for speed; no redundancy.
• RAID 1 (Mirroring): Data duplicated across disks for redundancy.
• RAID 5: Striping with distributed parity; tolerates one disk failure.
• RAID 6: Dual parity; tolerates two disk failures.
• RAID 10: Combination of mirroring and striping.

NAS (Network Attached Storage): A dedicated file-level storage device connected to a network, accessible by multiple clients via protocols like SMB/NFS.

SAN (Storage Area Network): A high-speed, block-level dedicated network of storage devices, typically used in enterprises via Fibre Channel or iSCSI.

Cloud Storage: Remote storage provided by services (e.g., AWS S3, Google Drive). Presents challenges of jurisdiction, data ownership, and remote acquisition.

Forensic relevance: RAID reconstruction, distributed data, and volatile/remote storage complicate acquisition and require specialized techniques.

Encoding Standards define how characters are represented as bytes:

• ASCII (American Standard Code for Information Interchange): A 7-bit encoding representing 128 characters (letters, digits, control codes). Extended ASCII uses 8 bits for 256 characters.
• Unicode: A universal standard assigning a unique code point to every character across all languages.
  • UTF-8: Variable-length (1–4 bytes), backward compatible with ASCII, most common on the web.
  • UTF-16: Uses 2 or 4 bytes per character.
  • UTF-32: Fixed 4 bytes per character.
• Base64: Encodes binary data into ASCII text, often seen in email attachments and encoded payloads.

Hex Editors: Tools that display and edit the raw byte content of files in hexadecimal alongside ASCII. Their forensic uses:

• Examining file signatures / magic numbers (e.g., JPEG begins with FF D8 FF, PDF with 25 50 44 46).
• File carving and identifying file types regardless of extension.
• Detecting hidden or manipulated data and steganography.
• Analyzing file headers and footers.

Examples: WinHex, HxD, 010 Editor.

File Signatures (also called magic numbers) are unique byte sequences at the beginning (header) and sometimes the end (footer) of a file that identify its type, independent of the file extension.

Examples of common signatures:

Importance in forensics:

• Detecting file masquerading: A criminal may rename secret.jpg to notes.txt to hide it. Signature analysis reveals the true type.
• File carving: Recovering files from unallocated space by locating headers and footers when metadata is lost.
• Data validation: Ensuring extracted data is a valid file.
• Filtering: Categorizing files by actual type during investigation.

Tools like TSK, Autopsy, and hex editors use signature analysis extensively.

Data Acquisition is the process of creating a forensically sound copy of digital evidence from a source device. The goal is to preserve the original data intact.

Fundamental principles:

• Preserve the integrity of original evidence.
• Use write blockers to prevent modification.
• Verify with cryptographic hashes (MD5/SHA-256).
• Maintain chain of custody.

Types of Acquisition:

1. Physical (Bit-stream) Acquisition: A sector-by-sector copy of the entire drive, including slack space, unallocated space, and deleted data. Most complete.
2. Logical Acquisition: Copies only specific files/folders or active data. Faster but may miss deleted/hidden data.
3. Sparse Acquisition: Collects fragments of unallocated data along with logical files.
4. Live Acquisition: Capturing data from a running system, essential for volatile data (RAM, running processes, network connections) that would be lost on shutdown.
5. Remote Acquisition: Acquiring data over a network, useful for cloud or remote systems.

Formats: Raw (dd), EnCase (E01), AFF (Advanced Forensic Format).

A structured data acquisition methodology ensures evidence is legally admissible and forensically sound:

1. Preparation: Gather forensic tools, write blockers, storage media, and documentation forms. Ensure destination media is forensically wiped.
2. Identification: Identify the source device, its type, interface, and capacity.
3. Isolation: Prevent network/remote access; for mobile devices, use Faraday bags.
4. Write Protection: Attach a hardware or software write blocker to prevent altering the source.
5. Acquisition/Imaging: Create a bit-stream image using tools like FTK Imager, dd, or Guymager. Prefer physical acquisition when possible.
6. Verification: Compute and compare hash values (MD5/SHA-256) of the source and image to confirm integrity.
7. Documentation: Record device details, hash values, timestamps, and examiner information; maintain chain of custody.
8. Preservation: Store the original evidence securely and work only on verified copies.

Contingency planning: Make at least two images and select alternative acquisition methods if the primary fails (e.g., disk errors).

A write blocker is a hardware or software device that permits read-only access to a storage device, preventing any write operations that would alter the original evidence.

Types:

1. Hardware Write Blockers: Physical devices placed between the source drive and the acquisition workstation (e.g., Tableau, WiebeTech). They intercept and block write commands at the interface level (SATA, USB, IDE). More reliable and court-preferred.
2. Software Write Blockers: Programs or OS configurations (e.g., registry settings, Linux read-only mount options) that block writes at the software level. More flexible but dependent on the host OS integrity.

Importance:

• Preserves evidence integrity — even connecting a drive can trigger OS writes (e.g., updating access times, creating recycle bin entries).
• Ensures the hash value remains unchanged, proving no tampering.
• Maintains legal admissibility by demonstrating that the original was not modified.
• Fundamental to following the principle: the acquisition process must not alter the source data.

Hashing is the process of applying a cryptographic algorithm to data to produce a fixed-length, unique value called a hash or digest. It is central to verifying evidence integrity.

Common algorithms:

• MD5: Produces a 128-bit hash (32 hex characters). Fast but cryptographically weakened.
• SHA-1: 160-bit hash.
• SHA-256: 256-bit hash; currently recommended for stronger security.

How it maintains integrity:

1. A hash is computed on the original source before acquisition.
2. After creating the forensic image, a hash is computed on the image.
3. If both hashes match, the copy is proven to be an exact, unaltered duplicate.
4. Any change — even a single bit — produces a completely different hash (avalanche effect).

Properties of a good hash function:

• Deterministic: Same input always yields the same output.
• Collision-resistant: Difficult to find two inputs with the same hash.
• One-way: Cannot reverse the hash to obtain original data.

Forensic use: Hashing is documented in the chain of custody and used to detect tampering and to filter known files (via hash sets like NSRL).

Once a forensic image is acquired, it must be prepared for analysis:

1. Verify Image Integrity: Recompute the hash and compare with the acquisition hash to ensure the image is unaltered.
2. Work on a Copy: Always analyze a duplicate of the image, never the original evidence or master image.
3. Select Forensic Tools: Choose analysis software such as Autopsy, The Sleuth Kit, FTK, or EnCase.
4. Mount or Ingest the Image: Add the image as a data source. Images can be mounted as read-only virtual drives or ingested directly into forensic software.
5. Identify File System and Partitions: Use tools like mmls and fsstat to understand the volume structure.
6. Handle Encryption/Compression: Decrypt or decompress if necessary, using recovered keys or credentials.
7. Recover Deleted Data & Carve Files: Extract deleted files and carve data from unallocated space.
8. Indexing and Keyword Searching: Build an index for efficient searching.
9. Documentation: Record all steps taken to ensure repeatability and admissibility.

Supported image formats: Raw/dd, E01 (Expert Witness Format), AFF, and split images.

HDD vs SSD — Forensic Comparison:

Challenges SSDs pose to forensics:

• TRIM: When files are deleted, the OS informs the SSD, which may permanently erase those blocks, sometimes within seconds — destroying recoverable data even without overwriting.
• Garbage Collection: Runs autonomously, altering data even when the drive is write-blocked at the file level (though controller operates internally).
• Wear-Leveling: Physical location of data changes, making bit-stream mapping unreliable.
• Self-corrosion / self-healing: Data can change even when powered without user interaction.
• Encryption: Many SSDs use built-in hardware encryption, complicating recovery.

Implication: SSD acquisition should be done quickly, and examiners must document that some data loss may be inherent to the technology, not tampering.

Slack space refers to the unused space within an allocated cluster that lies between the end of a file's actual data and the end of the cluster.

Why it occurs: File systems allocate space in fixed-size clusters. If a file is smaller than the cluster or does not fill the last cluster exactly, the remaining space is wasted but not cleared.

Types of slack space:

1. RAM Slack (Drive Slack): The space from the end of the file to the end of the last sector. Historically, older OSes padded this with data from RAM.
2. File Slack: The space from the end of the last used sector to the end of the cluster.

Example: With a 4096-byte cluster storing a 5000-byte file, two clusters (8192 bytes) are allocated. The file uses 5000 bytes, leaving 3192 bytes of slack space.

Forensic significance:

• May contain remnants of previously deleted files that occupied that cluster earlier.
• Can hold fragments of documents, images, or passwords.
• Can be exploited to hide data intentionally.
• Tools like TSK and Autopsy can extract and analyze slack space for evidence.

Static (Dead) Acquisition:

• Performed on a powered-off system.
• The storage device is removed or accessed via a write blocker, and a bit-stream image is created.
• Advantages: Repeatable, no changes to data, more forensically sound.
• Disadvantages: Loses volatile data (RAM contents, active network connections, running processes, decrypted keys).
• Used when: Volatile data is not critical, or the system can be safely shut down.

Live Acquisition:

• Performed on a running system.
• Captures volatile data such as RAM, open ports, logged-in users, running processes, and clipboard contents.
• Advantages: Preserves ephemeral evidence lost on shutdown; can capture encryption keys from memory to defeat full-disk encryption.
• Disadvantages: The act of capturing may alter the system state (Locard's exchange principle); less repeatable.
• Used when: Dealing with encrypted drives, malware analysis, or systems that cannot be shut down (e.g., critical servers).

Order of Volatility: Data should be collected from most volatile (CPU registers, RAM) to least volatile (disk, archival media) to preserve maximum evidence.

The Master File Table (MFT) is the core data structure of the NTFS file system. It is essentially a relational database where every file and directory on the volume has at least one record (typically 1024 bytes each).

Structure of an MFT record contains attributes such as:

• $STANDARD_INFORMATION: Stores timestamps (Created, Modified, Accessed, MFT-modified — collectively MACE/MACB times), flags, and owner ID.
• $FILE_NAME: Stores the file name and a second set of timestamps.
• $DATA: Contains the actual file content. For small files, data is stored directly in the MFT record (resident data); larger files use non-resident data with pointers to cluster runs.
• INDEX_ALLOCATION: Used for directory indexing.

Forensic importance:

• Timeline analysis: Comparing timestamps from $STANDARD_INFORMATION and $FILE_NAME can reveal timestamp manipulation (timestomping).
• Deleted file recovery: When a file is deleted, its MFT record is marked available but not immediately erased, allowing recovery.
• Resident file recovery: Small deleted files may be fully recoverable from the MFT.
• Detecting Alternate Data Streams (ADS): Hidden data attached to files can be discovered.

The MFT is one of the richest sources of metadata in Windows forensic investigations.