SlideShare a Scribd company logo
1 of 35
Download to read offline
Bin carver

Bin-Carver: Automatic recovery of binary executable files
• The process of reassembling files from
disk fragments in the absence of
metadata.
What is file carving?
• Accidental user deletions.
• Intentional user deletions.
• Malware.
When would we need file carving?
Using .jpeg file as an example :
•Find header (FF D8).
•Know footer pair (FF D9).
•Find all contiguous data.
Traditional file carving method
•Fragmentation.
•Doesn’t work without exact header and
footer information.
•Doesn’t work with all file types.
o focuses on documents of forensic interest.
o binary executables not included.
Problems with traditional method
• Recover Executable Linkable Format
(ELF) file e from disk image D
• D strictly consists of file content blocks
• Assume D is an EXT2 file system, block
size 4k
Bin-carver overview -1
• File content has not been overwritten.
• File content is stored in increasing order.
• ELF file e has n blocks in the disk.
want to link these n blocks together
utilizing internal graph node logic.
Bin-carver overview -2
Bin-carver overview -3
•Filename recovery is typically not
possible without the file system
metadata.
•Fragmentation.
Challenges
System Overview Diagram
• ELF-header scanner.
o scan all possible ELF headers hi using ELF-file
magic value.
• Block node linker.
o scans disk image, identifies nodes and links them.
• Conflict-node resolver.
o removes conflict nodes and outputs ELF-file ei.
Components
• Headers hold a “road map” describing
ELF file organization.
• Searching for the magic number sequence
7f 45 4c 46 allows to locate headers,
telling how to traverse all other sections.
Scanner -1
Each header is 52k and contains:
• Program header table (PHT)
o array of program headers
• Section header table (SHT)
o array of section headers
Scanner -2
• Usually located at end of ELF file.
o can serve as a footer because of this.
• Since A(footer) > A(hi) can start our search
at the 0x14 disk block.
• Gives a multitude of other constraints that
allow to calculate the location of the
footer.
Searching SHT
•Locates segments that create memory
image of the program.
•Each program header is 32 bytes.
•Usually starts right after ELF headers.
osame 4k block.
Searching PHT
•From program header, infer vase virtual
address of image file.
•Keep iterating and build the road map.
•The goal is to find every fill this road
map with content (bi).
Searching PHT
• With no fragmentation, job is done.
• But, with any garbage gap, this approach
would fail.
• So how to link each individual bi if the
disk is fragmented?
Finished?
• Have to logically connect bi and bj .
• Explore the caller-callee relationship:
• Fill block place of bcaller and bcallee
o find address
• Logically link them together.
o function prologue signature (local calls)
o PLT instruction sequence (library calls)
Block-node linker -1
• On a library call
o Use PLT block number as an anchor.
o Use this anchor to identify absolute block number of the
caller block.
• On a local call
o Only determines distance.
o Only works with blocks starting with e8 (CALL opcode).
• Most cases library calls are used to resolve
block numbers.
Block-node linker -2
• A particular placeholder i could have
several candidates.
• To eliminate redundant placeholders:
o Use identified non-conflict nodes
o Explore logic connections
o Resolve node
o Iterate through until a fixed point is reached
Conflict-node resolver -1
• Block-node linker only focuses on linking
code blocks. Conflict-node resolver
handles other data blocks (.data,
.debug).
Conflict-node resolver -2
To retrieve data blocks:
• Treat data sections as a block between the ELF header and
the first block of code section.
• Resolvers explores constraints defined in PHT and SHT.
• Worst case scenario: data section does not have identifiable
sections and we must use dynamic execution to eliminate
bogus permutations.
o Essentially, if the recovered binary file doesn’t crash, it
may have been recovered successfully.
Conflict-node resolver -3
• Comparisons were intended to be made
to other similar tools, both Foremost and
Scalpel do not support carving for
fragmented ELF binary files.
Evaluation - Comparison
Evaluation -1
• All files are ELF binaries.
o worst case, high false positive rates.
o addition of heterogeneous data irrelevant.
• Performance of algorithm is invariant to
size of the disk.
• Performance relies on number of files to be
recovered.
Evaluation -2
• To evaluate accuracy, need to prove the
recovered files are true elf files.
• Need to create an MD5 hash of first block
and every individual block for each true
ELF binary to detect true data in worst
case fragmentation scenario.
Evaluation -3
Identification rate:
• Shows portion that can be identified no
matter how fragmented the disk is.
o must be able to match hash values
Recovery Rate
• Valid files in the system that were
identified and recovered.
Effectiveness -1
Overall, very effective. On average:
• Identification rate of 96.3%
• Recovery rate of 93.1%
Effectiveness -2
Effectiveness -3
• All performance slowdowns occur during
linker and resolver phases.
• Large gaps hurt performance, and the
large number of caller-callee instructions
cause performance penalties.
Runtime Analysis -1
Runtime Analysis -2
Conclusion
• Bin-Carver, a tool for dissecting, map- ping, and recovering
binary executable files from raw binary data.
• Bin-Carver is extremely accurate, and much better than all
the existing file carving techniques when recovering binary
files with fragmentations.
• Bin-Carver also provides a useful complement to the more
traditional header-footer pairing approach for file carving to
gain more complete disk image recovery.
References
1. A. Pal, K. Shanmugasundaram, N. Memon, Automated reassembly of fragmented images, in: Proceedings of the 2003
International Conference on Multimedia and Expo - Volume 2, ICME ’03, IEEE Computer Society, Washington, DC, USA,
2003, pp. 625–628.
2. A.Pal, N.Memon, The evolution of file carving, Signal Processing Magazine, IEEE 26 (2) (2009) 59 –71.
3. M.Karresand, N.Shahmehri, File type identification of data fragments by their binary structure, in: Information Assurance
Workshop, 2006 IEEE, 2006, pp. 140 –147.
4. M. McDaniel, M. H. Heydari, Content based file type detection algorithms, in: Proceedings of the 36th Annual Hawaii
International Conference on System Sciences (HICSS’03) - Track 9 - Volume 9, 2003.
5. M. Karresand, N. Shahmehri, Oscar – file type identification of binary data in disk clusters and ram pages, in: Security
and Privacy in Dynamic Environments, Vol. 201 of IFIP International Federation for Information Processing, 2006, pp. 413–
424.
6. S.Moody, R.Erbacher, Sadi-statistical analysis for data type identification, in: Systematic Approaches to Digital Forensic
Engineering, 2008. SADFE ’08. Third International Workshop on, 2008, pp. 41 –54.
Thank You…......!!!!!!!

More Related Content

What's hot

What's hot (17)

Handling computer files
Handling computer filesHandling computer files
Handling computer files
 
File Types in Data Structure
File Types in Data StructureFile Types in Data Structure
File Types in Data Structure
 
Hw1
Hw1Hw1
Hw1
 
OSCh11
OSCh11OSCh11
OSCh11
 
File management
File managementFile management
File management
 
File Handling in C++
File Handling in C++File Handling in C++
File Handling in C++
 
1 cs xii_python_file_handling text n binary file
1 cs xii_python_file_handling text n binary file1 cs xii_python_file_handling text n binary file
1 cs xii_python_file_handling text n binary file
 
Linux Memory Analysis with Volatility
Linux Memory Analysis with VolatilityLinux Memory Analysis with Volatility
Linux Memory Analysis with Volatility
 
(120513) #fitalk an introduction to linux memory forensics
(120513) #fitalk   an introduction to linux memory forensics(120513) #fitalk   an introduction to linux memory forensics
(120513) #fitalk an introduction to linux memory forensics
 
Data file handling in python reading & writing methods
Data file handling in python reading & writing methodsData file handling in python reading & writing methods
Data file handling in python reading & writing methods
 
File implementation
File implementationFile implementation
File implementation
 
10 File System
10 File System10 File System
10 File System
 
File handling in c++
File handling in c++File handling in c++
File handling in c++
 
Python file handling
Python file handlingPython file handling
Python file handling
 
File handling
File handlingFile handling
File handling
 
File protection.59 to 60
File protection.59 to 60File protection.59 to 60
File protection.59 to 60
 
VIT351 Software Development VI Unit5
VIT351 Software Development VI Unit5VIT351 Software Development VI Unit5
VIT351 Software Development VI Unit5
 

Viewers also liked

A Novel Wireless Sensor Network Frame for Urban Transportation
A Novel Wireless Sensor Network Frame for Urban TransportationA Novel Wireless Sensor Network Frame for Urban Transportation
A Novel Wireless Sensor Network Frame for Urban Transportationsaddamhusain hadimani
 
Beauty of open source in cyber forensics
Beauty of open source in cyber forensicsBeauty of open source in cyber forensics
Beauty of open source in cyber forensicssaddamhusain hadimani
 
Linux tools for data recovery and reporting
Linux tools for data recovery and reportingLinux tools for data recovery and reporting
Linux tools for data recovery and reportingsaddamhusain hadimani
 
CS_VICTA_A4_MICROFASHION_EN
CS_VICTA_A4_MICROFASHION_ENCS_VICTA_A4_MICROFASHION_EN
CS_VICTA_A4_MICROFASHION_ENJörgen Peerik
 
Efficient Methods For Golfing - Helpful Guidelines
Efficient Methods For Golfing - Helpful GuidelinesEfficient Methods For Golfing - Helpful Guidelines
Efficient Methods For Golfing - Helpful Guidelinesoceanicnugget9399
 
インドでの腐食のテスト機器メーカー
インドでの腐食のテスト機器メーカーインドでの腐食のテスト機器メーカー
インドでの腐食のテスト機器メーカーmaseng181
 
ParcelPoint Portfolio
ParcelPoint PortfolioParcelPoint Portfolio
ParcelPoint PortfolioEmily Lutton
 
customer development for early and growth stage companies
customer development for early and growth stage companiescustomer development for early and growth stage companies
customer development for early and growth stage companiesMurali Prasad Vandayar
 
Apresentação dos Resultados do 2T15
Apresentação dos Resultados do 2T15Apresentação dos Resultados do 2T15
Apresentação dos Resultados do 2T15Celesc
 
User Authentication Based on Representative Users
User Authentication Based on Representative UsersUser Authentication Based on Representative Users
User Authentication Based on Representative Userssaddamhusain hadimani
 

Viewers also liked (16)

A Novel Wireless Sensor Network Frame for Urban Transportation
A Novel Wireless Sensor Network Frame for Urban TransportationA Novel Wireless Sensor Network Frame for Urban Transportation
A Novel Wireless Sensor Network Frame for Urban Transportation
 
Caine and dff
Caine and dffCaine and dff
Caine and dff
 
Beauty of open source in cyber forensics
Beauty of open source in cyber forensicsBeauty of open source in cyber forensics
Beauty of open source in cyber forensics
 
Linux tools for data recovery and reporting
Linux tools for data recovery and reportingLinux tools for data recovery and reporting
Linux tools for data recovery and reporting
 
CS_VICTA_A4_MICROFASHION_EN
CS_VICTA_A4_MICROFASHION_ENCS_VICTA_A4_MICROFASHION_EN
CS_VICTA_A4_MICROFASHION_EN
 
15946_OLC_Brochure_web_version
15946_OLC_Brochure_web_version15946_OLC_Brochure_web_version
15946_OLC_Brochure_web_version
 
Efficient Methods For Golfing - Helpful Guidelines
Efficient Methods For Golfing - Helpful GuidelinesEfficient Methods For Golfing - Helpful Guidelines
Efficient Methods For Golfing - Helpful Guidelines
 
インドでの腐食のテスト機器メーカー
インドでの腐食のテスト機器メーカーインドでの腐食のテスト機器メーカー
インドでの腐食のテスト機器メーカー
 
ParcelPoint Portfolio
ParcelPoint PortfolioParcelPoint Portfolio
ParcelPoint Portfolio
 
customer development for early and growth stage companies
customer development for early and growth stage companiescustomer development for early and growth stage companies
customer development for early and growth stage companies
 
FC0613DECOR.indd
FC0613DECOR.inddFC0613DECOR.indd
FC0613DECOR.indd
 
Apresentação dos Resultados do 2T15
Apresentação dos Resultados do 2T15Apresentação dos Resultados do 2T15
Apresentação dos Resultados do 2T15
 
pda forensics
pda forensicspda forensics
pda forensics
 
Analysis of database tampering
Analysis of database tamperingAnalysis of database tampering
Analysis of database tampering
 
User Authentication Based on Representative Users
User Authentication Based on Representative UsersUser Authentication Based on Representative Users
User Authentication Based on Representative Users
 
E mail forensics
E mail forensicsE mail forensics
E mail forensics
 

Similar to Bin carver

Embedded Systems: Lecture 14: Introduction to GNU Toolchain (Binary Utilities)
Embedded Systems: Lecture 14: Introduction to GNU Toolchain (Binary Utilities)Embedded Systems: Lecture 14: Introduction to GNU Toolchain (Binary Utilities)
Embedded Systems: Lecture 14: Introduction to GNU Toolchain (Binary Utilities)Ahmed El-Arabawy
 
Ganesh naik linux_kernel_internals
Ganesh naik linux_kernel_internalsGanesh naik linux_kernel_internals
Ganesh naik linux_kernel_internalsGanesh Naik
 
Ganesh naik linux_kernel_internals
Ganesh naik linux_kernel_internalsGanesh naik linux_kernel_internals
Ganesh naik linux_kernel_internalsnullowaspmumbai
 
Yihan Lian & Zhibin Hu - Smarter Peach: Add Eyes to Peach Fuzzer [rooted2017]
Yihan Lian &  Zhibin Hu - Smarter Peach: Add Eyes to Peach Fuzzer [rooted2017]Yihan Lian &  Zhibin Hu - Smarter Peach: Add Eyes to Peach Fuzzer [rooted2017]
Yihan Lian & Zhibin Hu - Smarter Peach: Add Eyes to Peach Fuzzer [rooted2017]RootedCON
 
VTU 3RD SEM UNIX AND SHELL PROGRAMMING SOLVED PAPERS
VTU 3RD SEM UNIX AND SHELL PROGRAMMING SOLVED PAPERSVTU 3RD SEM UNIX AND SHELL PROGRAMMING SOLVED PAPERS
VTU 3RD SEM UNIX AND SHELL PROGRAMMING SOLVED PAPERSvtunotesbysree
 
Ppt project process migration
Ppt project process migrationPpt project process migration
Ppt project process migrationjaya380
 
Query processing and optimization
Query processing and optimizationQuery processing and optimization
Query processing and optimizationArif A.
 
Mac Memory Analysis with Volatility
Mac Memory Analysis with VolatilityMac Memory Analysis with Volatility
Mac Memory Analysis with VolatilityAndrew Case
 
Topic under operation system File System
Topic under operation system File SystemTopic under operation system File System
Topic under operation system File Systemshreyagowda879
 
Technologies For Appraising and Managing Electronic Records
Technologies For Appraising and Managing Electronic RecordsTechnologies For Appraising and Managing Electronic Records
Technologies For Appraising and Managing Electronic Recordspbajcsy
 
Linux operating system by Quontra Solutions
Linux operating system by Quontra SolutionsLinux operating system by Quontra Solutions
Linux operating system by Quontra SolutionsQUONTRASOLUTIONS
 
ELF(executable and linkable format)
ELF(executable and linkable format)ELF(executable and linkable format)
ELF(executable and linkable format)Seungha Son
 
Schizophrenic files v2
Schizophrenic files v2Schizophrenic files v2
Schizophrenic files v2Ange Albertini
 
De-Anonymizing Live CDs through Physical Memory Analysis
De-Anonymizing Live CDs through Physical Memory AnalysisDe-Anonymizing Live CDs through Physical Memory Analysis
De-Anonymizing Live CDs through Physical Memory AnalysisAndrew Case
 
Linux System Programming - File I/O
Linux System Programming - File I/O Linux System Programming - File I/O
Linux System Programming - File I/O YourHelper1
 
Workshop - Linux Memory Analysis with Volatility
Workshop - Linux Memory Analysis with VolatilityWorkshop - Linux Memory Analysis with Volatility
Workshop - Linux Memory Analysis with VolatilityAndrew Case
 

Similar to Bin carver (20)

File carving overview
File carving overviewFile carving overview
File carving overview
 
Embedded Systems: Lecture 14: Introduction to GNU Toolchain (Binary Utilities)
Embedded Systems: Lecture 14: Introduction to GNU Toolchain (Binary Utilities)Embedded Systems: Lecture 14: Introduction to GNU Toolchain (Binary Utilities)
Embedded Systems: Lecture 14: Introduction to GNU Toolchain (Binary Utilities)
 
Ganesh naik linux_kernel_internals
Ganesh naik linux_kernel_internalsGanesh naik linux_kernel_internals
Ganesh naik linux_kernel_internals
 
Ganesh naik linux_kernel_internals
Ganesh naik linux_kernel_internalsGanesh naik linux_kernel_internals
Ganesh naik linux_kernel_internals
 
Yihan Lian & Zhibin Hu - Smarter Peach: Add Eyes to Peach Fuzzer [rooted2017]
Yihan Lian &  Zhibin Hu - Smarter Peach: Add Eyes to Peach Fuzzer [rooted2017]Yihan Lian &  Zhibin Hu - Smarter Peach: Add Eyes to Peach Fuzzer [rooted2017]
Yihan Lian & Zhibin Hu - Smarter Peach: Add Eyes to Peach Fuzzer [rooted2017]
 
VTU 3RD SEM UNIX AND SHELL PROGRAMMING SOLVED PAPERS
VTU 3RD SEM UNIX AND SHELL PROGRAMMING SOLVED PAPERSVTU 3RD SEM UNIX AND SHELL PROGRAMMING SOLVED PAPERS
VTU 3RD SEM UNIX AND SHELL PROGRAMMING SOLVED PAPERS
 
Ppt project process migration
Ppt project process migrationPpt project process migration
Ppt project process migration
 
Query processing and optimization
Query processing and optimizationQuery processing and optimization
Query processing and optimization
 
Mac Memory Analysis with Volatility
Mac Memory Analysis with VolatilityMac Memory Analysis with Volatility
Mac Memory Analysis with Volatility
 
File Allocation Methods.ppt
File Allocation Methods.pptFile Allocation Methods.ppt
File Allocation Methods.ppt
 
Topic under operation system File System
Topic under operation system File SystemTopic under operation system File System
Topic under operation system File System
 
Technologies For Appraising and Managing Electronic Records
Technologies For Appraising and Managing Electronic RecordsTechnologies For Appraising and Managing Electronic Records
Technologies For Appraising and Managing Electronic Records
 
Linux operating system by Quontra Solutions
Linux operating system by Quontra SolutionsLinux operating system by Quontra Solutions
Linux operating system by Quontra Solutions
 
ELF(executable and linkable format)
ELF(executable and linkable format)ELF(executable and linkable format)
ELF(executable and linkable format)
 
Schizophrenic files v2
Schizophrenic files v2Schizophrenic files v2
Schizophrenic files v2
 
De-Anonymizing Live CDs through Physical Memory Analysis
De-Anonymizing Live CDs through Physical Memory AnalysisDe-Anonymizing Live CDs through Physical Memory Analysis
De-Anonymizing Live CDs through Physical Memory Analysis
 
Hot sec10 slide-suzaki
Hot sec10 slide-suzakiHot sec10 slide-suzaki
Hot sec10 slide-suzaki
 
Linux System Programming - File I/O
Linux System Programming - File I/O Linux System Programming - File I/O
Linux System Programming - File I/O
 
Eusecwest
EusecwestEusecwest
Eusecwest
 
Workshop - Linux Memory Analysis with Volatility
Workshop - Linux Memory Analysis with VolatilityWorkshop - Linux Memory Analysis with Volatility
Workshop - Linux Memory Analysis with Volatility
 

Recently uploaded

MS4 -seq3- citizenship& community lexis & conditional 1& imperative & text ...
MS4 -seq3-  citizenship& community lexis & conditional 1&  imperative & text ...MS4 -seq3-  citizenship& community lexis & conditional 1&  imperative & text ...
MS4 -seq3- citizenship& community lexis & conditional 1& imperative & text ...Mr Bounab Samir
 
Work Experience for psp3 portfolio sasha
Work Experience for psp3 portfolio sashaWork Experience for psp3 portfolio sasha
Work Experience for psp3 portfolio sashasashalaycock03
 
To test decimal representation of rational Numbers.pdf
To test decimal representation of rational Numbers.pdfTo test decimal representation of rational Numbers.pdf
To test decimal representation of rational Numbers.pdfPranav Sharma
 
From Leadership to Communityship: The Heart, the Heat, and the Harmony of Goo...
From Leadership to Communityship: The Heart, the Heat, and the Harmony of Goo...From Leadership to Communityship: The Heart, the Heat, and the Harmony of Goo...
From Leadership to Communityship: The Heart, the Heat, and the Harmony of Goo...Sadegh Hashemi
 
Teaching English to the Test: Why Does Negative Washback Exist within Seconda...
Teaching English to the Test: Why Does Negative Washback Exist within Seconda...Teaching English to the Test: Why Does Negative Washback Exist within Seconda...
Teaching English to the Test: Why Does Negative Washback Exist within Seconda...Adduha3
 
Quality Assurance_GOOD LABORATORY PRACTICE
Quality Assurance_GOOD LABORATORY PRACTICEQuality Assurance_GOOD LABORATORY PRACTICE
Quality Assurance_GOOD LABORATORY PRACTICESayali Powar
 
Preparing for the FDA’s Enforcement of the Intentional Adulteration Rule
Preparing for the FDA’s Enforcement of the Intentional Adulteration RulePreparing for the FDA’s Enforcement of the Intentional Adulteration Rule
Preparing for the FDA’s Enforcement of the Intentional Adulteration RuleSafetyChain Software
 
language diversity of the world and india ppt.pptx
language diversity of the world and india ppt.pptxlanguage diversity of the world and india ppt.pptx
language diversity of the world and india ppt.pptxvasupavanibhonagiri
 
Personal Brand Exploration- Valeria Alvarez
Personal Brand Exploration- Valeria AlvarezPersonal Brand Exploration- Valeria Alvarez
Personal Brand Exploration- Valeria AlvarezValeriaAlvarez967687
 
Decimal Representation of rational numbers
Decimal Representation of rational numbersDecimal Representation of rational numbers
Decimal Representation of rational numbersPranav Sharma
 
3.28.24 The Poor People's Campaign.pptx
3.28.24  The Poor People's Campaign.pptx3.28.24  The Poor People's Campaign.pptx
3.28.24 The Poor People's Campaign.pptxmary850239
 
Divisibility Tests (Basic Number Systems)
Divisibility Tests (Basic Number Systems)Divisibility Tests (Basic Number Systems)
Divisibility Tests (Basic Number Systems)Pranav Sharma
 
In - Vivo and In - Vitro Correlation.pptx
In - Vivo and In - Vitro Correlation.pptxIn - Vivo and In - Vitro Correlation.pptx
In - Vivo and In - Vitro Correlation.pptxAditiChauhan701637
 
The Macardle Moore - PRESENTATION - Frank OCallaghan.pptx
The Macardle Moore - PRESENTATION - Frank OCallaghan.pptxThe Macardle Moore - PRESENTATION - Frank OCallaghan.pptx
The Macardle Moore - PRESENTATION - Frank OCallaghan.pptxJason McGee
 
Chemistry and formulation of para phenylenediamine based hair dye.
Chemistry and formulation of para phenylenediamine based hair dye.Chemistry and formulation of para phenylenediamine based hair dye.
Chemistry and formulation of para phenylenediamine based hair dye.ruchisuryawanshi1234
 
Empowering Student Engagement with Open Education
Empowering Student Engagement with Open EducationEmpowering Student Engagement with Open Education
Empowering Student Engagement with Open EducationLorna Campbell
 
EBUS5423 Data Analytics and Reporting Bl
EBUS5423 Data Analytics and Reporting BlEBUS5423 Data Analytics and Reporting Bl
EBUS5423 Data Analytics and Reporting BlDr. Bruce A. Johnson
 
Vani Magazine - Quarterly Magazine of Seshadripuram Educational Trust
Vani Magazine - Quarterly Magazine of Seshadripuram Educational TrustVani Magazine - Quarterly Magazine of Seshadripuram Educational Trust
Vani Magazine - Quarterly Magazine of Seshadripuram Educational TrustSavipriya Raghavendra
 

Recently uploaded (20)

MS4 -seq3- citizenship& community lexis & conditional 1& imperative & text ...
MS4 -seq3-  citizenship& community lexis & conditional 1&  imperative & text ...MS4 -seq3-  citizenship& community lexis & conditional 1&  imperative & text ...
MS4 -seq3- citizenship& community lexis & conditional 1& imperative & text ...
 
Work Experience for psp3 portfolio sasha
Work Experience for psp3 portfolio sashaWork Experience for psp3 portfolio sasha
Work Experience for psp3 portfolio sasha
 
To test decimal representation of rational Numbers.pdf
To test decimal representation of rational Numbers.pdfTo test decimal representation of rational Numbers.pdf
To test decimal representation of rational Numbers.pdf
 
March 2024 Directors Meeting, Division of Student Affairs and Academic Support
March 2024 Directors Meeting, Division of Student Affairs and Academic SupportMarch 2024 Directors Meeting, Division of Student Affairs and Academic Support
March 2024 Directors Meeting, Division of Student Affairs and Academic Support
 
Chasing the Academic Funders Opportunities and Challenges.pdf
Chasing the Academic Funders  Opportunities and Challenges.pdfChasing the Academic Funders  Opportunities and Challenges.pdf
Chasing the Academic Funders Opportunities and Challenges.pdf
 
From Leadership to Communityship: The Heart, the Heat, and the Harmony of Goo...
From Leadership to Communityship: The Heart, the Heat, and the Harmony of Goo...From Leadership to Communityship: The Heart, the Heat, and the Harmony of Goo...
From Leadership to Communityship: The Heart, the Heat, and the Harmony of Goo...
 
Teaching English to the Test: Why Does Negative Washback Exist within Seconda...
Teaching English to the Test: Why Does Negative Washback Exist within Seconda...Teaching English to the Test: Why Does Negative Washback Exist within Seconda...
Teaching English to the Test: Why Does Negative Washback Exist within Seconda...
 
Quality Assurance_GOOD LABORATORY PRACTICE
Quality Assurance_GOOD LABORATORY PRACTICEQuality Assurance_GOOD LABORATORY PRACTICE
Quality Assurance_GOOD LABORATORY PRACTICE
 
Preparing for the FDA’s Enforcement of the Intentional Adulteration Rule
Preparing for the FDA’s Enforcement of the Intentional Adulteration RulePreparing for the FDA’s Enforcement of the Intentional Adulteration Rule
Preparing for the FDA’s Enforcement of the Intentional Adulteration Rule
 
language diversity of the world and india ppt.pptx
language diversity of the world and india ppt.pptxlanguage diversity of the world and india ppt.pptx
language diversity of the world and india ppt.pptx
 
Personal Brand Exploration- Valeria Alvarez
Personal Brand Exploration- Valeria AlvarezPersonal Brand Exploration- Valeria Alvarez
Personal Brand Exploration- Valeria Alvarez
 
Decimal Representation of rational numbers
Decimal Representation of rational numbersDecimal Representation of rational numbers
Decimal Representation of rational numbers
 
3.28.24 The Poor People's Campaign.pptx
3.28.24  The Poor People's Campaign.pptx3.28.24  The Poor People's Campaign.pptx
3.28.24 The Poor People's Campaign.pptx
 
Divisibility Tests (Basic Number Systems)
Divisibility Tests (Basic Number Systems)Divisibility Tests (Basic Number Systems)
Divisibility Tests (Basic Number Systems)
 
In - Vivo and In - Vitro Correlation.pptx
In - Vivo and In - Vitro Correlation.pptxIn - Vivo and In - Vitro Correlation.pptx
In - Vivo and In - Vitro Correlation.pptx
 
The Macardle Moore - PRESENTATION - Frank OCallaghan.pptx
The Macardle Moore - PRESENTATION - Frank OCallaghan.pptxThe Macardle Moore - PRESENTATION - Frank OCallaghan.pptx
The Macardle Moore - PRESENTATION - Frank OCallaghan.pptx
 
Chemistry and formulation of para phenylenediamine based hair dye.
Chemistry and formulation of para phenylenediamine based hair dye.Chemistry and formulation of para phenylenediamine based hair dye.
Chemistry and formulation of para phenylenediamine based hair dye.
 
Empowering Student Engagement with Open Education
Empowering Student Engagement with Open EducationEmpowering Student Engagement with Open Education
Empowering Student Engagement with Open Education
 
EBUS5423 Data Analytics and Reporting Bl
EBUS5423 Data Analytics and Reporting BlEBUS5423 Data Analytics and Reporting Bl
EBUS5423 Data Analytics and Reporting Bl
 
Vani Magazine - Quarterly Magazine of Seshadripuram Educational Trust
Vani Magazine - Quarterly Magazine of Seshadripuram Educational TrustVani Magazine - Quarterly Magazine of Seshadripuram Educational Trust
Vani Magazine - Quarterly Magazine of Seshadripuram Educational Trust
 

Bin carver

  • 2.  Bin-Carver: Automatic recovery of binary executable files
  • 3. • The process of reassembling files from disk fragments in the absence of metadata. What is file carving?
  • 4. • Accidental user deletions. • Intentional user deletions. • Malware. When would we need file carving?
  • 5. Using .jpeg file as an example : •Find header (FF D8). •Know footer pair (FF D9). •Find all contiguous data. Traditional file carving method
  • 6. •Fragmentation. •Doesn’t work without exact header and footer information. •Doesn’t work with all file types. o focuses on documents of forensic interest. o binary executables not included. Problems with traditional method
  • 7. • Recover Executable Linkable Format (ELF) file e from disk image D • D strictly consists of file content blocks • Assume D is an EXT2 file system, block size 4k Bin-carver overview -1
  • 8. • File content has not been overwritten. • File content is stored in increasing order. • ELF file e has n blocks in the disk. want to link these n blocks together utilizing internal graph node logic. Bin-carver overview -2
  • 10. •Filename recovery is typically not possible without the file system metadata. •Fragmentation. Challenges
  • 12. • ELF-header scanner. o scan all possible ELF headers hi using ELF-file magic value. • Block node linker. o scans disk image, identifies nodes and links them. • Conflict-node resolver. o removes conflict nodes and outputs ELF-file ei. Components
  • 13. • Headers hold a “road map” describing ELF file organization. • Searching for the magic number sequence 7f 45 4c 46 allows to locate headers, telling how to traverse all other sections. Scanner -1
  • 14. Each header is 52k and contains: • Program header table (PHT) o array of program headers • Section header table (SHT) o array of section headers Scanner -2
  • 15. • Usually located at end of ELF file. o can serve as a footer because of this. • Since A(footer) > A(hi) can start our search at the 0x14 disk block. • Gives a multitude of other constraints that allow to calculate the location of the footer. Searching SHT
  • 16. •Locates segments that create memory image of the program. •Each program header is 32 bytes. •Usually starts right after ELF headers. osame 4k block. Searching PHT
  • 17. •From program header, infer vase virtual address of image file. •Keep iterating and build the road map. •The goal is to find every fill this road map with content (bi). Searching PHT
  • 18. • With no fragmentation, job is done. • But, with any garbage gap, this approach would fail. • So how to link each individual bi if the disk is fragmented? Finished?
  • 19. • Have to logically connect bi and bj . • Explore the caller-callee relationship: • Fill block place of bcaller and bcallee o find address • Logically link them together. o function prologue signature (local calls) o PLT instruction sequence (library calls) Block-node linker -1
  • 20. • On a library call o Use PLT block number as an anchor. o Use this anchor to identify absolute block number of the caller block. • On a local call o Only determines distance. o Only works with blocks starting with e8 (CALL opcode). • Most cases library calls are used to resolve block numbers. Block-node linker -2
  • 21. • A particular placeholder i could have several candidates. • To eliminate redundant placeholders: o Use identified non-conflict nodes o Explore logic connections o Resolve node o Iterate through until a fixed point is reached Conflict-node resolver -1
  • 22. • Block-node linker only focuses on linking code blocks. Conflict-node resolver handles other data blocks (.data, .debug). Conflict-node resolver -2
  • 23. To retrieve data blocks: • Treat data sections as a block between the ELF header and the first block of code section. • Resolvers explores constraints defined in PHT and SHT. • Worst case scenario: data section does not have identifiable sections and we must use dynamic execution to eliminate bogus permutations. o Essentially, if the recovered binary file doesn’t crash, it may have been recovered successfully. Conflict-node resolver -3
  • 24. • Comparisons were intended to be made to other similar tools, both Foremost and Scalpel do not support carving for fragmented ELF binary files. Evaluation - Comparison
  • 26. • All files are ELF binaries. o worst case, high false positive rates. o addition of heterogeneous data irrelevant. • Performance of algorithm is invariant to size of the disk. • Performance relies on number of files to be recovered. Evaluation -2
  • 27. • To evaluate accuracy, need to prove the recovered files are true elf files. • Need to create an MD5 hash of first block and every individual block for each true ELF binary to detect true data in worst case fragmentation scenario. Evaluation -3
  • 28. Identification rate: • Shows portion that can be identified no matter how fragmented the disk is. o must be able to match hash values Recovery Rate • Valid files in the system that were identified and recovered. Effectiveness -1
  • 29. Overall, very effective. On average: • Identification rate of 96.3% • Recovery rate of 93.1% Effectiveness -2
  • 31. • All performance slowdowns occur during linker and resolver phases. • Large gaps hurt performance, and the large number of caller-callee instructions cause performance penalties. Runtime Analysis -1
  • 33. Conclusion • Bin-Carver, a tool for dissecting, map- ping, and recovering binary executable files from raw binary data. • Bin-Carver is extremely accurate, and much better than all the existing file carving techniques when recovering binary files with fragmentations. • Bin-Carver also provides a useful complement to the more traditional header-footer pairing approach for file carving to gain more complete disk image recovery.
  • 34. References 1. A. Pal, K. Shanmugasundaram, N. Memon, Automated reassembly of fragmented images, in: Proceedings of the 2003 International Conference on Multimedia and Expo - Volume 2, ICME ’03, IEEE Computer Society, Washington, DC, USA, 2003, pp. 625–628. 2. A.Pal, N.Memon, The evolution of file carving, Signal Processing Magazine, IEEE 26 (2) (2009) 59 –71. 3. M.Karresand, N.Shahmehri, File type identification of data fragments by their binary structure, in: Information Assurance Workshop, 2006 IEEE, 2006, pp. 140 –147. 4. M. McDaniel, M. H. Heydari, Content based file type detection algorithms, in: Proceedings of the 36th Annual Hawaii International Conference on System Sciences (HICSS’03) - Track 9 - Volume 9, 2003. 5. M. Karresand, N. Shahmehri, Oscar – file type identification of binary data in disk clusters and ram pages, in: Security and Privacy in Dynamic Environments, Vol. 201 of IFIP International Federation for Information Processing, 2006, pp. 413– 424. 6. S.Moody, R.Erbacher, Sadi-statistical analysis for data type identification, in: Systematic Approaches to Digital Forensic Engineering, 2008. SADFE ’08. Third International Workshop on, 2008, pp. 41 –54.