cybersecurity

1. © 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
System Forensics, Investigation,
and Response
Lesson 6
Recovering Data

2. Page 2
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Learning Objective
Understand how data is deleted
Understand data recovery techniques

3. Page 3
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Key Concepts
Undeleting data
Recovering information from damaged
drives

4. Page 4
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Undeleting Data
Criminals who are not very technically
savvy think that deleting a file will keep
authorities from discovering it
Expect that evidence will frequently be
deleted from computers you examine

5. Page 5
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
File Systems and Hard Drives

6. Page 6
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Operating Systems
Current
Windows 10,
8, 7, Vista
Windows
Server 2016,
2012
Mac OS 10
Linux/Android
Legacy
Windows XP,
2000
Mac OS 8 or
earlier

7. Page 7
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Windows
FAT16 and FAT32 used in pre-Windows
2000 versions
NTFS file system in use since Windows
2000
Uses a table to map files to specific clusters
where they are stored on the disk

8. Page 8
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Storing a File in Windows
(FAT/FAT32)
Record cluster number for next
cluster
Add EOC if at end of chain
Mark bad, reserved, open
clusters

9. Page 9
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Deleting a File in Windows
(FAT/FAT32)
When a file is deleted, data not removed
from disk
FAT is updated to reflect clusters no longer
in use
New data saved to those clusters may
overwrite old information

10. Page 10
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
NTFS Fundamental Files
• Master File Table
• Describes all files on
the volume
MFT
• A map of all the
clusters on the hard
drive
Cluster
bitmap

11. Page 11
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Storing a File in Windows (NTFS)
MFT contains one base file
record for each file and directory
MFT serves same purpose as
FAT
Cluster bitmap file maps all
clusters on disk

12. Page 12
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Deleting Files in Windows (NTFS)
When a file is deleted, data not removed
from disk
Clusters are marked as deleted and
“moved” to Recycle Bin
When Recycle Bin is emptied, clusters
marked as fully available
Filename in the MFT is marked with a
special character that means the file has
been deleted

13. Page 13
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DiskDigger
Free and commercial versions
Free version recovers files one at a time

14. Page 14
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DiskDigger: Main Screen

15. Page 15
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DiskDigger: Starting Data
Recovery

16. Page 16
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
DiskDigger: Recovering an
Individual File

17. Page 17
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
WinUndelete
Easy to use
Wizard-driven

18. Page 18
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
WinUndelete
Courtesy
of
WinRecovery
Software

19. Page 19
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
WinUndelete
Courtesy
of
WinRecovery
Software

20. Page 20
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
WinUndelete
Courtesy
of
WinRecovery
Software

21. Page 21
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
FreeUndelete
Free tool for personal use
Commercial version available

22. Page 22
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
FreeUndelete
Courtesy
of
Recoveronix
Ltd.

23. Page 23
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
OSForensics
A robust forensics tool that also provides
for undeletion
Undelete from a mounted image or from
a live system

24. Page 24
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
OSForensics Deleted Files
Search
Courtesy
of
Recoveronix
Ltd.

25. Page 25
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
OSForensics Deleted Files
Results
Courtesy
of
Recoveronix
Ltd.

26. Page 26
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Linux
File systems
• ext3
• ext4

27. Page 27
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Storing a File in Linux
Stores files in contiguous blocks
Blocks sometimes need to be
extended
Exact size of blocks depends on
parameters used with the command
that creates the partition
Uses inodes and soft links

28. Page 28
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Deleting a File in Linux
Inode hard link is integral
Inode links directly to a specific file
OS keeps a count of references to each
hard link
When reference count reaches zero, file
is deleted

29. Page 29
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Recovering a File in Linux
Move system to single-user mode with init 1
command
Use grep to search for and recover files
Example:
• # grep -i -a -B10 -A100
'forensics' /dev/sda2 >
file.txt

30. Page 30
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
extundelete
Works with both ext3 and ext4 partitions
in Linux
Uses shell commands
Example: To restore all deleted files from
sda1 partition:
• extundelete /dev/sda4 --
restore-all

31. Page 31
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Scalpel
Works with Linux and Mac OS
Possible to compile source code to work
in Windows

32. Page 32
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Scalpel (Cont.)
Install
Verify output
directory is
empty
Edit config
file
Run scalpel
command

33. Page 33
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Scalpel (Cont.)
1. Install the tool.
2. In the configuration file
/etc/scalpel/scalpel.conf, uncomment the
specific file format you want to recover.
3. Run the following command:
sudo scalpel
[device/directory/file name] -o
[output directory]

34. Page 34
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Macintosh
Macintosh OS X and later versions are
based on FreeBSD
• A UNIX clone, much like Linux
Mac OS X uses HFS+, or Hierarchical File
System Plus
Earlier versions of Macintosh used HFS

35. Page 35
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
MacKeeper
Recovers deleted files on Macintosh
computers
Free, fully functional trial version
available

36. Page 36
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
MacKeeper
Open Files
Recovery
tool
Select
volume
Select
Undelete

37. Page 37
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Recovering Information from
Damaged Media
Remove
drive/connect
to test system
Boot test
system
Copy files
from drive to
test system

38. Page 38
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Recovering Information from
Damaged Media (Cont.)
Remove
drive/connect
to test system
Boot test
system
Drive not
recognized?
Perform repair
Image drive
content

39. Page 39
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Attempting Local Repair
Replace printed circuit board
Replace read/write head
assembly
Transfer disk platters to
healthy drive

40. Page 40
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Recovering After Logical
Damage
Logical damage
• May prevent host operating system from
mounting or using the file system
• May cause system crashes and data loss
• May be caused by power outages, or
turning off a machine while it is booting
or shutting down

41. Page 41
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Recovering After Logical
Damage (Cont.)
Microsoft Windows: chkdsk
Linux: fsck
Mac OS X: Disk Utility
The Sleuth Kit
TestDisk

42. Page 42
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Preventing Logical Damage
Journaling file systems
Use a consistency checker
Use disk controllers with battery backups

43. Page 43
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Consistency Checking
Involves scanning a disk’s logical
structure to ensure that it is consistent
with its specification
Verifies that dot (.) and dot-dot (..)
entries point to correct directories
Checkers include chkdsk and fsck

44. Page 44
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Consistency Checking Problems
Can fail is file system is highly
damaged
Chkdsk utility might delete files that
are out of place or unexplainable

45. Page 45
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Zero-Knowledge Analysis
Few assumptions made about state of
the file system
Scan drive
Match
results to
specs

46. Page 46
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
File Carving
 Can use file carving on a file that’s only partially
recovered
 Works on any file system
 Is often used to recover data from a disk where
there has been some damage or where the file
itself is corrupt
 File carving utilities look for file headers and/or
footers, and then pull out data s found between
the two boundaries
 One popular file carving tool is Scalpel

47. Page 47
System Forensics, Investigation, and Response
© 2019 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Summary
Undeleting data
Recovering information from damaged
drives