DF Midterm

Main file system used by Microsoft Windows

NTFS (New Technology File System).

File system natively supported by all commonly used operating systems

FAT32.

RAID 0

Striping; rapid access and increased storage but no redundancy. Minimum 2 drives.

RAID 1

Mirroring; duplicates data for recovery. Minimum 2 drives.

RAID 5

Places parity recovery data on each disk. Minimum 3 drives.

RAID 6

Uses redundant parity on each disk. Minimum 4 drives.

RAID 10

Mirrored striping; combination of RAID 1 and RAID 0. Minimum 4 drives.

NTFS organization

NTFS Boot Sector → Master File Table ($MFT) → File System Data, with a Master File Table copy ($MFTMirr).

Size of each MFT entry/record

1,024 bytes.

JPEG file header

FF D8 FF.

Number of bytes in one sector

512 bytes.

Number of date/time artifacts within one MFT entry

8 total: 4 in $STANDARD_INFORMATION and 4 in $FILE_NAME.

4th Amendment

Protects people, residences, and property from unreasonable searches and seizures; legal authority such as a warrant or consent is generally required.

5th Amendment

Protects individuals from being forced to incriminate themselves.

Sector

The smallest physical unit on a traditional hard drive where data is stored.

Cluster

A group of sectors used by the file system as an allocation unit.

Example: sectors to cluster

8 sectors/cluster × 512 bytes/sector = 4,096 bytes/cluster.

Hex 0x0A

Decimal 10; binary 1010.

Hard shutdown advantages

Simple, effective, no software traps, and no password is needed.

Hard shutdown disadvantages

Can cause file-system corruption, loses volatile data, and can create encryption issues.

RAW acquisition advantages

Fast, flat format, can be split into smaller files, and most forensic tools can read it.

RAW acquisition disadvantages

No compression, requires as much storage as the original disk/data, and no metadata is stored within the image.

Proprietary acquisition features not available with RAW

Integrated metadata, optional compression, and encryption/password protection.

Hardware write-blocker: Write Failure

Returns a write failure to the operating system.

Hardware write-blocker: Write Success

Returns success to the operating system but does not actually modify the data.

Hardware write-protection benefits

OS independent, portable, and scalable.

Software write-protection benefits

Easy to install, easy to implement, and less expensive.

FAT32 file deletion

First filename character changes to 0xE5

Clusters are marked unallocated (0x00000000); data remains until overwritten.

NTFS file deletion

MFT flag changes from 0x01 (active) to 0x00 (deleted)

Non-resident attribute for MFT is processed and clusters are marked unallocated in the bitmap

FAT32 cluster status: 0x00000000

Unallocated.

FAT32 cluster status: cluster number

Next cluster in the run.

FAT32 cluster status: 0x0FFFFFF7

Bad cluster.

FAT32 cluster status: 0x0FFFFFF8

Last cluster.

MFT attribute 0x10

$STANDARD_INFORMATION — Creation, Modified, MFT Entry Modified, Last Accessed, and Flags.

MFT attribute 0x30

$FILE_NAME — parent directory reference, timestamps, flags, filename information, and related name information.

MFT attribute 0x80

$DATA — contains the file data.

NTFS timestamp: Creation/Birth

Date and time when the file was created on the volume.

NTFS timestamp: Modified

Last date and time when the file's data was changed.

NTFS timestamp: Entry Modified

Last date and time when the file's attributes/MFT entry were changed.

NTFS timestamp: Accessed

Last date and time the file was opened/accessed.

NTFS timestamp time zone

NTFS timestamps are recorded in UTC.

FAT32 date conversion example: 0x4393

12/19/2013.

FAT32 date conversion: year

The stored year value is added to 1980.

Resident data

Data small enough to be stored inside the MFT entry.

Nonresident data

Data too large for the MFT entry; the MFT entry points to the clusters where the data is stored.

Four classifications/types of deleted data

Recycle Bin, Deleted File/Folder, Data Carving, and File Slack.

Why carved files are difficult to use as evidence

Original metadata and filename cannot be recovered, making it difficult to determine when the file was created, accessed, modified, or whether the suspect created/downloaded it.

SSD wear-leveling forensic implication

Wear leveling moves data between physical locations, which can destroy forensic metadata and make deleted-data recovery more difficult.