Lecture 6 File Systems in Digital Forensics

Physical vs. Offset Addresses

• Physical address: Refers to the start of the physical disk.

• Offset address: Refers to the start of a partition.

BIOS and CMOS

• BIOS: Firmware controlling the computer from power-on until the OS takes over.

• CMOS: Battery-powered semiconductor memory chip storing configuration settings made via the BIOS interface.

  • Stores system time/date, hardware settings, and boot order.

  • Failing CMOS battery can cause incorrect time/date, impacting forensic investigations.

Disk Initialisation, Partitioning, and Formatting

• Disk initialisation: Includes disk signature.

• Disk partitioning: MBR or GPT defines partitions.

• Disk formatting: VBR defines volumes.

  
  

Partitions vs. Volumes

• Partition:

  • Division of a physical disk; resides on a single disk.

  • Defines the layout of a disk.

  • A set of contiguous sectors of a disk.

• Volume:

  • Partition formatted with a file system (e.g., NTFS), managed by an Operating System.

  • Can span across more than one partition or several disks.

Data Analysis Process

• Analysis of MBR or GPT for understanding the disk layout.

• Analysis of VBR, recovery & decryption of volumes to fully access their content.

• Analysis and recovery of user/system files content and metadata.

File System vs. Operating System

• File System:

  • A data organisation system for storing and retrieving data to and from a volume on a storage media.

• Operating System:

  • Libraries and executables organized around the system kernel, allowing processes and applications to share resources.

Responsibilities

• Operating System:

  • Process Management

  • Resource Management

  • File Management (using the File System)

  • Memory Management

  • Device Management

• File System:

  • Disk management: Logical file organization, metadata management, disk space allocation.

  • Naming: Translation between filenames and storage location.

  • Protection: Permission and restriction of file access.

  • Reliability: Resilience to hardware failures, ensuring file integrity.

FAT File System

• FAT 12/16/32:

  • Developed by IBM & Microsoft.

  • Uses 12, 16, and 28-bit entries in addressing tables.

  • Supported by all common Operating Systems.

  • Primarily used in portable media.

• exFAT / FAT64:

  • Extended FAT, developed by Microsoft.

  • Optimized for USB drives and SD cards.

  • Lightweight but overcomes some FAT32 limitations.

Limitations of FAT32

• Supports files up to 4GB and volumes up to 2TB.

• Not a journaling file system, increasing corruption risk.

• Does not support file permissions.

NTFS File System

• NTFS (New Technology File System):

  • Default for NT family Windows versions from NT 3.1 (except Win9x and Millennium).

  • Now supported by default in Linux and Mac OS (read-only).

Advantages of NTFS over FAT

• Ability to set permissions on files/folders via ACLs.

• More efficient support for larger disks (less slack space).

• Supports encryption.

ReFS File System

• ReFS (Resilient File System):

  • Available from Windows Server 2012.

  • Used for data storage disks.

• Promises:

  • Automatic integrity check (checksums for metadata).

  • Integration with RAID.

  • Better handling of disk failure and automatic repair.

• Lacks:

  • File system compression and volume encryption support (BitLocker for full volume encryption is supported).

Apple/Mac OS X File Systems

• MFS (Macintosh File System):

  • Released in 1984.

• HFS (Hierarchical File System):

  • Released in 1985 to replace MFS.

• HFS+:

  • Released in 1998 with MacOS 8.

  • Uses big endian data structures.

  • Not supported by default by Windows and Linux (drivers available).

• APFS (Apple File System):

  • Released in March 2017 with MacOS 10.3 / iOS 10.3.

  • Default from September 2017, adopted across all Apple devices.

  • Optimized for SSD storage and focused on encryption.

Endian in Digital Forensics

• Important for interpreting raw data (e.g., 0x0D0C0B0A vs. 0x0A0B0C0D).

Linux File Systems

• Ext2/3/4 (Linux Extended File System):

  • Ext2 commonly used in IoT/Cisco routers.

  • Current OSes use ext4.

• Android:

  • Used YAFFS up to v2.3, then switched to ext4.

• XFS, JFS, ZFS:

  • Proprietary Unix file systems ported to Linux.

NTFS Details

• Everything is a file (administrative and user data).

NTFS File System Layout

• Includes NTFS Boot Sector with a hidden copy, Metadata Files, and MFT.

Boot Sectors

• VBR located at the first sector of the volume (sector 0).

• Backup VBR located at the last sector of the volume in NTFS.

• Contains essential file system information (bytes per sector, sectors per cluster, MFT start address, MFT record size).

Master File Table (MFT)

• Contains information about all files and directories.

• Stores information needed to locate data on the disk.

• Each MFT record is 1024 bytes long.

MFT Records

• File system metadata records (records 0-15).

  • Reserved for file system information.

• Users’ file metadata/data records.

  • Contain attributes with filename and metadata of users’ files or directories.

  • May contain a small portion of the content of users’ files.

Example of File System Metadata Records

• 0: $MFT (index of every user file/directory)

• 1: $MFTMirr (backup for 1st records of the MFT)

• 2: $LogFile (journal that records metadata transactions)

• 3: $Volume (volume label, identifier, version)

• 4: $AttrDef (IDs for attributes)

• 5: . (root directory of the file system)

• 6: $Bitmap (allocation status of each cluster)

• 7: $Boot (boot sector & boot code)

Inside an MTF Record

• MFT record header, set of attributes, and unused space.

Attribute Structure in MFT Record

• Comprised of an attribute header and attribute data.

Example of MFT Record Attributes

• 16: $STANDARD_INFORMATION (general info, e.g., last accessed, written and created date/times)

• 48: $FILE_NAME (file name & last accessed, written and created date/times)

• 80: $SECURITY_DESCRIPTOR (access control and security properties)

• 128: $DATA (file contents, up to ~700 bytes of file content)

• 144: $INDEX_ROOT (root node of an index tree)

• 160: $INDEXALLOCATION (leaf nodes of an index tree rooted in $INDEXROOT attribute)

• Every MFT record must have $STANDARDINFORMATION and at least one $FILENAME attribute.

Resident vs. Non-Resident Attributes

• Resident:

  • Data stored only in MFT records (in the MFT area).

• Non-Resident:

  • Attribute reserves extra space on the disk with cluster runs, storing data in the user data area. Used when data doesn't fit within the 1024-byte record.

$DATA Attribute Residency

• Resident for small files (< 700 bytes).

• Non-resident for files ≥ 700 bytes.

Cluster Runs

• Used to remember which clusters store each file (size ≥ 700 bytes).

• Each cluster run is a set of consecutive clusters.

• Recorded with the start cluster address and the length of the run in the attribute data.