CYBER FORENSICS
IOT743E02
Unit 3: Linux File system Analysis and File Carving
Unit 3: Linux File system Analysis and File
Carving
Unix/Linux file systems (Ext2/Ext3), Unix/Linux Forensic Investigation:
Unix/Linux forensics, investigation steps and technologies,
Case Study: Memory Acquisition of Linux System using LiME ,
Principles of file carving, Header/Footer carving, Bitfragment Gap
carving, Case Study- Image File Foremost File Carving tool.
T1. “Introductory Computer Forensics-A Hands-on Practical
Approach”, by Xiaodong Lin, Springer, 2018.
2
3
Unix/Linux file systems
What is the Linux File System?
A Linux file system is a set of processes that controls how, where, and when data is stored or
retrieved from storage devices. It manages data systematically on disk drives or partitions, and
each partition in Linux has its own file system because Linux treats everything as a file,
including devices and applications.
Like Windows uses C: and D: drives, Linux uses mount points, but everything appears under
the root / directory. In Linux, everything is treated as a file, including devices and
applications.
[Link]
Linux File System Format
• The Linux File System is a structured collection of files on a disk drive
or a partition. It is used for data management, and the partition
contains specific data. The purpose behind systematic data storage is
that it can quickly access files. It manages all the information,
including file size, creation date, file name, etc.
• Linux File System Format supports Windows operating systems. It
supports Ext2, Ext3, Ext4, JFSm ReiserFS, XFS, btrfs and swap file
system.
5
Linux File System Structure
The architecture of a file system comprises three layers mentioned below.
1. Logical File System
2. Virtual File System
3. Physical File System
6
1. Logical File System:
The Logical File System acts as the interface between the user applications and the file system itself. It facilitates essential
operations such as opening, reading, and closing files. Essentially, it serves as the user-friendly front-end, ensuring that
applications can interact with the file system in a way that aligns with user expectations.
2. Virtual File System:
The Virtual File System (VFS) is a crucial layer that enables the concurrent operation of multiple instances of physical file
systems. It provides a standardized interface, allowing different file systems to coexist and operate simultaneously.
This layer abstracts the underlying complexities, ensuring compatibility and cohesion between various file system
implementations.
3. Physical File System:
The Physical File System is responsible for the tangible management and storage of physical memory blocks on the disk.
It handles the low-level details of storing and retrieving data, interacting directly with the hardware components. This
layer ensures the efficient allocation and utilization of physical storage resources, contributing to the overall performance
and reliability of the file system.
Together, these layers form a cohesive architecture, orchestrating the organized and efficient handling of data in the Linux
operating system.
7
Characteristics of a File System
A file system defines the rules and structures for how data is organized, stored, accessed,
and managed on a storage device.
• Space Management: How the data is stored on a storage device. Pertaining to the memory
blocks and fragmentation practices applied in it.
• Filename: A file system may have certain restrictions to file names such as the name
length, the use of special characters, and case sensitive-ness.
• Directory: The directories/folders may store files in a linear or hierarchical manner while
maintaining an index table of all the files contained in that directory or subdirectory.
• Metadata: For each file stored, the file system stores various information about that file's
existence such as its data length, its access permissions, device type, modified date-time,
and other attributes. This is called metadata.
• Utilities: File systems provide features for initializing, deleting, renaming, moving, copying,
backup, recovery, and control access of files and folders.
• Design: Due to their implementations, file systems have limitations on the amount of data
they can store.
8
Essentials Aspects of File System
1) Journaling:
Journaling file systems keep a log called the journal, that keeps track of the changes
made to a file but not yet permanently committed to the disk so that in case of a
system failure the lost changes can be brought back. Journaling works like a checklist:
• Log changes in the journal.
• Apply changes to the disk.
• Mark them as complete.
Journaling can be configured in three different modes, each offering a trade-off between
reliability and performance. The Journal mode is the most reliable as it logs both file data
and metadata, ensuring the highest level of data integrity. However, it is also the
slowest mode due to the extensive logging process. The Ordered mode, on the other
hand, logs only the metadata, with the file data being written before the metadata.
This provides a balanced approach between data safety and system performance. Lastly,
the Writeback mode logs only metadata without enforcing any order between file data
and metadata writes. While it is the fastest journaling mode, it is also the least safe, as it
increases the risk of data corruption in the event of a crash.
9
2) Versioning:
• Versioning file systems store previously saved versions of a file,
i.e., the copies of a file are stored based on previous commits to
the disk in a minutely or hourly manner to create a backup.
3) Inode:
• The index node is the representation of any file or directory based
on the parameters - size, permission, ownership, and location of
the file and directory.
10
Linux File Systems
1) ext (Extended File System):
• Implemented in 1992, it is the first file system specifically designed for Linux. It is the first member of the ext family of file systems.
2) ext2:
▪ The Ext2 is defined as a second extended file system. It was
introduced in 1993 . It is a non-journaling file system that
became known for its efficient handling of flash drives and
SSDs. It solved the problems of separate timestamp for access,
inode modification and data modification. Due to not being
journaled, it is slow to load at boot time.
• It is the first commercial file system designed to overcome the
limitation of the Ext file system. Ext2 does not have a journaling
feature, and it is recommended for flash drives and USB. The
individual file size that Ext2 supports is 2TB and can be from
4TB to 32 TB depending upon block size.
11
3) Xiafs:
• Also developed in 1993, Xiafs was developed as an alternative but lacked the power and
functionality of ext2. Due to limited features and scalability, it is no longer in use.
4) ext3:
Introduced in 1999, ext3 brought in journaling capabilities, offering improved reliability. Unlike ext2, it avoided long boot-time
checks after an improper shutdown. It also supported online file system growth and HTree indexing, making it efficient for
large directories.
Ext3 refers to the third extended file system. This file journaling system is used on multiple Linux distributions. It can track all the
changes made with Ext3 to improve reliability and reduce possible file system corruption. In addition, it allows you to upgrade
from Ext2 without the need to back up and restore data.
• Ext2 and Ext3 use e2fsporgs as a standard utility. It makes the
conversation between both the file systems easier and
smooth.
• Ext3 is designed with new features such as journal, online file
system growth, and HTree indexing large directories.
• Ext3 used less CPU power as compared to other Linux file
systems. It is relatively safer and can easily recover data.
12
5) JFS (Journaled File System):
• First created by IBM in 1990, the original JFS was taken to open source to be implemented for Linux in 1990 it
is Known for its ability to perform well under varied loads JFS performs well under different kinds of load but is
not commonly used anymore due to the release of ext4 in 2006 which gives better performance.
6) ReiserFS:
• It is a journal file system developed in 2001. Despite its earlier issues, it has tail packing as a scheme to
reduce internal fragmentation. It uses a B+ Tree that gives less than linear time in directory lookups and
updates. It was the default file system in SUSE Linux till version 6.4, until switching to ext3 in 2006 for version
10.2.
7) XFS:
• XFS is a 64-bit journaling file system and was ported to Linux in 2001. It now acts as the default file system for
many Linux distributions. It provides features like snapshots, online defragmentation, sparse files, variable
block sizes, and excellent capacity. It also excels at parallel I/O operations.
8) SquashFS:
• Developed in 2002, this file system is read-only and is used only with embedded systems where low overhead
is needed.
9) Reiser4:
• It is an incremental model to ReiserFS. It was developed in 2004. However, it is not widely adapted or
supported on many Linux distributions.
13
10) ext4:
• The fourth ext4 developed in 2006, is a journaling file system. It has backward
compatibility with ext3 and ext2 and it provides several other features, some of
which are persistent pre-allocation, unlimited number of subdirectories,
metadata checksumming and large file size. ext4 is the default file system for
many Linux distributions and also has compatibility with Windows and
Macintosh.
• Ext4 was initially introduced to extend storage limits and improve system
performance. Compared to the previous Ext system, Ext4 can support up to 1TB
volume size and for single files up to 16TB with standard 4K block size.
14
ext4 in Linux File System :
Ext4 was designed to be backward compatible with ext3 and ext2, its previous generations. It's better than the previous generations in the following
ways:
• It provides a large file system .
• Utilizes extents that improve large file performance and reduces fragmentation.
• Provides persistent pre-allocation which guarantees space allocation and contiguous memory.
• Delayed allocation improves performance and reduces fragmentation by effectively allocating larger amounts of data at a time.
• It uses HTree indices to allow unlimited number of subdirectories.
• Performs journal checksumming which allows the file system to realize that some of its entries are invalid or out of order after a crash.
• Support for time-of-creation timestamps and improved timestamps to induce granularity.
• Transparent encryption.
• Allows cleaning of inode tables in background which in turn speeds initialization. The process is called lazy initialization.
• Enables writing barriers by default. Which ensures that file system metadata is correctly written and ordered on disk, even when write caches lose
power.
There are still some features in the process of developing like metadata checksumming, first-class quota supports, and large allocation blocks.
However, ext4 has some limitations. Ext4 does not guarantee the integrity of your data, if the data is corrupted while already on disk then it has no
way of detecting or repairing such corruption. The ext4 file system cannot secure deletion of files, which is supposed to cause overwriting of files
upon deletion. It results in sensitive data ending up in the file-system journal.
15
11) btrfs (Better/Butter/B-tree FS):
• It was developed in 2007. It provides many features such as
snapshotting, drive pooling, data scrubbing, self-healing and online
defragmentation. It is the default file system for Fedora Workstation.
12) bcachefs:
• This is a copy-on-write file system that was first announced in 2015
with the goal of performing better than btrfs and ext4. Its features
include full filesystem encryption, native compression, snapshots,
and 64-bit check summing.
16
Linux File Hierarchy Structure
• The Linux File Hierarchy Structure or the Filesystem
Hierarchy Standard (FHS) defines the directory
structure and directory contents in Unix-like
operating systems. It is maintained by the Linux
Foundation.
• In the FHS, all files and directories appear under the
root directory /, even if they are stored on different
physical or virtual devices.
• Some of these directories only exist on a particular
system if certain subsystems, such as the X Window
System, are installed.
• Most of these directories exist in all UNIX operating
systems and are generally used in much the same
way; however, the descriptions here are those used
specifically for the FHS and are not considered
authoritative for platforms other than Linux.
17
Linux Forensics
One crucial concept in Linux forensics is the "1000:1 rule." This principle
highlights an important asymmetry in cybersecurity:
• Defenders must be aware of thousands of potential attack vectors.
• Attackers only need to find one successful method to compromise a
system.
• Once a system is compromised, defenders need to find just one piece of
evidence to uncover the breach.
This rule emphasizes the importance of thorough, systematic examination
of your Linux systems using readily available tools.
18
Prioritizing Common Attacks in Linux Security
While Zero Day exploits often grab headlines, they are rare and typically
expensive to deploy. Instead, focus your efforts on detecting and
preventing common attacks, which are: More prevalent
• Equally damaging
• Often provide attackers with deniability
• By addressing these common threats, you significantly improve your
overall security posture.
19
What is Linux Forensics?
• Linux forensics refers to the process of collecting, analyzing, and
reporting on digital evidence found within Linux systems as part of
a legal or investigative process. This can include a wide range of
activities.
20
• Data Acquisition: Securely collecting data from Linux systems, ensuring that it's not
altered during the process. This often involves making a bit-by-bit copy of the entire file
system.
• Data Analysis: Analyzing the collected data to uncover important information. This can
involve looking at file system structures, examining log files, recovering deleted files, and
analyzing system and user activities.
• Timeline Analysis: Creating timelines of system and user activities to understand the
sequence of events.
• Network Analysis: Examining network-related activities, including logs of network
connections, analyzing network configuration, and looking into network service
information.
• Memory Analysis: Analyzing the contents of the system's memory (RAM) to gather
information about system state, running processes, and other dynamic activities.
• Artifact Analysis: Looking at specific artifacts left on a Linux system that could indicate
usage patterns, such as bash history, command execution, USB device history, and
more.
• Reporting: Compiling the findings into a comprehensive report that is understandable to
those who may not have a technical background, such as law enforcement officers or
legal professionals.
21
Forensics Artifacts in Linux Forensics
• In Linux forensics, key artifacts are specific files, logs, and system
information that can provide valuable insights during an
investigation. These artifacts are crucial for reconstructing events,
understanding user actions, and identifying anomalies. Some of
the key artifacts in Linux forensics include:
22
• Bash History: Stored in .bash_history, this file contains a record of commands
entered by users in the Bash shell. It can provide insights into user actions.
• Log Files: Located in /var/log/, these files log various system and application
activities. Key logs include:
• [Link] or secure: Records authentication and authorization information.
syslog or messages: Contains general system activity logs.
dmesg: Logs kernel-related messages and errors.
apache2/[Link] and apache2/[Link] for web server activities (if Apache is
used).
User and Group Information: Stored in /etc/passwd (user accounts) and /etc/group
(group information), these files provide details about users and groups on the
system.
• Cron Jobs: Files in /etc/cron.* and user-specific cron jobs (crontab -l) show
scheduled tasks, which can reveal automated or planned actions on the system.
• Network Configuration and Logs: Files in /etc/network/, /etc/hosts, and
/etc/[Link] provide information on network configuration. Network logs can
show past network connections and activities.
• SSH Logs and Keys: SSH logs (/var/log/[Link] or /var/log/secure) and SSH key
files (.ssh/authorized_keys, .ssh/id_rsa, etc.) provide details on remote access to
the system.
23
• Binary Executable History: The history file in user directories and system-wide executable logs can
reveal what programs have been run.
• Email and Communication Logs: If the system is used for email or messaging, logs and files related
to these services can contain crucial information.
• Web Browser History: If web browsers are used, their history files can provide details about
websites visited and actions taken online.
• Deleted Files and File Recovery: Information on recently deleted files or attempts to recover such
files can be crucial, especially in cases where there is an attempt to hide or delete evidence.
• System and Application Configuration Files: These files (/etc directory) can provide context about
how the system is set up and how applications are configured.
• Memory Dumps: Analysis of memory dumps can reveal information about running processes, open
files, network connections, and more, at the time the dump was taken.
Each of these artifacts can provide a wealth of information and, when analyzed together, can help
create a comprehensive picture of the activities on a Linux system. It's important for investigators to
have a strong understanding of Linux systems and file structures to effectively locate and interpret
these artifacts.
24
Key Areas of Focus in Linux Forensics
When investigating a Linux system for potential security breaches, concentrate on these three
main areas:
1. Suspicious Directories
Directories form the backbone of the Linux file system. Look out for:
• Directory Mimicry: Folders attempting to masquerade as legitimate system directories
• Hidden Directories: Concealed folders, often using special characters or unusual naming conventions
• Unusual Attributes: Directories with abnormal permissions, creation dates, or those differing from a clean
system image
2. Suspicious Files
Files often contain telltale signs of system compromise. Be alert for:
• Tampered Logs: Especially audit logs that have been erased or reduced to zero bytes
• Misleading File Types: Files with extensions that don't match their actual content
• Unusual File Locations: Legitimate system files appearing in unexpected places or modified binaries
3. Suspicious Processes
Running processes can reveal ongoing malicious activities. Watch for:
• Deceptive Process Names: Malicious processes often mimic names of legitimate system processes
• Unexpected Open Ports: Unfamiliar open ports or outbound connections
• Deleted but Active Processes: Processes that continue running despite being deleted from disk
25
Implementing a Regular Security Check Routine
To maintain a secure Linux environment, implement these best practices:
• Establish a baseline of your system's normal state
• Regularly scan for new or modified files in sensitive directories
• Monitor running processes and compare against known-good configurations
• Review network connections and open ports periodically
• Analyze system logs for unusual activities or login attempts
Effective Linux forensics doesn't always require advanced or expensive tools. By leveraging basic Linux commands and adopting a
systematic approach to system analysis, you can uncover significant security issues and maintain a robust defense against
common threats.
Remember, the 1000:1 rule works in your favor as a defender. Even the most sophisticated attacker is likely to leave traces that can
be detected through careful observation and the use of these simple yet powerful Linux commands.
Stay vigilant, keep your Linux systems updated, and regularly perform these basic checks to ensure the ongoing security of your
Linux environment.
Additional Resources
• Linux Security Basics
• NIST Guide to Computer Security Log Management
• The Art of Command Line
• Sherlock Linux
26
Linux Memory Acquisition using LiME
27
What is Memory Acquisition?
28
Basic of LiME
29
Principles of file carving
• File carving is a technique used in digital forensics to recover
deleted or lost files or data. It involves reconstructing files from
a block of binary data based on their content, rather than relying
on file system metadata. This method is particularly useful
when file system structures are damaged or incomplete, or
when recovering residual file system metadata.
The primary objectives of file carving include:
• Understanding fundamental concepts and techniques of file carving
• Understanding advanced state-of-the-art file carving techniques
• Becoming familiar with popular open-source file carving tools
30
Why File Carving is Necessary
• The knowledge of file system structures and metadata helps recover
deleted or lost files (previous chapters)
• However, if the residual file system metadata or information about deleted
files and directories is unavailable or damaged, traditional recovery
methods based on file system metadata remnants become ineffective.
• Criminals, for instance, might intentionally destroy file system structure to
prevent recovery. In such scenarios, file carving provides a more
sophisticated data recovery solution by reconstructing files solely based
on their contents.
• It emerged as an important technique in digital forensics around 2002
31
Core Principles and Techniques of File Carving
The fundamental concept of file carving involves identifying and extracting
file content directly from blocks of binary data
1. Header/Footer Carving (File Structure-Based Carving): This is a
primary technique where most known file types possess distinctive header
and footer structures that uniquely mark their beginning and end
◦ Tools like Foremost operate by searching for these predefined
header-footer pairs using a configuration file that contains the specific
header and footer information for various file format. For example, a Bitmap
image file (BMP) starts with "42 4D", and JPEG files begin with "FF D8 FF E0"
and end with "FF D9".
◦ Once a header is found, the carving tool identifies the corresponding
footer to extract the data block in between. This method is effective for
contiguous files, which are stored in a single, unbroken sequence of
blocks.
32
33
2. Content-Based Reconstruction: This approach means that file carvers
rebuild files solely based on their internal contents, rather than relying on external
file system information that might be missing or corrupted
34
Challenges in File Carving
• One of the significant challenges in file carving is dealing with
fragmented files, which are files stored in multiple non-contiguous
blocks across the storage medium
• Traditional header/footer carving methods are primarily effective for
contiguous files. When a file is fragmented, its blocks are scattered,
making simple header/footer matching insufficient.
Other challenges include:
• False positives: Recovering data that appears to be a file but is not, or
recovering incorrect data due to header/footer matches within other file
types or random data
• The need for manual intervention: In many cases, recovered files may
be incomplete or not viewable, requiring additional manual effort to
correct the data blocks
35
Advanced Carving Techniques and Tools
To address the complexities of fragmented files and improve recovery
rates, more sophisticated solutions and tools have been developed.
Popular Carvers:
• EnCase: A widely used commercial forensic software by Guidance
Software, used by law enforcement agencies and corporations
• Scalpel, Foremost, and FTK: Other well-known carvers. Foremost, for
instance, uses a configuration file for file header/footer definitions and
identifies file types like JPEG.
• Bifragment Gap Carving (BGC): BGC is an advanced technique
specifically designed to recover fragmented files. It was first designed
and developed by Garfinkel in 2006
36
Bifragment Gap Carving (BGC):
This approach was specifically designed to recover deleted files that are
fragmented, meaning they are stored in two or more non-contiguous pieces.
◦ A "bi-fragmented file" consists of a base fragment (header and first part of the data)
and another fragment (containing the rest of the file data and the footer)
◦ BGC's algorithm identifies potential fragments and uses a "gap carving" technique
to test all possible combinations of data blocks between identified fragments to produce a
valid reconstructed file
◦ A key element of BGC is its object validation model
37
Object Validation
Object validation is a crucial aspect of advanced file carving, particularly in BGC, used to
verify the accuracy and integrity of recovered files and to reduce false positives.
• Purpose: It checks if a candidate sequence of data blocks meets the structural
requirements for its assumed file type . If validation fails, the candidate is discarded,
indicating an incorrect reconstruction or a file too fragmented to be recovered by the
current method.
• Validation Rounds in BGC:
1. Preliminary Tests: Quick checks applied early on to eliminate many incorrect
candidates. For instance, a JPEG candidate must begin with specific hexadecimal numbers
(FF D8 FF E0) and end with (FF D9)
2. Container Structure Validation: For container file types (e.g., ZIP, Microsoft Office
documents), this involves checking their internal structures and embedded "content sum"
or Cyclic Redundancy Check (CRC) values to verify integrity . CRC is a data integrity
verification technique where a checksum is calculated and compared against an
embedded value.
3. Decompression and Semantic Validation: This is the final round for certain file
types, involving attempting to decompress and semantically validate the content of the
candidate sequence of blocks, especially for ZIP and Microsoft Office files.
38
• Benefits and Limitations:
This modular validation framework automatically reduces false positives
that plagued earlier header/footer carvers. However, BGC's validator
framework means it cannot recover files with missing headers or missing
data blocks because such files would fail the validation process
39
Challenges in File Carving
Despite advancements, several challenges persist in file carving:
• Fragmented Files: Recovering non-contiguous files is significantly more
difficult than contiguous ones . While BGC addresses bi-fragmented files,
highly fragmented files (more than two pieces) are exponentially more
challenging to recover due to the vast number of possible fragment
combinations. Often, they still require substantial manual intervention from
a forensic investigator.
• Missing or Corrupt Headers/Footers: If a file type lacks unique
header/footer structures, or if these are damaged or missing, traditional
header/footer carving becomes less effective. BGC also cannot recover files
with missing headers or data blocks.
• False Positives: Although advanced validation helps, the possibility of
carving incorrect or incomplete data can still arise, requiring a forensic
investigator to correct data blocks manually
40
File Carving Tools
There are different file carving tools available, many of which are open source. Three popular file carvers include
Foremost, Scalpel, and TestDisk/PhotoRec
1. Foremost
• Origin and Purpose: Foremost was developed by US Air Force special agents to create a configuration file that
contains file header/footer information for certain file formats
• How it Works: It sifts through disk looking for predefined headers and footers. Once a header is found, it
searches for its corresponding footer in the configuration file
• Configuration: The configuration file defines the file types Foremost can carve. For example, it includes entries
for GIF and JPG files, specifying their header and footer hexadecimal values and whether a header is comment or
ignored
◦ For GIF files, the configuration might specify "y 155000000 \x47\x49\x46\x38\x37\x61 \x00\x00\x3b" for its
header
◦ For JPG files, it might include "y 20000000 \xff\xd8\xff\xe0\x00\x10 \xff\xd9"
• Output: After Foremost has finished, it provides a summary of what was done and puts recovered files in a
subfolder named output in the directory from where it was called
. For example, recovering JPEG files from the DFRWS 2006 Forensics Challenge created two items: the "jpg"
subfolder and an "[Link]" file
• Limitations: Its effectiveness can be hampered by factors that increase the time taken for searches, such as
repeatedly searching through data that has been previously matched, and the length of time a few searches can
take and memory usage
41
2. Scalpel
• Improvements over Foremost: Scalpel was developed by Richard and Richard
and Rousseve to enhance performance and decrease memory usage compared to
Foremost
• Mechanism: Scalpel performs an in-memory lookup of headers and footers,
which is a much faster method than repeatedly searching the hard drive
• Functionality: It includes memory-to-memory copy operations and faster byte
writing, while largely keeping the same functionalities as Foremost. Scalpel reads
the same configuration file as Foremost.
42
TestDisk and PhotoRec
• TestDisk: An open-source, multi-platform data recovery tool developed by CGsecurity team . It is capable of running on multiple operating
systems, including:
• DOS
• Windows XP, 7 and 10
• Linux, FreeBSD, NetBSD, OpenBSD
• ◦ SunOS
• ◦ MacOSx
• TestDisk Features: TestDisk specializes in the recovery of deleted or lost files and offers many useful features
• ◦ Fix Partition table
• ◦ Recover deleted partition
• ◦ Rebuild FAT12/16/32 boot sector
• ◦ Fix Fat Tables
• ◦ Rebuild NTFS boot sector
• ◦ Recover NTFS boot sector from backup
• ◦ Fix MFT using MFT mirror
• ◦ Locate EXT2/3/4 backup superblock
• ◦ Undelete files from Fat, EXTfat, NTFS and EXT2/3/4 file systems
• ◦ Copy files from deleted FAT, EXTfat, NTFS and EXT2/3/4 partitions
43
PhotoRec: This is a companion program to TestDisk. While TestDisk offers broader options,
PhotoRec is specifically designed for recovering lost photos and pictures from various digital cameras
and storage media. PhotoRec excels at recovering deleted or lost photos, whereas TestDisk provides more
comprehensive data recovery functions, such as dealing with deleted or lost partitions
• Recovery Process Example (USB Drive): To recover data from a USB drive using TestDisk,
one might follow these steps
1. Image the USB Drive: Create an image of the USB drive (e.g., dcfldd if=/dev/sdb
of=/home/student/[Link] hash=md5 hashlog=/home/student/[Link]) This step also involves checking the MD5
hash value to ensure data integrity
2. Identify Device Name: Use fdisk -l to find the device name of the USB drive within the Linux VM
3. Launch TestDisk: Open TestDisk and select the created disk image (e.g., testdisk [Link] )
4. Select Partition Type: Choose the correct partition table type (e.g., Intel/PC partition)
5. Analyze Partition: Select the "Analyze" option to search for lost partitions
6. Quick Search: Initiate a "Quick Search" to locate partitions. If a deleted partition is detected and
appears in green, it signifies that TestDisk can restore it
7. Restore Partition: Press ENTER to proceed with restoring the detected partition
8. Write Partition Table: Confirm writing the partition table to the disk image by pressing ‘Y’. This action
restores the deleted partition onto the USB drive.
44
THANKYOU