Disk and File System

Analysis
Outline

Media File System Partition Virtual

Forensic Data Analysis Investigating Malware
Analysis Abstraction Identification Machine Disk Carving
Imaging Methodology Applications Handling
concept Model and recovery Images

Disk and File System Analysis 2

Media Analysis concept
• Analysis of each and every file
• Importance of Metadata
• Where can we find Metadata?
• What is a file system?
• FAT(12,16,332)(File Allocation Table)
• NTFS (New Technology File Table)
• Types of file
• How to identify file type?

Disk and File System Analysis 3

File System Abstraction Model
Storage layers Fat and NTFS EXT2 and FFS
Application level storage Files Files

Information classification Directories or Folders Directories

Storage Space management FAT or MFT Inodes and data bitmaps

Allocation units Clusters Blocks

Data classification Partitions Partitions

Physical Absolute sectors Absolute sectors

Disk and File System Analysis 4

Partition Identification and Recovery
• Partition refers to
• How the storage space or device
is divided up?
• Partition Structure
• How is information structured on
the partition?
• End and Beginning of Partition
• If the partition is Bootable
• Code used during startup

Disk and File System Analysis 5

Partition Identification and Recovery
• MBR (Master Boot Record) and GPT (GUID) Partition Table
• two different ways of storing the partitioning information on a drive.
• Limitations of MBR
• Works for disks up to 2TB in size
• Only supports 4 partitions
• Partition and Boot Data are stored in one place ( what if it gets replaced?)
• Advantages of GPT
• Every partition has a unique ID named “globally unique identifier”
• Size limit based on File System
• Up to 128 partitions on Windows
• Stores multiple copies of partition and boot data across Drive?
Disk and File System Analysis 6
Partition Identification and Recovery
• Physical Damage, Software Corruption, Human error, and Natural
Calamites
• Causes of Data Loss
• Data Recovery Process
• Preliminary Assessment
• Imaging
• In-depth analysis
• Recovery Phase
• Validations
• Explain using FAT…..
Disk and File System Analysis 7
Virtual Machine Disk Images
• Virtual Machines run on hypervisor
• There are two types of hypervisor
• Type 1 hypervisor
• Type 2 hypervisor
• Type 1: loads on physical hardware
• Types 2: on top of an existing OS
• Type1: Found on a workstation with a lot of ram and storage
• Type 2: mostly found on suspect machine
• Most widely used type 2 hypervisor: VMware, VirtualBox, parallel
Desktop, KVM, Microsoft hypervisor
Disk and File System Analysis 8
Virtual Machine Disk Images

Table: Files associated with Vmware [4]

File Extension Description

.vmx Stores configuration files
.log Contains logs of information such as when a VM was powered off, virtual appliances
added….
.nvram Keep track of the state of a VM’s BIOS
.vmdk Stores virtual hard drive’s content
.vmem Stores VM paging files, which serve as RAM
.vmsd Contains information about snapshot

Disk and File System Analysis 9

Virtual Machine Disk Images
Table: Files associated with VirtualBox [4]

File Extension Description

.ova or .ovf File used to create a virtual machine; OVF Stands for “Open virtualization Format”
.vdi Disk image file
.r0 Default libraries
.vbox Saved settings for virtual hard drives
.vbox-extpack Plug-ins
.vbox-prev Backups of VM
.xml-prec Backups of XML settings
.log Log files containing information such as a VM being powered on and off, whether it’s
in hibernation mode, virtual appliances added, and so on

Disk and File System Analysis 10

Virtual Machine Disk Images (Conducting the
Investigations)
• Acquire Forensic image of the host machine
• Link the VM’s IP address with log files
• Detect the presence of VM on the host machine
• Check folders……(which folders)
• Check the host’s Registry
• Existence of a virtual network adapter
• Check for UB devices connected on host ( They may contain live os)
• A VM can be inside another VM
• Live Acquisition of VM
• Snaphots,..
Disk and File System Analysis 11
Virtual Machine Disk Images (Conducting the
Investigations)
• Follow below given procedure
• Image the host machine.
• Locate the virtualization software and VMs, using the information
you’ve learned about file extensions and network adapters.
• Export from the host machine all files associated with VMs, including
log files, virtual adapters, and snapshots.
• Record the hash values of these associated files. Typically, forensics
software can perform this task as part of the export function.
• Next, you can open a VM as an image file in forensics software and
create a forensic image of it or mount the VM as a drive and then image
it or do a live search.
Disk and File System Analysis 12
Carving
• Extracting Data from Digital Storages without the help of File System
• It also recovers the files/data from unallocated spaces.
• Unallocated Spaces do not hold and file information data.
• Reconstruction of a file from the data chunk is one of the challenging
part of file Carving.
• File Carving is different from File Restoration
• Carving Vs Recovery

Disk and File System Analysis 13

Forensic Imaging
• RAW: This is simply a bit-to-bit copy of the hard drive without
leaving or adding any single bit. This image format is usually
accompanied by a separate file containing meta-information about the
image file.
• AFF: This is the Advanced Forensics Format, and it is used to store
disk images and forensics images' metadata. This is not a proprietary
but open format, which can be used with any tool for analysis and
won't exclusively work with a single tool.

Disk and File System Analysis 14

Forensic Imaging
• E01: This is the EnCase evidence file. It contains information related
to the acquisition process, such as the investigator’s name, the
timestamp, and the typed notes during the acquisition. It calculates the
checksum for every 32 KB of data, and at the end of the image file, it
adds the MD5 hash for the whole bitstream
• List the Tools for Imaging?

Disk and File System Analysis 15

Data Analysis Methodology
• “Find out the Data” “Organize all the pieces” “Integrate Them”
“Here the Data Analysis is Performed” ……
• Preparation Steps
• Imaging (Forensic Duplicate) (May be more than one)
• Recovery of deleted files + Unallocated spaces
• Generating a list of all the files (Most modern-day tools perform it by default )
• Generating the list of Search Strings ( + AI image text )
• Start Investigating the systems

Disk and File System Analysis 16

Data Analysis Methodology
• Investigating Windows System
• Review all pertinent logs
• Perform keyword searches
• Review relevant files
• Identify unauthorized user accounts or groups
• Identify rouge processes and services
• Look for unusual or hidden files/directories
• Check for illegal entry points
• Inspect jobs run by the Scheduler service
• Analyze trust relationships
• Review security identifiers
Disk and File System Analysis 17
Investigating Applications
• Open Source
• Autopsy
• Hex Editor
• Volatility
• Active@Disk Image
• Tool for each system file (prefetch, registry, lnk,…)

• Proprietary
• Magnet Axiom
Disk and File System Analysis 18
• Cellebrite UFED
Malware Handling
• “Malicious” + “Software” = Malware
• Broken software, which does not have malicious intent, called BADWARE
• Behavior of Malware
• Creating a security breach
• Making device control independent from the user,
• Activating device features independent of use with malicious remote access
tools
• Transferring personal data to other areas by abusing consent and intentions,
• To adversely affect other networks and devices with unnecessary commands,
• To defraud device users.

Disk and File System Analysis 19

Malware Handling

Figure : Mapping types of Malware to its behavior [3]

Introduction to Digital Forensics 20
Malware Handling
• Importance of isolated Environment
• Malware Detection Using
• Static Analysis
• Dynamic Analysis
• Hybrid Analysis
• Signature-based VS Machine Learning/Deep Learning Based
• Evasion Techniques (obfuscation, encryption, updates, downloading)

Disk and File System Analysis 21

References
1. Nilakshi Jain, Dhananjay Kalbande, “Digital Forensic: The fascinating
world of Digital Evidences”, Wiley, 2016.
2. Akashdeep Bhardwaj, Keshav Kaushik, “ Practical Digital
Forensics”, BPB publications, 2023
3. Or-Meir, O., Nissim, N., Elovici, Y., & Rokach, L. (2019). Dynamic
malware analysis in the modern era—A state of the art survey. ACM
Computing Surveys (CSUR), 52(5), 1-48.
4. Bill Nelson; Amelia Phillips; Christopher Steuart, “Guide to
Computer Forensics and Investigations, Instructor's Online
Companion Site”
Disk and File System Analysis 22