File System Forensics - Fergus Toolan

. .

Résumé :

Preface xvii?

Acknowledgements xxi?

Part I Preliminaries 1?

1 Introduction 3?

1.1 What is Digital Forensics? 4?

1.2 File System Forensics 5?

1.3 Digital Forensic Principles 5?

1.4 Digital Forensic Methodology 7?

1.4.1 Preparation 8?

1.4.2 Localisation/Preservation 8?

1.4.3 Acquisition 8?

1.4.4 Processing 9?

1.4.5 Analysis 9?

1.4.6 Reporting 9?

1.4.7 Quality Assurance 10?

1.4.8 Evidence Return 10?

1.5 About This Book 10?

1.5.1 Who Should Read This Book? 11?

1.6 Book Structure 12?

1.7 Summary 13?

Exercises 13?

Bibliography 14?

2 Linux as a Forensic Platform 17?

2.1 Open-Source Software 17?

2.1.1 Advantages of Open-Source Software 19?

2.1.2 Open Source ? Free 20?

2.2 Open-Source Software in Digital Forensics 20?

2.3 What is Linux? 21?

2.3.1 The Anatomy of the Linux OS 22?

2.3.2 Linux Distributions 27?

2.3.3 A (very) Brief History of Linux 28?

2.4 Using Linux 29?

2.4.1 User Accounts 30?

2.4.2 Basic Linux Commands 32?

2.4.2.1 Navigating the File System 32?

2.4.2.2 Getting Help 34?

2.4.2.3 Viewing/Editing Text Files 34?

2.4.2.4 Managing Directories 35?

2.4.2.5 Redirection and Pipes 35?

2.5 Linux as a Forensic Platform 36?

2.5.1 Commands for Digital Forensics 36?

2.5.1.1 Hashing 36?

2.5.1.2 Hex Viewers 38?

2.5.1.3 Archiving/Compression 39?

2.5.1.4 The file Command 40?

2.5.1.5 The strings Command 40?

2.5.1.6 Text Searching with (e)grep 41?

2.6 Summary 42?

Exercises/Discussion Topics 42?

Bibliography 43?

3 Mathematical Preliminaries 45?

3.1 Bits and Bytes 45?

3.2 Number Systems 48?

3.2.1 Notational Conventions 48?

3.2.2 Decimal 48?

3.2.3 Binary 49?

3.2.4 Hexadecimal 50?

3.2.5 Number Conversions 51?

3.2.6 Number Conversion with Bash 51?

3.2.7 Negative Numbers 53?

3.2.8 Floating-Point Numbers 53?

3.3 Representing Text 56?

3.3.1 Ascii 56?

3.3.2 Iso- 8859 57?

3.3.3 Unicode 59?

3.3.4 Utf- 8 60?

3.3.5 Utf- 16 61?

3.4 Representing Time 62?

3.4.1 Unix Time 63?

3.4.2 The Linux date Command 64?

3.5 Endianness and Raw Data 64?

3.6 Summary 66?

Exercises 67?

Bibliography 68?

4 Disks, Partitions and File Systems 69?

4.1 Disk Storage 70?

4.1.1 Traditional Rotational Hard Drives 71?

4.1.1.1 Optical Media 72?

4.1.2 Flash Drives 73?

4.1.3 Solid-State Drives 73?

4.2 Partitions 74?

4.2.1 Creating Partitions/File Systems on Linux 74?

4.2.1.1 Mounting File Systems on Linux 77?

4.2.2 Master Boot Record 78?

4.2.3 GUID Partition Table 80?

4.3 File Systems 83?

4.3.1 File System Concepts 83?

4.3.2 Comparison of File Systems 86?

4.4 Acquisition of File System Data 88?

4.4.1 Logical vs Physical Acquisition 88?

4.4.2 Acquisition Under Linux 88?

4.4.2.1 The dd Family 89?

4.4.2.2 Expert Witness Format (EWF) 90?

4.4.2.3 guymager 91?

4.5 Analysis of File Systems 92?

4.5.1 The Sleuth Kit 92?

4.5.1.1 Determine the Partition Layout 93?

4.5.1.2 Determine the File System Type 93?

4.5.1.3 List the Files 94?

4.5.1.4 Recover File Metadata 95?

4.5.1.5 Recover File Content 95?

4.5.1.6 Other TSK Commands 95?

4.5.2 Data Carving 96?

4.6 Summary 97?

Exercises 97?

Bibliography 98?

Part II Windows File Systems 99?