File System Forensic Analysis 225
nazarijo writes "The field of investigative forensics has seen a huge surge in interest
lately, with many looking to study it because of shows like CSI or the
increasing coverage of computer-related crimes. Some people see a
career opportunity there, and are moving toward computer forensics, marrying
both law enforcement and investigations with their interest in things digital. Central to this field is the study of data storage and recovery, which requires a deep knowledge of how filesystems work. Brian Carrier's new book File System Forensic Analysis covers this topic
with clarity and an uncommon skill." Read on for the rest of Nazario's review.
File System Forensic Analysis | |
author | Brian Carrier |
pages | 600 |
publisher | Addison Wesley Professional |
rating | 9 |
reviewer | Jose Nazario |
ISBN | 0321268172 |
summary | The standard for digital filesystem forensics |
It's easy to think that computer filesystems are relatively simple things. After all, if 'dir' or 'ls' don't show what you're looking for, maybe an undelete program will work. Or will it? To be a decent, trustworthy expert in forensics (a requirement if you plan to participate in any criminal investigations), you'll have to learn how filesystems really operate, how tools like undelete and lazarus work, and how they can be defeated.
Carrier's book isn't a legal book at all, and it doesn't pretend to offer much insight into the law surrounding forensics. Instead it focuses on technical matters, and is sure to be the gold standard in its field. This is important, because it comes at you expecting you to have some knowledge, even if only informal, of what a filesystem contains. With a basic understanding of data structures, you'll get a wealth of information out of this book, and it will be a good reference long after you've first studied it.
File System Forensic Analysis is divided into three sections. These are arranged in the order that you'll want to study them to maximize the benefit you can hope to achieve, namely an understanding of how to examine filesystems for hidden or previously stored data. The first three chapters cover a fundamental series of topics: Digital Investigation Foundations, Computer Foundations, and an introduction to Hard Disk Data Acquisition. While they start at a basic level (e.g. what hexadecimal is), they quickly progress to more developed topics, such as the types of interfaces (SATA, SCSI, IDE), the relationship of the disk to the computer system as a whole, and how data is stored in a file and filesystem at a basic level. A lot of examples given use Linux, due to the raw, accessible nature of UNIX and UNIX-like systems, and the availability of tools like 'dd' to gather data.
Part 2 covers "Volume Analysis," or the organization of files into a storage system. This introduces the basics of things like partition tables (including how to read one). The next few chapters cover PC-based partitions (DOS and Apple), server-based partitions (BSD, Solaris and GPT partitions), and then multiple disk volumes like RAID and logical volumes. With this introduction, the final chapter of the section covers how to use these filesystem descriptions in practice to look for data during analysis. Filesystem layouts, organization, and things like journals and consistency checks are covered with a clarity and exactness that's refreshing for such a detailed topic.
Having covered the basics of filesystems, Part 3 covers the bulk of the book and material. Several chapters follow that specifically show you how to analyze particular filesystems by using their data structures to direct your reads. A range of filesystems are covered, including FAT, NTFS, EXT2 and EXT3, and the BSD types UFS1 and UFS2. Each filesystem has two chapters, one devoted to concepts and analysis, another entirely about data structures. Dividing each filesystem type like this lets Carrier focus first on the theory of each filesystem and its design, and then the practical use of its design to actually understand how to pull data off of it.
The real strength of File System Forensic Analysis lies in Carrier's direct and clear descriptions of the concepts, the completeness of his coverage, and the detail he provides. For example, a number of clear, well-ordered and simple diagrams are peppered throughout the book, explaining everything from allocation algorithms to NTFS alternative data streams. This use of simple diagrams makes the topics more easily understood, so the book's full value can be appreciated. This is the kind of thing that sets a book apart from its peers and makes it a valuable resource for a long time.
Finally, Carrier brings it all together and shows us how many aspects of filesystems can be examined using his "sleuth kit" tools, freely available and easy to use. Without appearing to hawk this tool at the expense of other valuable resources, you get to see how simple and direct filesystem manipulations can be done using a direct approach. This kind of presentation is what makes File System Forensic Analysis a great foundation.
Overall I'm pleased with File System Forensic Analysis, I think that Carrier has achieved what few technical authors do, namely a clear explanation of highly technical topics which retains a level of detail that makes it valuable for the long term. For anyone looking seriously at electronic forensics, this is a must have. I suspect people who are working on filesystem implementations will also want to study it for its practical information about NTFS. Overall, a great technical resource.
You can purchase File System Forensic Analysis from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
STEP ONE (Score:5, Funny)
Re:CSI (Score:5, Funny)
Or becoming a hacker because I wanted to meet Sandra Bullock. Man, what a time-waster this has turned out to be.
Re:STEP ONE (Score:3, Funny)
Re:The "How To Destroy Your HD" Thread (Score:4, Funny)
Re:The "How To Destroy Your HD" Thread (Score:5, Funny)
Custom built 5.25" bay metal box, front side key locked switch controlling 12v powered spark igniter for magnesium primer charge; remainder of the box filled with thermite. Install in the computer's top bay. You can generally get all the way through at least eight drives that way, but if you have vertical mount drives, you'll want a second kaboom bay in the lowest 5.25 bay. Have a good UPS, and have a metal-bottomed water tank below the computer (camoflage as an overclock device), because that much thermite does NOT stop quickly.
They can pry my PGP key from my computer's cold dead... um, slag. =)
New TV show.. (Score:5, Funny)
Re:That is just great (Score:3, Funny)
You'd better hope nobody does a forensic analysis of YOUR filesystems.
Re:I do this sometimes... (Score:5, Funny)
What the heck is 'extreme porn'?!
People f*****g on snowboards at 120MPH? Some naked chick with massive fake breasts doing skateboard stunts on a halfpipe while guys standing at the top on each side try to bukakke her while she's paused in mid-air?
"It's not XXX rated.... it's XXXTREME rated!"
Re:CSI (Score:3, Funny)
Re:STEP ZERO: (Score:3, Funny)
You keep using that word. I do not think it means what you think it means.
MC (Score:3, Funny)
I found that too... I got Hammer to defend my computer, and any time someone tries to take the drive away for forensic examination Hammer stops them by saying "You can't touch this!"
Re:I do this sometimes... (Score:1, Funny)
> have much of a leg to stand on--a subpoena is a
>subpoena, and you would either have to ignore it, respect it
>but stay silent, or 'fess.
You unwittingly have stumbled across the reason why we don't worry too much about encryption. Dorks can wrap their goods in layers of encryption, but at the end of the day it becomes worth their time to hand over the passphrases. The loudest, most flamboyant who post "I'll n3v3r h4nd 1t 0v3r 2 th3 f3ds!!!" are typically the ones who end up writing it on a tear-soaked interview form.
I love how that works out.
Re:Here is an even better question (Score:3, Funny)
Re:What about encryption? (Score:2, Funny)
First you recover the PGP Disk file, using the sorts of techniques discussed in the book this review covers. Then you apply cryptanalysis, using the sorts of techniques discussed in cryptography and cryptanalysis books.
Re:STEP ZERO: (Score:2, Funny)
Re:I do this sometimes... (Score:3, Funny)