File Systems, Boot Sequence, and Disk Drives

File Systems

• A file system is used by an operating system as a roadmap to find data on a disk
• The type of file system determines how data is stored
• File systems are typically tied to an operating system
• Platform familiarity is essential when acquiring data

Boot Sequence

• Complementary Metal Oxide Semiconductor (CMOS) stores system, date, and time info, even when powered off
• Basic Input/Output System (BIOS) contains programs for hardware-level input and output
• The Bootstrap process in ROM guides the computer's startup
• A key or key combination opens the CMOS setup screen
• Modifying CMOS boot settings is necessary to boot from forensic media like a floppy disk or CD

Disk Drives

• Disk drives are constructed from coated platters with magnetic material
• Geometry refers to the layout of platters, tracks, and sectors on a disk
• The Head reads and writes data to a drive, with one head per platter surface
• Tracks are concentric circles on a disk platter where data resides
• Cylinders are columns of tracks across multiple platters, spanning top and bottom surfaces
• Sectors are sections on a track, commonly sized at 512 bytes
• Drives handle properties at firmware or hardware level
• Zoned bit recording (ZBR) involves varying sector sizes
• Track density refers to space between tracks
• Areal density measures bits per square inch on platter
• Head and cylinder skew are properties

Solid-State Drives

• Wear-leveling is included in flash memory devices to ensure even wear of read/writes across all memory cells
• A full forensic copy should be made of solid-state devices to recover unallocated disk space data

Microsoft File Structures

• In Microsoft file systems, sectors are grouped ito clusters
• Clusters are allocation units that are one or more sectors in size
• Clusters typically contain 512, 1024, 2048, or 4096 bytes
• Combining sectors into clusters minimizes overhead when reading or writing to a disk
• Clusters start from 0 in NTFS and 2 in FAT
• The first sector of all disks has a system area, boot record, and file structure database
• OS assigns logical addresses also known as cluster numbers
• Sector numbers are physical addresses
• Clusters and addresses are assigned to logical disk drives, also known as partitions

Disk Partitions

• A partition is a logical drive
• FAT16 does not recognize disks larger than 2MB. Larger disks have to be partitioned
• Windows operating systems can have three primary partitions and an extended partition which holds several logical drives
• Hidden partitions constitute voids or gaps between actual partitions
• Partition gaps can be found in the unused space between partitions
• Disk editor utilities can alter partition tables typically to hide them
• Disk editors like Norton DiskEdit, WinHex, or Hex Workshop can examine a partition's physical level
• Key hexadecimal codes are analyzed by the OS to maintain and identify file systems
• Hex Workshop can recognize file headers to define file types
• Boot disks include a Master Boot Record (MBR)
• The MBR is located at sector 0 of the disk drive
• In hex editors like WinHex, an initial partition can be found at offset 0x1BE
• The hexadecimal filesystem code is 3 bytes from 0x1BE
• Partition info in the MBR contains locations, sizes, and important data
• Software like PartitionMagic can modify the MBR

FAT Disks

• The File Allocation Table (FAT) represents file structure database first used in floppy disks
• The FAT was deprecated after Windows NT and 2000
• The FAT database includes filenames, directory names, timestamps, the starting cluster number, and file attributes
• The FAT database is written on a disk's outermost track
• FAT versions include FAT12, FAT16, FAT32, VFAT and exFAT (mobile personal storage devices)
• Cluster sizes can vary according to hard disk size and file system, resulting in drive slack
• Drive slack includes RAM and file slack
• One of the unintentional side effects of FAT16 was the reduced fragmentation due to its large clusters
• As cluster size increased, this reduced fragmentation
• As available space is used up the OS assigns new allocated clusters adding more slack
• A chain can be broken or fragmented, as files grow and require more disk space
• The OS assigns a starting cluster position when storing data in a FAT file system
• Data is written to the first sector of the first cluster that is assigned
• When this first assigned cluster is full the next available cluster will be assigned
• Files may become fragmented if the next cluster isn't contiguous

Deleting FAT Files

• When a file is deleted in a Microsoft OS, its directory entry is marked as such using the HEX E5 (σ) character to replace the original first letter
• The FAT chain for the file is set to 0
• Data in the file remains on the hard drive
• The area of disk where the deleted file is located is unallocated
• The disk space becomes usable to write other files

NTFS Disks

• New Technology File System (NTFS) was launched with Windows NT and is the current primary file system
• NTFS allows more control over files, folders, and information about the file compared to FAT
• NTFS is Microsoft's journaling file system which involves recording every transaction
• In NTFS, all information written to a disk is considered as a file
• Partition Boot Sector comes first on an NTFS disk, followed by the Master File Table (MFT)
• NTFS decreases the amount of file slack
• Clusters and smaller on smaller drives
• NTFS uses unicode: international data format
• MFT contains disk file info, and is called metadata
• First 15 records within the MFT are reserved
• Hex Workshop allows viewing of file headers

NTFS Attributes

• In the NTFS MFT files and folders are stored in separate records of 1024 bytes each
• A record contains file or folder data is within record fields (metadata). Record fields are also called Attribute IDs
• File or folder info saves through Resident v Non-resident.
• Files larger than 512 bytes will be stored outside the MFT; cluster addresses store file placement locations
• Files larger than 512 bytes are known as a data run
• Each attribute record is identified by a header as resident vs nonresident
• OS allocates logical clusters to the disk partition after its created and are known as logical cluster number, or LCN
• The MFT links these to the nonresident files on disk partition
• Then data is written to nonresident files + assigns (LCN) address, these become virtual cluster number or VCN
• All MFT records begin their header with 'FILE'
• Size of the MFT record in its header starts at offset 0x1C ending at offset 0x1F
• The length of the header begins at offset 0x14
• At offset 0x32 and 0x33 the final update details of sector 1
• Data can be appended to files, this is called Alternate Data Streams, that can hide essential info
• File association with the same data stream

NTFS Compression & Encryption

• NTFS compression is same as former FAT DriveSpace 3
• Individual files, entire folders, or drives can be compressed with NTFS
• In forensics, compression and analysis of compressed data can also be achieved
• Files encrypted with EFS are decrypted with a public or private key (Windows 2000)
• Windows Vista or later will use a recovery certificate, and is given to local admin account
• Windows Admin can choose Windows or the command line for recovery
• EFS decrypts with a command called 'Efsrecvr'

Deleting & Resilience

• A file deleted on Windows XP or NT, its renamed and moves to recycle bin
• Windows command line tool named 'Del' removes files
• Resilient File System (ReFS) address extensive data storage
• Has maximized data accessibility, enhanced data integrity, and scalability in design
• ReFS has a metadata table like NTFS

Understanding Encryption

• Encryption was developed in response to concern over loss of personal info
• Software that encrypts the whole partition is a full disk encryption (FDE)
• Current WDE or whole disk encryption features: login screen before it goes into to Windows
• Complete V differential drive encryption and safe hibernation
• Complex calculations for AES, advanced encryption standard, or IDEA are also included
• TPM or Trusted Platform Module is included; it is a chip so keys and authentication can be safely protected

Examining MS BitLocker & other Encryption

• Only Vista Ultimate and Enterprise have BitLocker
• TPM microchip (version 1.2 or later) is needed along with compatible BIOS
• Two NTFS were also needed to run Bitlocker
• Bitlocker configuration is dependent on running the hardrive first
• Individual sector of the hardrive is encrypted
• Many encrypt the device's boot sector; stopping boot bypass
• Use provided CD to prompt/recover for one-time passphrase, in order to decrypt

The Windows Registry

• A database that stores hardware and software configuration info and user settings
• Can contain valuable evidence for investigative purposes
• Use Registry Editor program, 'Regedit.exe' for Windows 9x based systems to view registry
• ‘Regedt32.exe’ registry viewer is used for XP, or Windows 2000.
• Both utilities can be used with Windows 7 and 8.
• Viewing and editing tool to show registry to the user
• The registry breaks windows into category with HKEY prefixes
• “H” is for handle of a key
• Each folder and key within registry is the values and more
• Branch is also shown

Locating Registry files

• Specific branch examples in each HKEY
• Hives is specific branch examples local versus hardware
• Each key has the value for the name or file description
• ProDiscover to extract System.dat from image file is used
• AccessDatato review these files and find what info is available
• OSForensics or X-Ways are additional registry viewer