File Systems 2
browser cache
"files" or "pages" saved on HD so that web content doesnt need to be downloaded if its unchanged
LBA
(Logical Block Address) Disk access using sector number. - Sectors are considered numbered, starting at 0.
MBR
(Master Boot Record) First sector on hard disk, zip disk, flash drive contains MBR. - 446 bytes: Boot code - 64 bytes: Partition Table - Four 16 byte entries (three may be empty) - 2 bytes: 0x55 0xAA (footer)
Attributes
(NTFS) used to record information (file system metadata) about files and directories within MFT record -have an attribute type identifier (four byte unsigned integer) -occur after standard header of file entry -are in order by attribute type identifier - vary in length (but length is always (?) a multiple of 8) -same attribute may occur more then once in file entry -end of attributes is signed by 0xFFFF FFFF in file entry -all parts of an attribute may not be required (space may be allocated but not used)
FAT file deletion
-First byte of directory entry (or entries) set to 0xE5. -FAT cluster entries for the file set to 000 or 0000 or 0000 0000
registry files
-SAM -SECURITY -SOFTWARE -SYSTEM -NTUSER.DAT
Unsigned Integer
0, 1, 2, 3, 4, .... 0x00, 0x01, 0x02, ...0x0A, 0x0B... -if bits represent and unsigned integer all bits are used to form a binary number (or most equivalently a hexadecimal number)
FAT12
12 bits (1 1/2 bytes) per cluster
FAT16
16 bits (2 bytes) per cluster
FAT32
32 bits (4 bytes) per cluster -only 28 bits (3 1/2 bytes) are significant
ADS
Alternate Data Stream -NTFS permits a file to have more than $DATA (0x80) atrribute, if the $DATA attribute is named, it is an alternate data stream -keeps file of data for carrier file -$Bad in $BadClus is an ADS -ADS is mostly hidden from the system -Forensics implication: ADS is a way to hide data (files)
DVn.ext
D - deleted V - drive (volume) letter n - number (0, 1, ...) ext - original extension
EFI
Extensible Firmware Interface (officially UEFI (Unified Extensible Fireware Interface)) -Intel ("Tiano") developed, since standardized fireware-op system interface. Includes boot services and partition specifications.
FSINFO
FAT32 only -sectors contaning "hints" about file system -sector number (within partition) of FSINFO in VBR at bytes 0x30-0x31 (typically is 1 - immediately after VBR) -number of free clusters 0x1E8-0x1EB -next free cluster 0x1EA-0x1EF
FAT
File Allocation Table -A table with an entry for each cluster on a disk. Cluster's entry can be: --000 0000 00000000 (cluster not in use. Free) --xxx xxxx xxxxxxxx (cluster in use to store a file or directory and xxx... is the next cluster used for the file or directory) --FFF FFFF 0FFFFFFF (cluster is in use to store a file and it is the last cluster for the file. EOF (end of file))
FAT file system
File system which uses a FAT to keep track of clusters' allocation.
GPT
GUID (globally unique identifer) Partition Table. -Replaces the partition table of the MBR when EFI is utilized --MBR is present at sector 0 --Partition code of 0xEE in MBR partition table entry indicates GPT --GPT follows MBR
GUID
Globally Unique IDentifier
Cluster
Group of one or more consecutive sectors considered to be a unit by Microsoft file system (FAT, exFAT, NTFS) -Also called allocation unit
HKEY_CLASS_ROOT
HKCR - application information --file types of extension --open with lists --commands -- alias for HKLM\Software\Classes
HKEY_CURRENT_USER
HKCU -pointer to alias for HKU\SID - SID of current user
HKEY_LOCAL_MACHINE
HKLM -hardware, software, security settings -- frequently important in investigations
HKEY_USERS
HKU -configuration information for users (by SID)
LFN
Long File Name -File descriptor using more than 8 characters for name or 3 characters for extension or characters not legal in MS-DOS file descriptor. Also some descriptors with mixed upper and lower case letters.
$MFT
Master File Table -a file containing information about every file in the NTFS volume -file information in $MFT is in MFT record or file entry -most file entry in $MFT consists of attributes (which follow the header) -one entry for every file and directory -file entries 0-11 for system files and 12-23 are reserved -after standard header, sequence of attributes -first four bytes of attribute are attribute type identifier -MFT records are kept consistent by using an update sequence
NTFS
New Technology File System -Number of cluster = 0-2^64-1 (theoretical) -0-2^32-1 (implemented in XP) -Cluster size (maximum 128 sectors/cluster) -64KB with 512 byte sectors -maximum file size ~ 2^64-1 bytes (theoretical) - ~ 2^44-1 bytes (implemented) -maximum number of files = 2^32-1 -file name up to 255 unicode characters
FATs
Number of the first cluster used to store a file or directory is in the directory entry for the file. -The entry in the FAT for a cluster used to store a file contains either the number of next cluster or an end of file marker.
Numerical Prefixes
Numerical prefixes are used to express large quantities, especially storage capacity. Kilo K Thousands Mega M Millions Giga G Brillions Tera T Trillions Peta P Quadrillion Exa E Quintillion
SID
Security IDentifier -MS Windows unique, unchangeable identifier for "security principle"
VFAT
Virtual File Allocation Table -Adaptation of Windows to use LFN (with FATs)
Data run
a continuous group of clusters used for attribute contents -number of clusters in the data run followed by number of first cluster
Links
additional references to files, alternate access to files
0x80 $data
alternate data stream (ADS) -second (or third or...) 0x80 $data atrribute which is named. must (?) be "attached" to existing file, essentially a file attached to a file
0x10 $standard_information
always resident -flag at 0x08 of attribute header is always 00 -four dates/times file creation (born) file alteration (modification,write) file entry alteration (modification,change) file read (accessed)
mount
attach a storage device to a system so the data on the device is accessible -attach a volume within a file system so that the volume is incorporated into the file system (usually as a directory)
Resident Attribute
attribute entirely within MFT entry (many attributes are resident) - attributes consisting of a header and contents (or data)
Non-resident Attribute
attribute partially (maybe mostly) outside $MFT -data attribute is frequently non-resident -attribute consisting of a header and location (clusters) of the attributes contents (or data) -flag at 0x08 is 01
$MFTMirr
backup copy of first four file entries in $MFT
Little Endian
bytes are stored with least significant byte first. Effectively, this means reverse order. -intel architecture uses little endian
shell bags
collection of keys recording each folders display setting for a user
tree
collection of nodes conneced by directed edges with no cycles
Sysinternals Suite
collection of tools (software) for obtaining information (some live) about a computer
$Upcase
contains entries for all unicode characters to define a collating sequence for file names
$Volume
contains information about the volume itself (the volume name) -file size is 0 -may be contained completely within $MFT (all attributes may be resident)
symbolic link
creates 0xC0 $reparse_point attribute
short cut
creates new file with link information in 0x80 $data attribute
registry data
data (value) in registry is in three parts: -Name -Type -Value
b-tree
data structured which can be efficiently searched -NTFS directory's file (and subdirectories) are in b-tree
registry
database of settings and information for a system. Maintained in several files and memory - intended to replace initialization and configuration files
decremented
decreased by 1
$Extend
directory for containing additional files for NTFS (extending NTFS)
recycle bin
extend across volumes
exFAT
extended FAT (extended File Allocation Table) -larger files and more files then FAT32 -max volume size(theoretical) 2^57 -primary VBR sectors 0-11 -backup VBR sectors 12-23 -for larger flash drives and SSD's -older versions of D.F tools may not recognize exFAT -allocation status of clusters is recorded in $BITMAP
INFO2
file (like a DB) in RECYCLED or RECYCLER\User_SID containing information about deleted files
Sparse File
file with a large number of consecutive null bytes (an entire cluster or clusters of null bytes)
$BOOT
first sector and cluster number 0 in NTFS -contains data about file system -contains important file system parameters (file system ID, bytes per sector, sectors per cluster, size of MFT file record(usually 2 sectors/1024 bytes), etc.) -footer (signature) 55 AA
0x30 $file_name
for "standard" file, resident attribute -may occur more than once (SFN, hard links) -MFT entry number of parent or containing directory -use 0x10 $standard_information for dates/times flags -use file size in 0x80 $data -file name in unicode (two bytes per character)
0xA0 $index_allocation
for nodes of b-tree (nonroot nodes, called index nodes)
0x90 $index_root
for root of b-tree -$I30 (name for a directory index) -32 bytes: index parameters (clusters per index node) -file (or index) entries: at least one (which may be null)
$LogFile
forensic value: may contain file fragments
$Secure
holds security descriptors
Signed Integer
if bits are represented an (arbitrary) integer (0, +-1, +-2,...) the leading bit gives the sign of the number and the other bits are used to give the absolute value (size) of the number. -the leading bit's value indicates positive (0) or negative (1) integer. -if a byte (8 bits) is expressed in hexadecimal, the leading bit is 1 only if the high digit is 8, 9, A, B, C, D, E, or F (which means the signed integer is negative)
incremented
increased by 1
nonroot node
index node -in clusters designated (by data runs) in 0xA0 $index_allocation -starts with "INDX" (ASCII) -four bytes INDX at offset 00 -four bytes at offset 0x18 is offset from 0x18 to first entry - after index header, file (index) entries
$Ixxxx.ext
information about recycled file
Hard Link
link to file contents -direct reference to file contents -creates a 0x30 $file_name attribute
jump list
lists of recent items, organized by program. May include pinned items
plug-in
module which can be added to larger program to give additional functionality
MRU
most recently used order
MFT Entry
mostly (perhaps all) file metadata
KEYS
node below hives in registry - contain last write time - contain VALUES
root node
node which has no parent
leaf
node without children
dates and times
recorded elsewhere in MFT -$std_info's are used by system -UTC is converted to time zone (including daylight savings or other local bias) when shown to user
$Rxxxx.ext
recycled file, renames
RegRipper
registry file analyzer
thumbnail
small graphic for a graphics file or icon for nongraphics file
cookie
small text file with information from web site visit
Soft Link
symbolic link -link made to file metadata -indirect reference to file contents
HIVES
top level node of registry -names begin with HKEY
$BadClus
tracks bad clusters
$BITMAP
tracks use of clusters -1 (set) cluster is in use -0 (clear) cluster is not in use
subtree
tree starting at a given node
0xC0 $reparse_point
used to mount volumes and also for symbolic links
0x20 $attribute_list
used when attributes wont fit in file entry (file record of MFT -list entry: attribute type number length of entry MFT entry number for attribute attribute ID attribute name (if named)
Two's compliment
using this, the leading bit indicates positive (if 0) or negative (if 1)