Filesystem Structure and Metadata

Using the mmls command analyse /images/diskimg1.dd. Extract the sector offset information for the three partitions shown.

The fsstat command displays file system information. Data of particular interest in the output of this command vary depending on the file system being examined but may include volume names, data unit sizes, and statistical information about the state of the file system.

From the terminal use fsstat command to analyse the first partition of diskimg1.dd. Use the offset information shown above, i.e.

$ fsstat -o 63 /images/diskimg1.dd

What are the three main types of information stored in the VBR? List them in the order they appear in the fsstat command.
1. Content Information Declustering Information Filesystem Information Metacontent Information Metadata Information Sector Deallocation Information System Restore Information Volume Information
2. Content Information Declustering Information Filesystem Information Metacontent Information Metadata Information Sector Deallocation Information System Restore Information Volume Information
3. Content Information Declustering Information Filesystem Information Metacontent Information Metadata Information Sector Deallocation Information System Restore Information Volume Information

What is the file system type label of the first partition? Match is CASE SENSITIVE!

What is the start and end sectors of the FAT tables FAT 0 and FAT 1. Remember to make these relative to the start of the disk, not the start of the partition.

Where does, in disk sectors, the root directory lie?
Start:
End:

What is the cluster size in bytes?
Start:

What is the size in clusters of the first file in the FAT table.
Start:

In this question we will look at the files and their associated metadata. This will use the fls, icat, and istat commands. The fls list files and directory information from an image, along with inode information. The icat command reads the contents of a file, and the istat command allows access to the file metadata.

Using fls on partition 1 of diskimg1.dd, identify the inode number for the file 'Tomas.jpg'.
Inode:

Use the istat command to examine the inode for Tomas.jpg. Identify and calculate the following information:
File Size:
Created: Format as an ISO date with timezone, e.g. 2000-05-20 15:57:45 (GMT).
File Data First Sector:
Last Sector ALLOCATED:

Remember that there are four sectors to a cluster, so unneeded sectors left in a partially used cluster are still counted when calculating the last sector allocated.

What is the first two bytes of the file Tomas.jpg? Write in lower case using the format 0xffff.
Signature:

What is the last two bytes of the file Tomas.jpg? Write in lower case using the format 0xffff.
Tail Signature:

What does it mean? (Hint - Google it!)
Signature of an html file Signature of a gif file Signature of a jpg file Executable file Internal metadata of the windows registry It is part of the recycle bin Part of a partition table cluster

How many bytes of slackspace does this file have?
Bytes of slackspace:

Examine the slackspace of the file Tomas.jpg. Find a hidden message and complete the sentence below:
Sentence: This is a in slackspace

Most of the forensic tools are able to read and present metadata information regarding files and directories. In case of file system corruption or just data verification it is essential that you can manually verify metadata information stored in the file system.

For the purpose of this exercise you will be opening a record in the Root Directory of the FAT filesystem in partition 1, and then verifying the metadata for the associated file.

To complete the task you need to recall the FAT directory structure, shown below.

The File Attributes are an OR of the following information:

If the first byte of a FAT entry is 0xe5 then this indicates that the entry has been deleted.

Recall from earlier the location, in disk sectors, where the root directory lies?
Start:
End:

Using dd and xxd, scan the first root directory sector and discover the offset for the file SECRETS.TXT. Format it in three digit hex, e.g. 0x000.
Offset:

The creation time, held in the FAT record for SECRETS.TXT starts at offset 13. The first byte is the ms part of the time, so for simplicity focus on the two bytes starting at offset 14 (which relates to hours, minutes, and seconds). For example, if the 2 native bytes at offset 14 were : 0x9140
Big endian is 0x4091.
In Binary this is 0100000010010001.
Bits 0-4 are seconds/2: 10001 = 17, then *2 is 34 seconds.
Bits 5-10 are Minutes: 000100 = 4 minutes.
Bits 11-15 are Hours: 01000 = 8 hours.
So the creation time is 08:04:34

What is the hex native endian creation time (at offset 14) of SECRETS.TXT? Format as 0x0000.
Native endian:

What is the hex big endian creation time of SECRETS.TXT? Format as 0x0000.
Big endian:

What is the binary big endian creation time of SECRETS.TXT? Format as 10000000000 with no leading zeros.
Big endian binary:

What is the creation time in hr:mn:sc?
Creation Time:

Dates are similar in procedure to convert, except that: Day is bits 0-4
Month is bits 5-8
Year is bits 9-15 + 1980

What is the creation day of SECRETS.TXT in the format 1 JAN 2012.
Creation Date: January February March April May June July August September October November December

What is the last access date of SECRETS.TXT in the format 1 JAN 2012.
Accessed Date: January February March April May June July August September October November December

In decimal, what is the starting cluster shown in this fat entry?

Just for information... this cluster number, if you wish to convert it into a partition sector number, is first added to the Total Cluster Range low boundary as reported by fsstat. It is then multiplied by the blocks per cluster (e.g. 4), then the Cluster Area low boundary is added.

What is the file size in bytes?

Verify your findings using fls to locate the inode number of SECRETS.TXT, then using istat to access the inode information. Prove you have done this by entering the inode number and the Written time (in the format "00:00:00").
Inode number:
Written time: