Explore BrainMass
Share

Explore BrainMass

    Unix and Sleuth

    This content was COPIED from BrainMass.com - View the original, and get the already-completed solution here!

    This project needs to be done on a UNIX machine using the Sleuth forensic tools. If you are using your own machine, you need to install the Sleuth Kit forensic tools (http://www.sleuthkit.org) on your machine.

    This week, you need to use the Sleuth tools to carry out the following tasks on the FAT undelete image from http://dftt.sourceforge.net/test6/index.html (there is a zip link on the site that you can get the image from : http://sourceforge.net/projects/dftt/files/Test%20Images/6_%20FAT%20File%20Recovery%20%231/6-undel-fat.zip/download?use_mirror=jaist&download=

    1. using the command fls to see the existing files and recently deleted files/folders in the image file: 6-fat-undel.dd (provide screenshot and explanation)

    2. practice the following commands on the same image file: fsstat, icat, ifind, ils, istat, dcat, dls, dstat, dcalc (provide screenshot and explanation)

    To download the image:
    http://sourceforge.net/projects/dftt/files/Test%20Images/6_%20FAT%20File%20Recovery%20%231/6-undel-fat.zip/download?use_mirror=jaist&download=

    © BrainMass Inc. brainmass.com October 10, 2019, 6:21 am ad1c9bdddf
    https://brainmass.com/computer-science/data-clustering/unix-and-sleuth-540989

    Solution Preview

    In old system dls, dcalc etc; in new system: blkls, blkcalc etc.

    11 tools:
    Data Unit Layer: dls, dcat, dstat, dcalc
    Meta Data Layer: ils, icat, istat, ifind
    File Name Layer: fls, ffind
    File System Layer: fsstat
    //
    FIRST_LETTER LAYER
    d Data Unit - file and directory content stored.
    i Meta Data - descriptive data about files and directories stored.
    f File Name - actual name of the file or directory saved.
    fs File System - all other file system specific data stored.
    //
    Functions of tools:
    ENDING FUNCTION
    ls Lists information in layer
    cat Displays content in layer
    stat Displays details about a given object in layer
    find Maps other layers to its layer
    calc Calculates "something" in the layer
    /////////////////////
    Commands execution outputs:
    ////////
    1. fls: List file and directory names in a disk image.
    ///////
    Display undeleted files: (option -u):

    #localhost 6-undel-fat]$ fls -u 6-fat-undel.dd
    r/r 3: FAT_REC_1 (Volume Label Entry)
    v/v 191619: $MBR
    v/v 191620: $FAT1
    v/v 191621: $FAT2
    d/d 191622: $OrphanFiles
    //////
    Display deleted files: (option -d):

    #localhost 6-undel-fat]$ fls -d 6-fat-undel.dd
    r/r * 4: _rag1.dat
    r/r * 5: _rag2.dat
    r/r * 6: _ing.dat
    r/r * 7: _ult1.dat
    d/d * 8: _ir1
    d/d * 11: System Volume Information
    ///////
    Display all entries: option -a:

    #localhost 6-undel-fat]$ fls -a 6-fat-undel.dd
    r/r 3: FAT_REC_1 (Volume Label Entry)
    r/r * 4: _rag1.dat
    r/r * 5: _rag2.dat
    r/r * 6: _ing.dat
    r/r * 7: _ult1.dat
    d/d * 8: _ir1
    d/d * 11: System Volume Information
    v/v 191619: $MBR
    v/v 191620: $FAT1
    v/v 191621: $FAT2
    d/d 191622: $OrphanFiles
    //////////////////////////////
    fsstat: Display general details of a file system.
    //////

    #localhost 6-undel-fat]$ fsstat 6-fat-undel.dd
    FILE SYSTEM INFORMATION
    --------------------------------------------
    File System Type: FAT16

    OEM Name: MSDOS5.0
    Volume ID: 0xc0fecd11
    Volume Label (Boot Sector): NO NAME
    Volume Label (Root Directory): FAT_REC_1
    File System Type Label: FAT16

    Sectors before file system: 63

    File System Layout (in sectors)
    Total Range: 0 - 12032
    Total Range in Image: 0 - 12031
    * Reserved: 0 - 7
    ** Boot Sector: 0
    * FAT 0: 8 - 31
    * FAT 1: 32 - 55
    * Data Area: 56 - 12032
    ** Root Directory: 56 - 87
    ** Cluster Area: 88 - 12031
    ** Non-clustered: 12032 - 12032

    METADATA INFORMATION
    --------------------------------------------
    Range: 2 - 191622
    Root Directory: 2

    CONTENT INFORMATION
    --------------------------------------------
    Sector Size: 512
    Cluster Size: 1024
    Total Cluster Range: 2 - 5973

    FAT CONTENTS (in sectors)
    --------------------------------------------
    ///////////////////////
    ils: List inode information.
    ////
    Display every inode: option -e:

    #localhost 6-undel-fat]$ ils -e ...

    Solution Summary

    Some of the Unix commands of Sleuth Kit are executed. Command line executions commands as well as their outputs are presented here.

    $2.19