Explore BrainMass

Unix and Sleuth

This project needs to be done on a UNIX machine using the Sleuth forensic tools. If you are using your own machine, you need to install the Sleuth Kit forensic tools (http://www.sleuthkit.org) on your machine.

This week, you need to use the Sleuth tools to carry out the following tasks on the FAT undelete image from http://dftt.sourceforge.net/test6/index.html (there is a zip link on the site that you can get the image from : http://sourceforge.net/projects/dftt/files/Test%20Images/6_%20FAT%20File%20Recovery%20%231/6-undel-fat.zip/download?use_mirror=jaist&download=

1. using the command fls to see the existing files and recently deleted files/folders in the image file: 6-fat-undel.dd (provide screenshot and explanation)

2. practice the following commands on the same image file: fsstat, icat, ifind, ils, istat, dcat, dls, dstat, dcalc (provide screenshot and explanation)

To download the image:

Solution Preview

In old system dls, dcalc etc; in new system: blkls, blkcalc etc.

11 tools:
Data Unit Layer: dls, dcat, dstat, dcalc
Meta Data Layer: ils, icat, istat, ifind
File Name Layer: fls, ffind
File System Layer: fsstat
d Data Unit - file and directory content stored.
i Meta Data - descriptive data about files and directories stored.
f File Name - actual name of the file or directory saved.
fs File System - all other file system specific data stored.
Functions of tools:
ls Lists information in layer
cat Displays content in layer
stat Displays details about a given object in layer
find Maps other layers to its layer
calc Calculates "something" in the layer
Commands execution outputs:
1. fls: List file and directory names in a disk image.
Display undeleted files: (option -u):

#localhost 6-undel-fat]$ fls -u 6-fat-undel.dd
r/r 3: FAT_REC_1 (Volume Label Entry)
v/v 191619: $MBR
v/v 191620: $FAT1
v/v 191621: $FAT2
d/d 191622: $OrphanFiles
Display deleted files: (option -d):

#localhost 6-undel-fat]$ fls -d 6-fat-undel.dd
r/r * 4: _rag1.dat
r/r * 5: _rag2.dat
r/r * 6: _ing.dat
r/r * 7: _ult1.dat
d/d * 8: _ir1
d/d * 11: System Volume Information
Display all entries: option -a:

#localhost 6-undel-fat]$ fls -a 6-fat-undel.dd
r/r 3: FAT_REC_1 (Volume Label Entry)
r/r * 4: _rag1.dat
r/r * 5: _rag2.dat
r/r * 6: _ing.dat
r/r * 7: _ult1.dat
d/d * 8: _ir1
d/d * 11: System Volume Information
v/v 191619: $MBR
v/v 191620: $FAT1
v/v 191621: $FAT2
d/d 191622: $OrphanFiles
fsstat: Display general details of a file system.

#localhost 6-undel-fat]$ fsstat 6-fat-undel.dd
File System Type: FAT16

OEM Name: MSDOS5.0
Volume ID: 0xc0fecd11
Volume Label (Boot Sector): NO NAME
Volume Label (Root Directory): FAT_REC_1
File System Type Label: FAT16

Sectors before file system: 63

File System Layout (in sectors)
Total Range: 0 - 12032
Total Range in Image: 0 - 12031
* Reserved: 0 - 7
** Boot Sector: 0
* FAT 0: 8 - 31
* FAT 1: 32 - 55
* Data Area: 56 - 12032
** Root Directory: 56 - 87
** Cluster Area: 88 - 12031
** Non-clustered: 12032 - 12032

Range: 2 - 191622
Root Directory: 2

Sector Size: 512
Cluster Size: 1024
Total Cluster Range: 2 - 5973

FAT CONTENTS (in sectors)
ils: List inode information.
Display every inode: option -e:

#localhost 6-undel-fat]$ ils -e ...

Solution Summary

Some of the Unix commands of Sleuth Kit are executed. Command line executions commands as well as their outputs are presented here.