Free Jibjab Look Alike

The Sleuthkit - mini driving fast

often times when you forget all the potential and tools
Sleuthkit
, so I decided to write a quick little guide to illustrate typical uses of ready-to-wear for this very useful suite of tools for computer forensics, developed by Brian Carrier.

start from the disc / image

mmls / dev / sdaX or mmls disk.dd

used to display the partitions on a device or an image file, providing output in the starting sector, very useful for determining the offset of partition start.

'Mmls' as in 'fdisk-lu' in Linux with some differences. Namely, that shows the areas that have not been used so that these can be used to search for hidden data. It also provides the value of the length of the partitions so that it can be used with 'dd' to extract more easily.

fsstat file_system-f-o offset disk.dd

is to provide important data on the file system on the device or image file analysis of the device, including a particularly interesting, namely the block / cluster size.

ifind file_system-o-f-d offset numero_del_cluster disk.dd

is to provide the i-node belongs to that particular cluster. The number of clusters is derived from offset in decimal bytes, we are seeing,

divided by the size of the cluster / block determined by fsstat. If we find, for example, a string starting at offset decimal 101,345 in a DD image file, to get the i-node will perform 101345/dim_cluster.


ffind file_system-o f-the-node offset disk.dd

is to provide the name of the file corresponding to the i-node.

istat-f-o file system i-node offset disk.dd

used to provide metadata about the file corrsipondente to that i-node.

fls-d-f-r-p-o offset file_system disk.dd

used to display deleted files recursively in all subfolders and with the full path (-p).

fls-a-l-p-r-f-o offset file_system disk.dd
list all the files are not deleted.

file_system icat-f-r-o offset disk.dd i-node> filename.ext

Used to export the contents of the file for the i-node to file (filename.ext).

sigfind-t file_system disk.dd

Need to look for "signatures" that identify the various file systems, t-list to display various file systems supported.

Other valuable information are:
http://wiki.sleuthkit.org/index.php?title=FS_Analysis


sleuthkit The Manual:

http://wiki.sleuthkit.org/index. php? title = TSK_Tool_Overview


Example of how to pull a string to an unallocated space


usually to search for strings by sending the pipe of commands:




strings-td disk.dd grep-i "abcd" ("-t d" generates the offset in decimal)
that is faster than the command:

grep-iaob "abcd" ; disk.dd


-i ignore upper / lower case;
-
is a binary file as if it were text; -b Print the byte offset
; -o
Show only the party line that coincides with the search string;

$ mmls disk.dd
DOS Partition Table Offset Sector: 0
Units are in 512-byte sectors
     Slot        Start                     End                   Length             Description 00:  Meta    0000000000   0000000000   0000000001   Primary Tabl 01:  -----     0000000000    0000000062   0000000063   Unallocated 02:  00:00   00000000
63 0174000014 0173999952 NTFS (0x07)
If we want to search for strings in unallocated space of disk.dd and considering that the starting sector of the partition is 63 and that the file system is NTFS, then:
1) We extract the unallocated space from disk
blkls-f ntfs-o 63 disk.dd> disk.blkls

2) We extract the strings and we take just those that "abcdefg", from the unallocated space only extracted from blkls (disk.blkls) strings-td disk.blkls

such a result would be: 10389739
: abcdefg

where 10389739 is the offset in bytes

3) We find the cluster size set in the file system:

fsstat-f ntfs-o 63 disk.dd
\u0026lt;...> CONTENT INFORMATION ----------------------------------

Sector Size : 512

Cluster Size: 1024
Total Cluster Range: 0 to 21749992
Sector Total Range: 0 to 173999950

4) Divide 10389739 by 1024 and get the number 10146 which is the cluster that contains the string "abcdefg" ;, but the file disk.blkls and not in the image file, so we must convert the address of the cluster disk.blkls image file into a real address of the original image file, ie disk.dd

5)
blkcalc-f ntfs-o 63-u 10146 disk.dd we get 59,382 which is the real address of the cluster that contains the search string.
6) We can see the cluster using the command: blkcat-f ntfs-o 63 disk.dd 59382
8) found metadata information relating to the i-node 493:

istat-f ntfs-o 63 493 disk.dd \u0026lt;...>
$ FILE_NAME Attribute Values:
Flags: Archive
Name: pippo.jpg
Parent MFT Entry: 458 Sequence: 122
Allocated Size: 0 Actual Size: 0
Created: Tue March 18 15:05:19 2008
File Modified: Tue March 18 15:05:19 2008

MFT Modified: Mon March 18 15:05:19 2008
Accessed: Tue March 18 15:05:19 2008

9) Let's see if there is still a file associated with the i-node:

ffind-f ntfs-o 63-to 493 disk.dd
/ Document and Settings / spectra / Documents / pippo.jpg we found a file called pippo.jpg.

10), taking the file pippo.jpg
icat-f ntfs-o 63-r 493 disk.dd> pippo.jpg
Consider that the starting sector of the partition is 63, which is disk.dd NTFS by icat command export the contents of relying on its number of i-node.
I hope that this small handy booklet will be useful to all those who, like me, begin to have the disk HAD biological increasingly full


Nanni Bassetti