Ad
More Related Content
What's hot (20)
Viewers also liked (20)
Ad
Similar to Windows File Systems (20)
Ad
More from primeteacher32 (20)
Recently uploaded (20)
Windows File Systems
- 2. Exploring Microsoft File Structures • In Microsoft file structures, sectors are grouped to form clusters • Storage allocation units of one or more sectors(blocks) • Clusters range from 512 bytes up to 32,000 bytes each • Combining sectors minimizes the overhead of writing or reading files to a disk • Clusters are numbered sequentially starting at 0 in NTFS and 2 in FAT • First sector of all disks contains a system area, the boot record, and a file structure database • OS assigns these cluster numbers, called logical addresses • Sector numbers are called physical addresses • Clusters and their addresses are specific to a logical disk drive, which is a disk partition
- 3. Disk Partitions • A partition is a logical drive • Windows OSs can have three primary partitions followed by an extended partition that can contain one or more logical drives • Question: How many partitions on a Linux drive? • Hidden partitions or voids are known as Partition gap • Unused space between partitions
- 4. Disk Partitions • The partition table is in the Master Boot Record (MBR) • Located at sector 0 of the disk drive • MBR stores information about partitions on a disk and their locations, size, and other important items • In a hexadecimal editor, such as HxD, you can find the first partition at offset 0x1BE • The file system’s hexadecimal code is offset 3 bytes from 0x1BE for the first partition
- 5. Examining FAT Disks • File AllocationTable (FAT) • File structure database that Microsoft originally designed for floppy disks • FAT database is typically written to a disk’s outermost track and contains: • Filenames, directory names, date and time stamps, the starting cluster number, and file attributes • Three current FAT versions • FAT16, FAT32, and exFAT (Xbox systems) • Cluster sizes vary according to the hard disk size and file system
- 6. Examining FAT Disks • Microsoft OSs allocate disk space for files by clusters • Results in drive slack • Unused space in a cluster between the end of an active file and the end of the cluster • Drive slack includes: • RAM slack – Space between end of file and sector • File slack – Space between end of file and end of cluster • An unintentional side effect of FAT16 having large clusters was that it reduced fragmentation • As cluster size increased
- 7. Examining FAT Disks • When you run out of room for an allocated cluster • OS allocates another cluster for your file, which creates more slack space on the disk • As files grow and require more disk space, assigned clusters are chained together • The chain can be broken or fragmented • When the OS stores data in a FAT file system, it assigns a starting cluster position to a file • Data for the file is written to the first sector of the first assigned cluster • When this first assigned cluster is filled and runs out of room • FAT assigns the next available cluster to the file • If the next available cluster isn’t contiguous to the current cluster • File becomes fragmented
- 8. Deleting FAT Files • In Microsoft OSs, when a file is deleted • Directory entry is marked as a deleted file • With the HEX E5 character replacing the first letter of the filename • FAT chain for that file is set to 0 • Data in the file remains on the disk drive • Area of the disk where the deleted file resides becomes unallocated disk space • Available to receive new data from newly created files or other files needing more space
- 9. Examining NTFS Disks • NT File System (NTFS) • Improvements over FAT file systems • NTFS provides more information about a file • NTFS gives more control over files and folders • NTFS was Microsoft’s move toward a journaling file system • It records a transaction before the system carries it out • NTFS results in much less file slack space • Clusters are smaller for smaller disk drives • NTFS also uses Unicode • An international data format (Encoding Scheme) • On an NTFS disk • First data set is the Partition Boot Sector • Next is Master FileTable (MFT)
- 10. NTFS System Files • MFT contains information about all files on the disk • Including the system files the OS uses • In the MFT, the first 15 records are reserved for system files • Records in the MFT are called metadata
- 11. MFT and File Attributes • In the NTFS MFT • Begins after the Partition table • All files and folders are stored in separate records of 1024 bytes each • Each record contains file or folder information • This information is divided into record fields containing metadata • A record field is referred to as an attribute ID • File or folder information is typically stored in one of two ways in an MFT record: • Resident - Files less than or equal to 512 bytes are stored inside the MFT • Nonresident - Files larger than 512 bytes are stored outside the MFT • Question: What address is stored for file location if it is nonresident? • Each MFT record starts with a header identifying it as a resident or nonresident attribute • First 42 bytes contains the File Record Header (file or dir, in use or deleted, allocated size
- 13. MFT $SIA • All have a $STANDARD_INFORMATION_ATTRIBUTE • 72 Bytes Contains the 64bit timestamps for MAC • Written in UTC • Times do not always match the activity • NTFS delays writing the last accessed time to improve disk performance • Values stored in the $SIA can be an Indicator of Compromise (IOC) • Question:Why would the $SIA values indicate a compromise?
- 14. MFT $FNA • All have a $FILE_NAME_ATTRIBUTE • 66 Bytes of metadata plus the filename • Contains a reference to the parent directory
- 15. NTFS Data Streams • Each file can contain multiple streams • Similar to a DVD with multiple language tracks • Used to store additional file attributes • Not displayed inWindows Explorer • Show as attribute 0x80 in
- 16. Deleting NTFS Files • When a file is deleted inWindows NT and later • The OS renames it and moves it to the Recycle Bin • Can use the Del (delete) MS-DOS command • Eliminates the file from the MFT listing in the same way FAT does
- 17. Understanding Microsoft Startup Tasks • Learn what files are accessed when Windows starts • This information helps you determine when a suspect’s computer was last accessed • Important with computers that might have been used after an incident was reported • When you start aWindows XP NTFS workstation, several files are accessed immediately • The last access date and time stamp for the files change to the current date and time • Destroys any potential evidence • Startup Files for Windows: • The Ntldr program inWindows XP used to load the OS has been replaced with these three boot utilities: • Bootmgr.exe • Winload.exe • Winresume.exe
- 18. Summary • The Master Boot Record (MBR) stores information about partitions on a disk • When files are deleted in a FAT file system, the Greek letter sigma (0x05) is inserted in the first character of the filename in the directory • NTFS is more versatile because it uses the Master FileTable (MFT) to track file information • Records in the MFT contain attribute IDs that store metadata about files • Analysis of MFT can provide indicator of compromise (IOC) • File slack, RAM slack, and drive slack are areas in which valuable information can reside on a drive
Editor's Notes
- #12: Question – cluster or logical address Manipulation of data in the MFT is an anit-forensic activity (used for hiding data and access)