Forensics on Incident 4 - Revision history

PhilippeTeuwen: /* MFT */

2017-03-05T19:08:29Z

MFT

← Older revision		Revision as of 19:08, 5 March 2017
Line 191:		Line 191:
	==MFT==		==MFT==
	===testdisk===		===testdisk===
			http://www.cgsecurity.org/wiki/Advanced_NTFS_Boot_and_MFT_Repair

	testdisk validates the NTFS boot sectors but fails on MFT:		testdisk validates the NTFS boot sectors but fails on MFT:

2017-03-05T19:07:52Z

NTFS

← Older revision		Revision as of 19:07, 5 March 2017
Line 187:		Line 187:
	* https://blogs.technet.microsoft.com/askcore/2009/12/30/ntfs-metafiles/		* https://blogs.technet.microsoft.com/askcore/2009/12/30/ntfs-metafiles/
	* http://ntfs.com/ntfs-mft.htm		* http://ntfs.com/ntfs-mft.htm
			* https://flatcap.org/linux-ntfs/ntfs/help/glossary.html

	==MFT==		==MFT==

2017-03-05T19:07:05Z

NTFS

← Older revision		Revision as of 19:07, 5 March 2017
Line 180:		Line 180:
	sudo ddrescue -m wd.ntfs.map /dev/sda wd.img wd.img.map		sudo ddrescue -m wd.ntfs.map /dev/sda wd.img wd.img.map
	</pre>		</pre>

			NTFS documentation

			* http://ftp.kolibrios.org/users/Asper/docs/NTFS/ntfsdoc.html
			* https://technet.microsoft.com/en-us/library/cc781134(v=ws.10).aspx
			* https://blogs.technet.microsoft.com/askcore/2009/12/30/ntfs-metafiles/
			* http://ntfs.com/ntfs-mft.htm

	==MFT==		==MFT==
	===testdisk===		===testdisk===

2017-03-05T18:38:59Z

file carving

@@ Line 284: / Line 284: @@
     mv "$i" "${i/.docx}$n.docx"
 done
 </pre>

2017-03-05T18:34:29Z

file carving

@@ Line 250: / Line 250: @@
 [[File:Hdd-ntfs.png|800px]]
 ==file carving==
@@ Line 262: / Line 268: @@
 </pre>
 ===photorec===

2017-03-05T00:02:33Z

file carving

← Older revision		Revision as of 00:02, 5 March 2017
Line 240:		Line 240:

	Indeed, MFT and MFTmirror are both corrupted (marked [https://flatcap.org/linux-ntfs/ntfs/help/glossary.html#baad "BAAD"]) and further attempts to recover or mount the NTFS partition fail because of those markers.		Indeed, MFT and MFTmirror are both corrupted (marked [https://flatcap.org/linux-ntfs/ntfs/help/glossary.html#baad "BAAD"]) and further attempts to recover or mount the NTFS partition fail because of those markers.

			==ddrescue views==

			ddrescueview wd.img.map

			[[File:Hdd-recover.png\|800px]]

			ddrescueview wd.ntfs.map

			[[File:Hdd-ntfs.png\|800px]]

	==file carving==		==file carving==

2017-03-04T23:35:26Z

manual

2017-03-04T23:09:32Z

file carving

← Older revision		Revision as of 23:09, 4 March 2017
Line 243:		Line 243:
	As NTFS filesystem is broken, trying file carving...		As NTFS filesystem is broken, trying file carving...

			===fill unused areas===

			Fill empty space with zeroes to ease photorec:
			<pre>
			ddrescue --fill-mode=? /dev/zero wd.img wd.ntfs.map
			</pre>
	===photorec===		===photorec===

2017-03-04T23:08:35Z

MFT

← Older revision		Revision as of 23:08, 4 March 2017
Line 185:		Line 185:

	MFT and MFT mirror are bad. Failed to repair them.		MFT and MFT mirror are bad. Failed to repair them.

			testdisk on Readynas failed to be installed because it expects libntfs-3g852 but Netgear provide their own ntfs-3g and libntfs-3g851, so:

			laptop# apt-get install equivs
			laptop$ equivs-control libntfs-3g852
			# edit libntfs-3g852 or:
			laptop$ cat << EOF > libntfs-3g852
			Section: misc
			Priority: optional
			Standards-Version: 3.9.2
			Package: libntfs-3g852
			Description: equivs libntfs-3g852
			long description and info
			.
			second paragraph
			EOF
			laptop$ equivs-build libntfs-3g852
			readynas# dpkg -i /tmp/libntfs-3g852_1.0_all.deb
			readynas# apt-get install testdisk
			readynas# ( cd /lib/x86_64-linux-gnu/ ; ln -s libntfs-3g.so.851 libntfs-3g.so.852 )
			readynas$ testdisk wd.img

	===ddru_ntfsfindbad===		===ddru_ntfsfindbad===

2017-03-04T23:04:09Z

MFT

@@ Line 186: / Line 186: @@
   MFT and MFT mirror are bad. Failed to repair them.
 ===ddru_ntfsfindbad===
@@ Line 202: / Line 201: @@
 ERROR! Unable to correctly process the mft from the partition boot sector
 </pre>
 ==file carving==