CHFI · Domain 2
Digital Evidence
About 18% of the exam
Storage media types
- Magnetic disk
- platters, sectors, mechanical heads
- Solid state
- flash cells, controller, wear leveling
- Optical
- sessions, tracks, burn timestamps
- Flash media
- removable, often reformatted, carve friendly
- Network storage
- shared volumes, acquire logically
- Array
- several disks presented as one
Geometry and addressing
- Sector
- smallest unit the device handles
- Cluster
- smallest unit the file system allocates
- Slack
- unused remainder of the last cluster
- Logical address
- sector number without physical geometry
- Unallocated
- clusters not assigned to a file
- Advanced format
- larger physical sector, logical emulation
Bigger clusters waste more space per file, which means more slack for an examiner to search
Partition schemes
- Older scheme caps volumes near two terabytes
- Newer scheme uses identifiers and redundancy
- A protective entry hides the new layout
- Backup table sits at the disk end
- Conversion can leave remnants of the old scheme
- Gaps between partitions can hide data
Areas that hide from the system
- Host protected area
- sectors withheld from normal reads
- Device configuration overlay
- reported capacity reduced by firmware
- Service area
- vendor region outside user addressing
- Remapped sectors
- old contents may remain unreachable
- Over provisioning
- spare flash cells beyond capacity
- Detection
- compare native and reported capacity
File systems at a glance
Windows family
- Allocation table chains clusters per file
- Directory entry holds name and start
- Newer flash format lifts the size limit
- Master file table holds one record per file
- Small content stays resident in the record
Unix family
- Inode holds metadata and block pointers
- File name lives in the directory entry
- Journal records metadata operations
- Extents replace indirect block chains
- Orphan list can reveal recent deletions
Apple family
- Catalog records name and metadata
- Overflow file holds extra extents
- Newer format uses copy on write
- Snapshots preserve earlier volume states
- Timestamps stored at fine precision
Every question about deletion is really a question about whether the metadata record or the content survived
Master file table attributes
- Standard information
- times easily changed by tools
- File name
- name plus a second timestamp set
- Data
- content, resident or run list
- Attribute list
- record overflowed into extension records
- Index root
- directory contents inside the record
- Bitmap
- allocation state of clusters
- Named stream
- extra content attached to a file
Metadata files to name
- Boot record describes the volume layout
- Mirror protects the first table records
- Transaction log holds recent metadata operations
- Change journal lists changes with reasons
- Bitmap tracks which clusters are used
- Case mapping table supports name comparison
Deletion and recovery
- Entry marked free
- Content still on disk
- Clusters reused
- Content overwritten
- Only fragments remain
- Deleting usually unlinks rather than erases
- An intact record still names the clusters
- Recycle metadata keeps the original path
- Trim clears flash cells early
- Heavy use destroys recoverable content fastest
Carving and signatures
- Header carving
- match a known starting signature
- Footer validation
- confirm the ending marker exists
- Structure validation
- internal fields must be consistent
- Fragmentation
- pieces out of order defeat simple carving
- False positives
- signature present, content meaningless
- Signature analysis
- content compared against the extension
A carved file that matches the expected size can still be stitched together in the wrong order
Encryption you will meet
Full volume
- Volume header signature identifies the scheme
- Recovery keys may sit in directory services
- Capture while the volume is unlocked
- Memory and hibernation may hold keys
File level
- Individual files encrypted per user certificate
- Names and structure often remain readable
- Recovery agents can decrypt centrally
- Backups may hold plaintext copies
Containers
- Headerless containers resemble random data
- Uniform high entropy is the main clue
- Hidden volumes complicate proof
- Context and file size hint at existence
Arrays and virtual disks
- Striping alone gives no redundancy
- Single parity survives one disk loss
- Mirroring duplicates every block
- Wrong stripe size corrupts at intervals
- Image members individually when possible
- Virtual disks need every chain file present
Hashing and integrity
- Hash the source before and after imaging
- Record the algorithm and the value
- Add a stronger second algorithm
- A mismatch means investigate, not conceal
- Bad sectors explain some mismatches
- Re-verify after transport and storage
Key artifacts
- Resident data
- small content inside the record
- Run list
- clusters holding non-resident content
- Alternate stream
- hidden content on an ordinary file
- File slack
- old bytes after the logical end
- Volume serial
- identifier linking artifacts to media
- Journal record
- what changed and why
Know the order
- Identify the media
- Check native capacity
- Image with a write blocker
- Verify the hash
- Parse the file system
- Then carve the rest
Metadata driven recovery before carving, because the file system already knows where the clusters were
Reference strip: media and file systems
Layout terms
- Sector, cluster, slack
- Allocated and unallocated space
- Partition table and boot record
- Hidden firmware areas
Windows structures
- Master file table records
- Standard information and file name times
- Transaction log and change journal
- Alternate data streams
Other file systems
- Allocation table chains
- Inodes, extents and journals
- Catalog and overflow extents
- Copy on write snapshots
Recovery
- Metadata based recovery first
- Signature carving second
- Slack and unallocated sweeps
- Snapshots and backups
Integrity
- Hash source and image
- Second algorithm for strength
- Document bad sector counts
- Re-verify after every move
Quick exam traps
- Trap: Deleting a file overwrites its content immediately
- Trap: The reported drive capacity is always the true capacity
- Trap: Reformatting a volume destroys all recoverable data
- Trap: A carved file that opens correctly is always complete
- Trap: File level encryption also hides the file names
- Trap: Single parity arrays survive two simultaneous disk failures
- Trap: A hash mismatch always means someone altered the evidence
cybercertprep.com · original revision sheet written from the public body of knowledge