3

Today in class we learned about how information can be uncovered in a file slack. I understand this theoretically, given the physical and logical file size I can come up with the slack space of a file. However, how can I uncover this information in the slack space if I wanted to know if there is anything valuable in a certain file slack? I've been using a hex editor to look at the disk and the files but I am not sure where to go from here. I heard that enCase is a good resource, however I am not able to find the link to download on Ubuntu or Mac for free

  • A bit of Google Searching brought up this SANS Paper discussing one tool. – user2320464 Oct 11 '16 at 19:51
  • Please note that File Slack and Filesystem Slack might be considered two different things. I believe you are referring to Filesystem Slack Space. On the other hand, File slack space could refer to file-system-like file such as free space in an SQL database file prior to optimization. Also it might could refer to extra (hiding) data appended to an ordinary media file (i.e. JPEG), which normally has no effect on the rendered image. – Bryan Field Oct 11 '16 at 19:54
  • What you are trying to do is what a data recovery tool performs. – Xaqron Oct 11 '16 at 19:59
  • @GeorgeBailey how do I access this extra (hiding) data? – Bthegreatest Oct 11 '16 at 20:05
  • @Xaqron Exactly! But I am not sure how to recover this data, I have calculated the slack space but I am not sure how to access the sectors of the disk – Bthegreatest Oct 11 '16 at 20:07
2

I think you want Filesystem Slack. As Xaqron says, you will need a hex editor that can open drives, because opening up a file will only help you with File Slack, not Filesystem Slack.

Preferably you should use a Hex editor that shows the ASCII characters at the same time as the hex data.

Manual review using Hex editor

Once you have such an editor, you have to find out what you are looking for?

Let's imagine that you are looking for a Word document that has been erased. The best way to start is to look at a Word document with a Hex Editor, and then find some kind of code at the very beginning of the file, which you will likely see on all word documents.

Once you find such code, you will be able to search for this in the slack space.

One problem you will find is that opening a drive directly will show you all data, both Allocated and Slack. Unfortunately, it is difficult for a human to distinguish which is which. For example, if there are some real Word documents, as well as deleted ones, then how could you tell the difference? This would be very difficult.

Perhaps you will instead need to search for key words or phrases that you are interested in. Keep in mind, that some documents will encode the text differently. Again, you should compare what non-deleted files look like before searching this in Slack space.

The same principals apply for any document type, not just Word. For example Image files often have a few bytes at the beginning that you can use to tell what type of file it was. Unfortunately, images are heavily encoded so you cannot search their contents.

Some files like txt do not have such identification, but are also very light on the encoding, so they are easier to find in slack space.

Keep in mind that Slack Space will often be a mess, with partially overwritten or expired chunks of files. De-fragmentation processes or re-allocation to other files can introduce gaps in what you are able to recover.

Tools

A couple more things come to mind.

  • There may be a specialized hex editor or other tool available that will highlight and search Slack Space separately from Allocated Space. I don't know if there is one, but it seems like there would be. This would really help your manual review process.

  • There are applications designed to identify and restore files out of Slack Space. These automated tools (restore deleted files) are readily available and are the easiest way to get something productive done.

0

What you are looking to do is called forensic analysis, and the process is fairly simple: create a file containing a copy of the disk image, load the image into an analysis tool, and start hunting.

To create a disk image of a hard disk on a Windows machine, probably the easiest way is to boot to a LiveCD distro of Linux, and use dd to copy the disk image to a file somewhere. There are freeware and other tools that supposedly can make a disk image under Windows, and they work fine for USB sticks and removable drives. (Also note that an encrypted disk will effectively prevent making a useful image.)

For analysis, EnCase is a tool that many professional investigators use. (I believe there is a free version available to students.) But it's all closed source, and the fully licensed product is quite expensive.

There is a very good open source tool called The Sleuth Kit, and a Windows GUI version available called Autopsy. Autopsy makes it easy to open a disk image file, search through the disk, recover "deleted" files, and examine what's in the slack space. There is a module that helps find deleted images, which are often the focus of an investigation. You'll find it's well documented, and the web has a lot of good tutorials.

  • haha I am actually using autosy, however I'm having trouble accessing the slack space. I have calculated the slack space (in bytes) but I am having trouble analyze the bits and pieces of where the data is located in the slack space. Any suggestions? – Bthegreatest Oct 11 '16 at 21:37
  • Slack space is a messy trash can. It is not designed to be orderly; it's what's left over after deleting stuff. Your best bet is to start using file system references to deleted files. The most recently deleted files will be best, and those can often point to slack space areas of the disk that may still represent the original data. But if you're just browsing through gigabytes of previously deleted data, you'll never find anything useful that way. – John Deters Oct 11 '16 at 21:42
  • the thing is, the given clue for recovering a secret key tells me to look at the slack of a certain file. – Bthegreatest Oct 11 '16 at 21:44
  • 1
    One thing you could do is if you know what you are looking for, search for something you know is related. Let's say it's source code to an app where you saw an error message "Error: the cheese is not this way." Searching for the word "cheese" would yield relatively few hits, and you might get lucky. But just blindly stumbling through the slack space is likely to be extremely non-productive. – John Deters Oct 11 '16 at 21:44
  • I am not searching blindly because I know where to look, however I do not know how to access THAT area – Bthegreatest Oct 11 '16 at 21:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.