2

If a file is scattered in pieces on a hard drive how is it possible to find all parts of it?

Forensically in a file carving situation where one do not have access to a running OS.

6
  • I don't know (hence the comment and not an answer), but how does a disk defrag achieve it? I imagine you'd want to take the same approach? Oct 4, 2019 at 12:35
  • Well yea, essentially that is also what i thought about.. but.. to be honest that is not as easy as it might seem. Therefore i found reason enough to ask this question :) Let´s see if anyone else knows :)
    – Daniel
    Oct 4, 2019 at 12:57
  • @Daniel I assume you mean after the file been deleted? If not, you just plug the drive into a computer running an OS that can read the file system.
    – Anders
    Oct 4, 2019 at 13:08
  • Not necessarily. If the clever data recovery team managed to get a chunk of data out of a damage USB key for example and im tasked to carve for files. But also deletion, that does count in my question too.
    – Daniel
    Oct 4, 2019 at 14:35
  • 1
    @Daniel Modern file carving uses a lot of statistical analysis and heuristics to try and piece together pictures, audio files, documents, and other file types. The more advanced ones will even try to use known filesystem fragmentation behavior to improve hit rate or speed up the process.
    – user
    Oct 4, 2019 at 17:42

2 Answers 2

1

Your questions are somewhat disjoint, so let me take them in pieces.

If a file is scattered in pieces on a hard drive how is it possible to find all parts of it?

A fragmented file contains pointers or links to each piece or extent of the file. Exactly how those links are structured varies with the file system, but all file systems use them.

Forensically in a file carving situation where one do not have access to a running OS.

First of all, it's not a question of a "running OS". Whatever software tools you are using is running under your analysis OS, which is unrelated to whatever OS might exist or existed on the disk drive being analyzed. For example you may be running Linux and examining a disk drive taken from a Windows machine.

"Carving" has nothing to do with an OS. Carving comes into play when you are trying to recover "deleted" files.

If the "File System" is intact (such as NTFS or Fat, etc.) then deleted file recovery can vary greatly by file system. If the link Pointers are still present, although deallocated, the fragmented file segments may still be located from the pointers.

If the Link Pointers are gone or the File System is not usable, "carving" comes into play. Note that most carvers require a working file system, only a few can carve raw data without a known File System.

File carvers look for known headers to indicate the beginning of a file. Generally they just grab sequential data blocks until they hit a matching footer, or an allocated block.

Most carvers will not recover fragmented files from raw data. There are a few that do a pretty good job of finding matching Header/Footer contiguous fragments. There are fewer still that will attempt to find lost middle fragments for well structured content like JPGs, but these are mostly experimental and unreliable.

0

That is of course filesystem dependent.

What you normally do in forensics is make a copy of the whole disk (with dd) and operate on that copy only. Next is to try to undelete a file.

You will always have some operating system running otherwise you cannot access the file. You will attach the drive-copy to a computer that runs an OS, but you will not boot from that drive.

For FAT and NTFS, wikipedia (https://en.wikipedia.org/wiki/Undeletion) has an excellent explanation, which I won't copy here.

For ext[234]fs, there is a utility called extundelete.

The main point of all the undeletion tools is, that the original content must still be available and not have been overwritten and that you must be able to reconstruct the pointers on the disk to the right sectors/clusters. For that, you either use the tools (the easy way) or you must have good knowledge of the structure of the filesystem that you are examining, as well as a good knowledge of what the OS does when it deletes files. Which is of course OS dependent.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.