1

Could you please help me to understand the best approach to compare two filesystems / hard disks?

As a practical learning exercise I created a clone of whole hard drive a month ago and again yesterday (it’s Ubuntu Server and I cloned it on Debian just using DD on disconnected hard drive). The point is to compare known state and unknown that was potentially compromised.

After DDing (sudo dd if=/dev/sdX of=/tmp/my_image1) I attached both clones:

sudo losetup --partscan --find --show /tmp/my_image1

I changed FSID so I can mount it and I mounted it:

sudo mount /dev/loop0p3 /mnt/0a -o ro

sudo mount /dev/loop1p3 /mnt/0a -o ro

After that I simply compared both filesystems to find possible change / malware:

sudo diff --no-dereference --brief --recursive /mnt/0a /mnt/0b

It was just for learning, I didn’t assume to find anything else then new logs, Bash history...

But strange thing that I discovered are non-regular files:

sudo find /mnt/0a -not -type f,d,l -exec ls -l '{}' \;
crw-rw-rw- 1 root root 5, 1 Apr 23 07:32 /mnt/0a/dev/console
crw-rw-rw- 1 root root 1, 7 Apr 23 07:32 /mnt/0a/dev/full
crw-rw-rw- 1 root root 1, 3 Apr 23 07:32 /mnt/0a/dev/null
crw-rw-rw- 1 root root 5, 2 Apr 23 07:32 /mnt/0a/dev/ptmx
crw-rw-rw- 1 root root 1, 8 Apr 23 07:32 /mnt/0a/dev/random
crw-rw-rw- 1 root root 5, 0 Apr 23 07:32 /mnt/0a/dev/tty
crw-rw-rw- 1 root root 1, 9 Apr 23 07:32 /mnt/0a/dev/urandom
crw-rw-rw- 1 root root 1, 5 Apr 23 07:32 /mnt/0a/dev/zero
crw------- 1 root root 10, 236 Apr 23 07:34 /mnt/0a/dev/mapper/control

Could anyone please help me understand:

1) Hurpose of character devices on disconnected hard drive - system is not running, I thought that these files are created by system when it’s running (like files in /prod and /dev) and the purpose is to interface with the system, not to store data

2) How am I suppose to compare it? I can compare standard file (bit by bit), I can compare directory names and I can compare symbolic link (by comparing targets) but I have no idea how to compare this.

2
  • 1
    I'm wondering if this is really a Information Security.SE question or a better fit for e.g. Unix & Linux.SE.
    – Glorfindel
    Jun 4, 2020 at 6:56
  • "The point is to compare known state and unknown that was potentially compromised." I suggest you to try learning forensics and malware analysis and look into FIM(File integrity monitoring) solutions Jun 4, 2020 at 13:16

1 Answer 1

0

1) Hurpose of character devices on disconnected hard drive - system is not running, I thought that these files are created by system when it’s running (like files in /prod and /dev) and the purpose is to interface with the system, not to store data

While /proc is completely generated by the kernel, /dev does have some real contents. While a devtmpfs does usually get mounted over it, early boot tasks that run before that happens need some of the devices. Even though character devices are to interface with the system, they still exist on disk; they just don't store their contents there.

2) How am I suppose to compare it? I can compare standard file (bit by bit), I can compare directory names and I can compare symbolic link (by comparing targets) but I have no idea how to compare this.

Compare the major and minor device numbers (e.g., 1, 3 for /dev/null). If two character device files have the same device numbers, then they point to the same device and can thus be considered identical. If not, then they point to different devices and should be considered different.

3
  • That's great explanation Joseph! Thank you! Basically it means that for example character devices are like (kind of) symbolic links. The way how to compare it is compare what they're pointing to instead of comparing the target. diff needs to be told to do that for symlinks (using --no-dereference) and when it comes to non-regular files I can compare them as you mentioned using major and minor device number. (btw I wanted to give you more reputation but I have to have minimum 15 which I don't...., sorry about that)
    – Luky
    Jun 9, 2020 at 14:18
  • @Luky since you asked the question, you can hit the check mark to accept the answer without any rep restriction. Jun 9, 2020 at 18:25
  • I didn't know that ;-). Check mark marked ;-). Again thank you @Joseph
    – Luky
    Jun 13, 2020 at 18:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .