A Practical Approach to Sufficient Infosec.ppt.pptVIP

File System Analysis * What is a File System? Computers need a way to store data and then to retrieve the said data in simple but quick ways. File systems provide a way for computers to store data in a hierarchy of files and directories. * What is a File System? A file system defines how and where files are stored and how they are named. Files systems are independent of any type of computer. The file systems we will look at are FAT (File Allocation Table), NTFS, Ext2 and Ext3. However, what they have in common is that they all know how to store data and to retrieve the data in a quick manner. * Essential and Non-Essential Data When looking at data, it is important to differentiate between the essential and non-essential data. We have to trust the essential data, but not necessarily trust the non-essential data. It is also important to know which OS wrote the file system because different OS’s might have different requirements as to what is essential and what is not. * Essential and Non-Essential Data Essential data is that data that is needed to save and retrieve files. Some essential data: Content storage location. Name of the file. Pointer from name to metadata. Non-essential data is there for convenience but not needed for the basic functionality of storing and retrieving files. Access Times Security Permissions * Data Categories In order to understand different analysis techniques, we divide the data on a computer into several categories. File System Content Metadata File Name Application The tools in The Sleuth Kit (TSK) are based on these same categories. * Data Categories - File System Each instance of a file system is unique because it has a unique size. It contains the general file system information such as where to find certain data (which cluster or block does this reside in) and how big the data unit is. It works like a map. * Data Categories - Content This category is made up of the actual content of a file. Most of the information