File Systems
Total Page:16
File Type:pdf, Size:1020Kb
Mag. iur. Dr. techn. Michael Sonntag File systems Computer Forensics, Budapest 2008 Institute for Information Processing and Microprocessor Technology (FIM) Johannes Kepler University Linz, Austria E-Mail: [email protected] http://www.fim.uni-linz.ac.at/staff/sonntag.htm © Michael Sonntag 2008 Agenda z Physical disk layout z The boot sequence Æ What changes on a disk during a boot? z Filesystems in detail: Æ FAT, FAT32 Æ NTFS Æ EXT3 Michael Sonntag Computer forensics: File systems 2 Physical structure of a harddisk (http://www.storagereview.com/guide2000/hdd/...) Michael Sonntag Computer forensics: File systems 3 General aspects of harddisks z Several different sized exist Æ Typically named according to the size of the disks, not the case » Note that these are not absolutely accurate (3,5" drive Æ 3,74" disk)! z Rotating disks = „platters“ Æ Made from aluminium or compounds; perhaps even glass Æ Coating: Ironoxide (=rust), Cobalt, … z "Comb" with read-/write heads z Landing Zone / Auto Parking: Resting the head on the surface when not spinning in an area where there is no data Æ In olden times: Manual. Today fully automatic z Impenetrable to dust, but not airtight z „Geometry“ Æ Number of platters, heads, cylinders, sectors z Reserve tracks to enable size guarantee (every disk has phys. errors!) z SMART = Self-Monitoring Analysis and Reporting Technology Michael Sonntag Computer forensics: File systems 4 Tracks and sectors z Formatting the disk creates a file A sector system on the media Æ Which must be able to address individual "parts"! z A disk is divided into (thousands) of concentric circles = tracks A track z Each track is subdivided into sectors of each 512 bytes Æ Not every track has the same number of sectors, however! Track 0 = At the outside z sector = The smallest addressable unit on a disk (="parts") Æ Because of various reasons, larger One disk (upper surface!) units might be created on higher levels » Example: Clusters, partitions, directories, files, … Michael Sonntag Computer forensics: File systems 5 Tracks and sectors z 5,25" disk Æ 2 sides Æ á 40 tracks Æ á 9 sectors z Space for data: Æ 2*40*9*512 Æ 368640 Bytes » =360 kBytes Image: 20 tracks, 16 sectors Source: http://www.storagereview.com/guide2000/ref/hdd/geom/tracks.html Michael Sonntag Computer forensics: File systems 6 ZBR Zoned Bit Recording z Zones with different number of sectors per track Æ Why not different for each track? Æ Because, … 15 0 14 1 11 0 ... ... 1 2 7 0 ... 1 2 3 ... ... 4 ... Source: http://www.storagereview.com/guide2000/hdd/... Michael Sonntag Computer forensics: File systems 7 Cylinders z All tracks on a harddisk which are aligned Æ A harddisk may consist of several physical disks (=platters) Æ All physical disks spin at the same rate and synchronously (=common shaft) z Accessing data on the same cylinder is possible without moving the heads! Æ All heads are mounted on a single actuator arm Æ Simultaneous moves z Example: A cylinder of a harddisk with 4 platters consists of 8 tracks Michael Sonntag Computer forensics: File systems 8 Physical structure of platters Sector Track Cylinder 15 0 14 1 0 1 ... 2 2 2 3 1 4 0 ... sec_per_track nr_cyl tracks_per_cyl (16) (3) = Number of heads (3) sec cyl head [0 .. sec_per_track-1] [0 .. nr_cyl-1] [0 .. tracks_per_cyl-1] Michael Sonntag Computer forensics: File systems 9 Introducing "clusters" z Several sectors are combined to a single cluster z Cluster = Smallest part which can be addresses individually by the operating system z Introduced to manage large/variable-size harddisks by OS Æ Example: FAT16 can only address 216 units » 1 unit = 1 sector Æ 32 MB » 1 unit = 1 cluster (=4 sectors each) Æ 128 MB z What about fragmentation? Æ Internal fragmentation: Space between end of file and end of cluster » Increases: File slack Æ Forensic!!! Æ External fragmentation: Clusters are not allocated in "sequence" » Reduced slightly, as less "units" are needed for a single file z Advantages and problems of cluster size? Æ A 1 byte file requires at least a full cluster » Depends strongly on the number of small files! Æ Larger disks are possible Michael Sonntag Computer forensics: File systems 10 Disk-Partition and OS-BOOT z BIOS Æ „Basic Input / Output System“ Æ Provides also information on disks Æ Cannot be changed by a program » Modern computers: Flash-programmable, but often requires setting a jumper on the motherboard to enable this! z MBR Æ Master Boot Record Æ Contains partition information on the disk and a small piece of code (initial loader for the operating system) » This piece of code is executed first Æ Boot sector viruses! Æ Contains the partition table » List of partitions; which is active, set as boot, … Æ Located at Cylinder 0, head 0, sector 1 (harddisks, floppy disks) Michael Sonntag Computer forensics: File systems 11 OS BOOT (1) Hardware Reset CPU starts executing the program at a pre-defined (hard-coded) address BIOS Basic hardware initialisation Selftest (POST) Decision from where the system will boot Floppy A: Harddisk C: CD-ROM D: Michael Sonntag Computer forensics: File systems 12 OS BOOT (2) BIOS Load Master-Boot-Record and execute it Changes on disk may occur! MBR Select the active partition Read Partition-Boot-Record and execute it PBR Execute OS-Loader Changes on disk will occur! OS Start basic filesystem Michael Sonntag Computer forensics: File systems 13 OS BOOT (3) z Boot sequence BIOS M P O Active B Partition B Partition S partition R R Michael Sonntag Computer forensics: File systems 14 The FAT file system z Very old: Was developed by Microsoft for MS-DOS Æ Partially patented! Æ Little overhead Æ Used today still for memory sticks, flash drives, etc. » Not used anymore for "main" OS partitions (NTFS, etx, …) z Big advantage: Standardized Æ This means, available fully on various OS! » NTFS can be used on Linux, but not completely » Ext can be used on Windows, but not completely z Various versions exist: FAT12, FAT16, FAT32 Æ FAT16: Typically used on most flash disks etc.! Æ We will only discuss FAT16 here! z Bad sectors are marked as such only within the cluster z Simple and fast for smaller disks! Michael Sonntag Computer forensics: File systems 15 Properties of FAT16 z Stores only short filenames: 8.3 Æ Long filenames possible through a (patented) extension z Stores creation, modification and access date z Attributes: Read-only, hidden, system, archive z Maximum number of files: 65517 Æ FAT 12 Æ 212, FAT 16 Æ 216, FAT32 Æ 228 Æ Root directory: Typically 512 files; maximum 32767 files » Fixed maximum size; created during formatting z Maximum file size: 2 GB z Maximum volume size: 2 GB (theoretical: 4 GB) z Allows hierarchical directories Æ Each counts against the limit as a file Michael Sonntag Computer forensics: File systems 16 Physical layout of FAT16 Root BS FAT1 FAT2 Data area directory Optional: Reserved sectors z Boot sector: A single sector containing the boot code and the partition table Æ More reserved sectors immediately afterwards possible z FAT1: The File Allocation Table Æ Contains the map to the data area (which clusters used) z FAT2: Copy of FAT1 z Root directory (fixed location!) Æ Location and properties of files » Note: Subdirectories are located in the data area! z Data area: Where files and subdirectories are located Michael Sonntag Computer forensics: File systems 17 The File Allocation Table (FAT16) z Basic concept of storing/accessing a file: 1. Locate file description in root directory 2. Extract from description number of first cluster 3. Read cluster 4. Lookup this cluster number in FAT 5. According to value found, go to step 3 (next cluster) or terminate (last cluster) » Note: FAT-lookup can also be done in a single step for a whole file and cached until all data sectors were read! z Each cluster is described by a number as Æ Unused Æ Used by a file Æ Last cluster in a file Æ Bad cluster Michael Sonntag Computer forensics: File systems 18 The File Allocation Table (FAT16) Index in FAT 0x01 0x20 0x21 0x22 0x23 0x24 0x25 0x26 0x27 0x28 0x29 MBR … 0x0000 0x0022 0x0025 0x0026 0xFFFF 0x0027 0xFFFF 0xFFFF 0xFFF7 0x0000 Cluster number Cluster 0x27 z The example contains 3 files CA FE 00 0D D5 56 A7 … Sector 0x98 z Directory entries: Æ A: Start cluster 0x21 D1 AF 2E 56 51 7A 72 02 A1 … Sector 0x99 Æ B: Start cluster 0x23 CC 08 7A 69 C4 E2 96 … Æ C: Start cluster 0x24 Sector 0x9A End of file z Cluster 0x28 is erroneous FF 00 07 FE 47 11 08 15 FF FF … z Cluster 0x20 and 0x29 are free Sector 0x9B Michael Sonntag Computer forensics: File systems 19 Storing a directory in FAT16 z Like normal file, but format identical to root directory Æ 11 bytes: Name (8.3) Æ 1 byte: Attributes Æ 5 bytes: Creation time and date (10 ms) Æ 2 bytes: Last access date (1 day, no time!) Æ 4 bytes: Last modification time and date (2 s) Æ 2 bytes: First cluster number Æ 4 bytes: File size in bytes Æ 3 bytes: Reserved z Deleting files: Æ Marked as deleted within the directory ONLY Æ Marking is done by setting first filename byte to "E5h" » The FAT is unaffected and can be used to reconstruct the content as long as the sectors are not reused! » The rest of the directory entry remains until reused! Michael Sonntag Computer forensics: File systems 20 FAT 16 and computer forensic z Typically, files are not actually deleted (see above) Æ Unless the physical area is reused, it is recoverable Æ Fragments of FAT chains may exist even then » Partial recovery of files might be possible z There is no "partition" slack within FAT Æ All clusters are used; there are no partitions