Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Digital Forensics > Reconstructing FAT File System Structures > Flashcards

Reconstructing FAT File System Structures Flashcards

1
Q

Photographic documentation must be used to…

A

Place material and to avoid claims of mistaken identity or mis-configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Storage comes in arbitrary forms:

A
  • Tiny USB mass storage devices
  • Gaming consoles
  • Smart watches
  • Phones
  • Digital photo frames
  • Local surveillance camera storage
  • Photo frames
  • Backup media
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Forensic Duplication:

A

The ability to produce an identical byte stream from the duplicate as from the original

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A forensic duplicate as a file (or artefact) containing…

A

Every bit of information from the source, typically in a raw format

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

A qualified duplicate provides…

A

The same information as a forensic duplicate, but contains further embedded meta-data or employs certain kinds of compression

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

A restored image is a…

A

Forensic or qualified forensic duplicate restored to another storage medium

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

A mirror image provides a…

A

Bit-wise copy from one medium to another

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Device must ensure that no write occurs on the original device but…

A

Recall that even during the read-only operation, the device may alter its internal state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Imaging device must…

A

Perform sector-by-sector copying

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Error conditions must be…

A

Identified clearly, detailed logging

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Integrity of duplicated data must be…

A

Traceable, typically using cryptographic hash information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Creating Forensic Duplicates - Addition information which should be recorded:

A
  • Time and location of duplication session

* Diagnostic information from device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Any mechanism providing imaging or write blocking must provide assurance of maintaining the objectives:

A
  • Manufacturers may need to provide expert testimony when challenged
  • Forensic laboratories may provide test results
  • The NIST CFTT provides detailed test plans for imaging and write blocking devices
  • Hardware-based systems are simple to implement and particularly to validate
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Volume systems may be used to…

A

Combine multiple sub-volumes into a single volume

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

All components required for duplication must be…

A

Identified and recorded clearly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

In the case of files, disks and partitions may contain un-allocated as well as slack space, can be used by…

A

Arbitrary file systems and must be analysed separately

17
Q

Reconstruction of on-disk data depends on a number of factors including:

A
  • Has the medium been used in some way after the incident
  • Has any deletion occurred
  • Is the use of wiping tools suspected
  • Is the presence of anti-forensic or malware components suspected
  • Is the file system complete
  • Is knowledge of file content or file format available
  • Is sought-after information replicated
18
Q

Establishing that a volume holds a FAT file system:

A
  • Finding the 0x55AA boot sector signature or in the reserved area is quickest approach
  • Even for file systems, the structure of FAT can often be hypothesised
19
Q

Identify the first cluster:

A

Easy only if the exact FAT type and cluster size is known

20
Q

Knowledge of the OS version which created or used the file system is important which means…

A

Cluster allocation strategy may vary

21
Q

Once a directory entry has been located, the base entry must be identified:

A
  • For long file names, multiple entries may exist
  • Recall that the allocation status is set by the first byte of the base entry
  • The base directory entry will also hold the starting cluster of the file
  • On creating a new directory, the OS will generally zero/wipe the cluster, the first two entries are for “.” and “..” entries
22
Q

The FAT structure will contain a chained list of entries for all data clusters and the last block will contain…

A

An End-of-File (EOF) marker

23
Q

Deleted/De-allocated files will result in…

A

Deletion of first byte of directory entry

24
Q

Deletion of first byte of directory entry can cause…

A

Ambiguity in file names

25
Q

Long file name entries can be used to…

A

Reconstruct original file name

26
Q

If a directory entry is zeroed out…

A

Files are now orphaned

27
Q

Recovery requires use of heuristics for file or directory structures:

A
  • This may sometimes find files of earlier generations

* Time values in entries are not always reliable, but can provide circumstantial evidence

28
Q

Processes for reconstructing files are similar as for directories:

A
  • Where cluster information is available, simply following the chain is straightforward
  • Otherwise content-specific heuristics may be needed
29
Q

As data is allocated on a cluster basis, on average half of the last cluster will be un-used, but for re-sed clusters…

A

This means that data in this slack space may remain for some time until its overwritten

Digital Forensics (26 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions