File system forensics: FAT, NTFS and ext4
You read partition tables, learn how FAT, NTFS and ext4 store and delete data, and find deleted files and leftovers in slack space.
Level 201 · 17 lessons · 15 practice labs
Lessons
Disks and partitions
- Sectors, clusters and blocks: the smallest pieces of a disk
- Reading the MBR partition table with xxd and mmls
- GPT partitions and the backup header
- Unallocated space: data hiding between partitions
- Short task: find the hidden partition in an image
FAT and NTFS
- FAT: directory entries and the cluster chain
- A deleted file in FAT: the name that loses its first letter
- The NTFS Master File Table (MFT) and its records
- NTFS attributes: $STANDARD_INFORMATION and $FILE_NAME
- Alternate data streams: a hidden file inside a file
- Change history with $UsnJrnl and $LogFile
- Short task: find the MFT record of a deleted document in an NTFS image
ext4 and recovery
- ext4 inodes and examining them with debugfs
- The ext4 journal: tracing a deleted file
- File slack and the old data left in it
- Getting a deleted file back with icat and tsk_recover
- Capstone: recover deleted evidence from three different file systems
Practice labs
- Read the partition table: List an image's partitions, start sectors and types with mmls.
- Decode the MBR in a hex dump: Read the first sector with xxd and decode one partition entry's type and start by hand.
- Find the hidden partition in an image: Find the file system hidden in unallocated space between partitions and list its contents.
- Read a FAT directory entry: List the directory entries in a FAT image and find a file's first cluster.
- Find the trace of a deleted file: Extract the deleted file's name and size from the directory entry with its first letter gone.
- Recover a file by following the cluster chain: Recover a deleted FAT file by following its clusters and verify its hash against the given value.
- Read an MFT record: List the attributes and times in a file's MFT record with istat.
- Find the alternate data stream: Find the file carrying a hidden stream in an NTFS image and extract the stream's contents.
- The deleted document's MFT record and change history: Find the deleted document's MFT record and order its creation, rename and deletion moments from $UsnJrnl entries.
- Inspect an inode with debugfs: Extract a file's inode number, size and times with debugfs.
- The trace of a deleted file in the ext4 journal: Find the old inode copy of a deleted file in the journal and write its block addresses.
- Bring a deleted file back from the journal: Rebuild the deleted file from the block addresses found in the journal and verify its contents.
- Extract a file from its inode with icat: Find the deleted entry with fls and extract its content with icat.
- Old data left in file slack: Find the old text left in a file's slack space and show which cluster holds it.
- Recover evidence from three file systems: Recover one deleted file each from FAT, NTFS and ext4 images and tabulate the differences in method.
About this course
You read partition tables, learn how FAT, NTFS and ext4 store and delete data, and find deleted files and leftovers in slack space.
What you will learn
- Disks and partitions
- FAT and NTFS
- ext4 and recovery
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.