Disk Image & Filesystem Forensics
Inspect disk images, parse Master File Tables (MFT), mount raw partitions, and carve deleted files using Sleuth Kit and Autopsy.
Types of Disk Images
- Raw / DD (
.raw,.dd,.img): Bit-for-bit uncompressed copy of media. - Expert Witness Format (
.E01,.L01): EnCase format containing embedded metadata, hashes, and compressed chunks. - Virtual Disk Images (
.vmdk,.vhd,.qcow2): Hypervisor disk format files.
Initial Inspection & Mounting
1. Identify Partition Table
# View partition layout, offset sectors, and filesystem types
mmls disk.raw
file -s disk.raw
parted disk.raw print2. Mounting Partitions in Linux
Multiply the starting sector offset by the sector size (usually 512 bytes):
$$\text{Byte Offset} = \text{Start Sector} \times 512$$
# Example: Start sector 2048 -> Offset = 1048576 bytes
sudo mount -o loop,ro,offset=1048576 disk.raw /mnt/analysisSleuth Kit (TSK) Command Suite
Sleuth Kit provides command-line utilities to inspect filesystems without mounting:
| Command | Function | Example Usage |
|---|---|---|
fsstat |
Display filesystem metadata (cluster size, total sectors) | fsstat -o 2048 disk.raw |
fls |
List file and directory entries (including deleted entries) | fls -r -o 2048 disk.raw |
ffind |
Find file name associated with a specific inode/MFT record | ffind -o 2048 disk.raw 14208 |
icat |
Output raw contents of a specific inode/file record | icat -o 2048 disk.raw 14208 > flag.png |
istat |
Show detailed metadata for a specific inode / MFT entry | istat -o 2048 disk.raw 14208 |
File Carving (Recovering Deleted Files)
File carving reconstructs files from unallocated space based on file headers/footers (magic bytes) regardless of filesystem metadata.
1. PhotoRec
photorec disk.rawInteractive terminal UI allows selecting partition types and file extensions (e.g., png, pdf, zip, docx) to carve into output directories.
2. Scalpel
Configure target file signatures in /etc/scalpel/scalpel.conf, then run:
scalpel -c scalpel.conf -o /tmp/carved_output disk.rawNTFS Master File Table (MFT) Analysis
In NTFS filesystems, every file is cataloged in the $MFT.
Key attribute records:
$STANDARD_INFORMATION(0x10): Contains MACB timestamps (Modified, Accessed, Created, Born).$FILE_NAME(0x30): File name and parent folder record. Timestamps here are harder for malware to forge (“timestomping”).$DATA(0x80): Actual file contents (resident if $< 700$ bytes, non-resident if larger).
Parse $MFT files using MFTECmd (Eric Zimmerman tool):
MFTECmd.exe -f "$MFT" --csv C:\AnalysisOutput\