Instructor: Carving. 2 2
I mentioned before that when you delete a file, 3 3
it's not really gone from the hard drive. 4 4
It's just still stored on there 5 5
and we need to find a way to get it off. 6 6
And that's what we're going to talk about in this lesson 7 7
when we talk about carving. 8 8
But before we talk about carving, 9 9
you have to understand how a hard drive works. 10 10
If you look at a hard drive, you may think, well, 11 11
that's just one single platter 12 12
and we just store information on it, 13 13
but that's not really true. 14 14
We actually take that disk and we divide it up 15 15
into smaller areas, whether you're using a hard drive 16 16
or an SSD, these are going to be divided into sectors. 17 17
These sectors are either 512 bytes of data, 18 18
which is a standard size, or 4,096 bytes of data, 19 19
which is an advanced size. 20 20
This allows us to identify individual parts 21 21
of that disc where we're going to store files. 22 22
Now, again, this seems really small when we talk about 23 23
something like a video file that may be a gigabyte in size. 24 24
And so what ends up happening is, 25 25
we end up taking these files and breaking them apart 26 26
to fit inside these sectors. 27 27
Now, in addition to these sectors, 28 28
we start using blocks and clusters. 29 29
Now, a blocking cluster 30 30
is the smallest unit a file system can address. 31 31
And by default, this is 4,096 bytes. 32 32
So if you're using the advanced format, 33 33
one block or cluster is equal to one sector. 34 34
But if you're using the standard sector size of 512 bytes, 35 35
you're going to have multiple sectors making up 36 36
that one block or one cluster. 37 37
Now, because of the way these hard drives work 38 38
and we start breaking things up into these blocks 39 39
and clusters and sectors, I can take a really big file 40 40
and make it into a lot of different pieces 41 41
and then I can store those pieces all over the hard drive. 42 42
Now, by default, it's going to start at sector one 43 43
and keep adding as it goes linearly, 44 44
one, two, three, four, five. 45 45
But eventually, you delete a file 46 46
and so when you want to fill that hole, 47 47
it's going to start breaking up your files 48 48
and putting it across the hard drive in any holes it finds. 49 49
That's the idea of how this works. 50 50
Now, to be able to identify where all these files are, 51 51
we have to have something called the master file table. 52 52
The master file table is a table that contains metadata 53 53
with the location of each file 54 54
in terms of the block and cluster for the disc 55 55
and this is used inside NTFS file systems. 56 56
If you're using FAT, 57 57
it uses a file allocation table instead. 58 58
But most Windows machines these days use NTFS. 59 59
So we'll just talk about it 60 60
in terms of the master file table 61 61
for our purposes here in this lesson. 62 62
Now, when you delete a file, 63 63
you really aren't deleting the file as I said before. 64 64
You're deleting the entry to that file. 65 65
You're going into the MFT, the master file table, 66 66
and you're erasing the metadata that says 67 67
where that file is located. 68 68
That marks that spot on the hard drive as open and available 69 69
for another file to be written there. 70 70
Again, this can lead to little blocks and little sectors 71 71
all over the hard drive in various places 72 72
that you start putting data in. 73 73
So when you are deleting a file as a user, 74 74
you're actually only deleting the reference in the table, 75 75
and that converts that previous location to free, 76 76
also known as slack space. 77 77
This is an important concept to understand, 78 78
because as forensic analysts, 79 79
it's our job to find those files that are deleted 80 80
and bring them back to life, 81 81
especially when they contain evidence of a crime. 82 82
This brings us to the idea of file carving 83 83
which was the title for this lesson. 84 84
Now, when we talk about file carving, this is the process 85 85
of extracting data from a computer 86 86
when the data has no associated file system metadata. 87 87
Essentially, somebody has deleted the file 88 88
and I want to get that file back. 89 89
Now, again, because there's little pieces 90 90
of the file all over the hard drive 91 91
and those spots were now allocated as open, 92 92
pieces could have been overwritten 93 93
and so you may not be able to get the entire file back. 94 94
Instead, by doing file carving, 95 95
I can attempt to piece together those data fragments 96 96
from all the unallocated and slack spaces 97 97
to reconstruct the deleted files. 98 98
And if I can't get the whole file, 99 99
I can at least get parts of those files. 100 100
This is why if you have a hard drive that's failing on you 101 101
and you want somebody to analyze it and recover 102 102
the lost files for you, or you delete something by mistake, 103 103
the first thing we tell you is, 104 104
immediately stop using the computer. 105 105
Don't touch it anymore, because the more you use it, 106 106
the more chance something's going to get overwritten, 107 107
and we won't be able to recover your files. 108 108
But if you just stop what you're doing 109 109
and bring us that computer immediately, 110 110
we can bring those files back to life for you. 111 111
Now, there are lots and lots 112 112
of tools out there that can do file carving. 113 113
EnCase can do it, FTK can do it and of course, 114 114
Autopsy can do it using the Sleuth Kit. 115 115
For instance, here on the screen, 116 116
you'll see the graphical user interface for Autopsy 117 117
and we went in here and we are carving a file. 118 118
Notice in the upper right-hand corner, 119 119
you see that PDF file it says ebook.pdf 120 120
and there's two or three of those 121 121
and then there's another PDF file under that 122 122
and there's a red X over the file icon. 123 123
That means, this was an unallocated space on the hard drive 124 124
and we found something that looks like a PDF file. 125 125
We believe this to be the file, 000-000+ebook.pdf. 126 126
And if you look at the bottom, 127 127
you can see the metadata associated with it, 128 128
and we can go through a recovery operation 129 129
to put that piece back together 130 130
and be able to get that file back, hopefully, 131 131
and use it as evidence. 132 132
Now, the great thing about using something like Autopsy 133 133
is it is a graphical user interface, 134 134
so it's really easy to point and click 135 135
and recover your files. 136 136
Now, another tool you can use is Scalpel. 137 137
And Scalpel is actually the tool that's being used 138 138
by Autopsy, but it's actually a command line tool. 139 139
This is an open-source command line tool 140 140
that is part of the Sleuth Kit 141 141
and it's used to conduct the file carving 142 142
on Linux and Windows systems. 143 143
When you're using Autopsy to do file carving, 144 144
you're actually using Scalpel. 145 145
And you can use Scalpel directly 146 146
and use it from the command line environment, 147 147
but it is a lot more complex. 148 148
But for the exam, you don't need to know how to use Scalpel 149 149
from the command line or even from the user interface. 150 150
You just need to know the concept that file carving 151 151
is used to bring back pieces of a file, 152 152
or the full file, if you're lucky 153 153
as evidence in a digital forensics investigation.