1 1 00:00:00,540 --> 00:00:01,950 Carving. 2 2 00:00:01,950 --> 00:00:04,290 I mentioned before that when you delete a file, 3 3 00:00:04,290 --> 00:00:06,420 it's not really gone from the hard drive. 4 4 00:00:06,420 --> 00:00:07,680 It's just still stored on there 5 5 00:00:07,680 --> 00:00:09,510 and we need to find a way to get it off. 6 6 00:00:09,510 --> 00:00:11,100 And that's what we're going to talk about in this lesson 7 7 00:00:11,100 --> 00:00:12,570 when we talk about carving. 8 8 00:00:12,570 --> 00:00:14,040 But before we talk about carving, 9 9 00:00:14,040 --> 00:00:16,680 you have to understand how a hard drive works. 10 10 00:00:16,680 --> 00:00:19,140 If you look at a hard drive, you may think, well, 11 11 00:00:19,140 --> 00:00:20,400 that's just one single platter 12 12 00:00:20,400 --> 00:00:22,080 and we just store information on it, 13 13 00:00:22,080 --> 00:00:23,820 but that's not really true. 14 14 00:00:23,820 --> 00:00:26,280 We actually take that disk and we divide it up 15 15 00:00:26,280 --> 00:00:29,310 into smaller areas, whether you're using a hard drive 16 16 00:00:29,310 --> 00:00:32,520 or an SSD, these are going to be divided into sectors. 17 17 00:00:32,520 --> 00:00:35,430 These sectors are either 512 bytes of data, 18 18 00:00:35,430 --> 00:00:39,360 which is a standard size, or 4,096 bytes of data, 19 19 00:00:39,360 --> 00:00:41,190 which is an advanced size. 20 20 00:00:41,190 --> 00:00:44,010 This allows us to identify individual parts 21 21 00:00:44,010 --> 00:00:46,650 of that disc where we're going to store files. 22 22 00:00:46,650 --> 00:00:48,870 Now, again, this seems really small when we talk about 23 23 00:00:48,870 --> 00:00:51,690 something like a video file that may be a gigabyte in size. 24 24 00:00:51,690 --> 00:00:53,160 And so what ends up happening is, 25 25 00:00:53,160 --> 00:00:55,530 we end up taking these files and breaking them apart 26 26 00:00:55,530 --> 00:00:57,630 to fit inside these sectors. 27 27 00:00:57,630 --> 00:00:59,160 Now, in addition to these sectors, 28 28 00:00:59,160 --> 00:01:01,680 we start using blocks and clusters. 29 29 00:01:01,680 --> 00:01:02,940 Now, a blocking cluster 30 30 00:01:02,940 --> 00:01:05,250 is the smallest unit a file system can address. 31 31 00:01:05,250 --> 00:01:08,190 And by default, this is 4,096 bytes. 32 32 00:01:08,190 --> 00:01:10,350 So if you're using the advanced format, 33 33 00:01:10,350 --> 00:01:13,290 one block or cluster is equal to one sector. 34 34 00:01:13,290 --> 00:01:17,310 But if you're using the standard sector size of 512 bytes, 35 35 00:01:17,310 --> 00:01:19,710 you're going to have multiple sectors making up 36 36 00:01:19,710 --> 00:01:21,840 that one block or one cluster. 37 37 00:01:21,840 --> 00:01:23,700 Now, because of the way these hard drives work 38 38 00:01:23,700 --> 00:01:25,710 and we start breaking things up into these blocks 39 39 00:01:25,710 --> 00:01:28,680 and clusters and sectors, I can take a really big file 40 40 00:01:28,680 --> 00:01:30,780 and make it into a lot of different pieces 41 41 00:01:30,780 --> 00:01:33,660 and then I can store those pieces all over the hard drive. 42 42 00:01:33,660 --> 00:01:36,150 Now, by default, it's going to start at sector one 43 43 00:01:36,150 --> 00:01:38,160 and keep adding as it goes linearly, 44 44 00:01:38,160 --> 00:01:40,590 one, two, three, four, five. 45 45 00:01:40,590 --> 00:01:42,240 But eventually, you delete a file 46 46 00:01:42,240 --> 00:01:43,740 and so when you want to fill that hole, 47 47 00:01:43,740 --> 00:01:45,300 it's going to start breaking up your files 48 48 00:01:45,300 --> 00:01:48,300 and putting it across the hard drive in any holes it finds. 49 49 00:01:48,300 --> 00:01:50,310 That's the idea of how this works. 50 50 00:01:50,310 --> 00:01:53,130 Now, to be able to identify where all these files are, 51 51 00:01:53,130 --> 00:01:56,130 we have to have something called the master file table. 52 52 00:01:56,130 --> 00:01:58,980 The master file table is a table that contains metadata 53 53 00:01:58,980 --> 00:02:00,570 with the location of each file 54 54 00:02:00,570 --> 00:02:03,570 in terms of the block and cluster for the disc 55 55 00:02:03,570 --> 00:02:06,360 and this is used inside NTFS file systems. 56 56 00:02:06,360 --> 00:02:07,530 If you're using FAT, 57 57 00:02:07,530 --> 00:02:09,990 it uses a file allocation table instead. 58 58 00:02:09,990 --> 00:02:13,320 But most Windows machines these days use NTFS. 59 59 00:02:13,320 --> 00:02:14,153 So we'll just talk about it 60 60 00:02:14,153 --> 00:02:16,140 in terms of the master file table 61 61 00:02:16,140 --> 00:02:18,120 for our purposes here in this lesson. 62 62 00:02:18,120 --> 00:02:19,710 Now, when you delete a file, 63 63 00:02:19,710 --> 00:02:22,380 you really aren't deleting the file as I said before. 64 64 00:02:22,380 --> 00:02:24,240 You're deleting the entry to that file. 65 65 00:02:24,240 --> 00:02:27,270 You're going into the MFT, the master file table, 66 66 00:02:27,270 --> 00:02:29,310 and you're erasing the metadata that says 67 67 00:02:29,310 --> 00:02:30,870 where that file is located. 68 68 00:02:30,870 --> 00:02:33,600 That marks that spot on the hard drive as open and available 69 69 00:02:33,600 --> 00:02:35,430 for another file to be written there. 70 70 00:02:35,430 --> 00:02:38,400 Again, this can lead to little blocks and little sectors 71 71 00:02:38,400 --> 00:02:40,680 all over the hard drive in various places 72 72 00:02:40,680 --> 00:02:42,510 that you start putting data in. 73 73 00:02:42,510 --> 00:02:45,240 So when you are deleting a file as a user, 74 74 00:02:45,240 --> 00:02:48,120 you're actually only deleting the reference in the table, 75 75 00:02:48,120 --> 00:02:51,000 and that converts that previous location to free, 76 76 00:02:51,000 --> 00:02:52,830 also known as slack space. 77 77 00:02:52,830 --> 00:02:55,020 This is an important concept to understand, 78 78 00:02:55,020 --> 00:02:56,820 because as forensic analysts, 79 79 00:02:56,820 --> 00:02:59,460 it's our job to find those files that are deleted 80 80 00:02:59,460 --> 00:03:00,990 and bring them back to life, 81 81 00:03:00,990 --> 00:03:03,900 especially when they contain evidence of a crime. 82 82 00:03:03,900 --> 00:03:06,120 This brings us to the idea of file carving 83 83 00:03:06,120 --> 00:03:08,040 which was the title for this lesson. 84 84 00:03:08,040 --> 00:03:10,380 Now, when we talk about file carving, this is the process 85 85 00:03:10,380 --> 00:03:12,360 of extracting data from a computer 86 86 00:03:12,360 --> 00:03:15,420 when the data has no associated file system metadata. 87 87 00:03:15,420 --> 00:03:17,550 Essentially, somebody has deleted the file 88 88 00:03:17,550 --> 00:03:19,470 and I want to get that file back. 89 89 00:03:19,470 --> 00:03:21,690 Now, again, because there's little pieces 90 90 00:03:21,690 --> 00:03:23,340 of the file all over the hard drive 91 91 00:03:23,340 --> 00:03:26,070 and those spots were now allocated as open, 92 92 00:03:26,070 --> 00:03:27,510 pieces could have been overwritten 93 93 00:03:27,510 --> 00:03:30,090 and so you may not be able to get the entire file back. 94 94 00:03:30,090 --> 00:03:32,070 Instead, by doing file carving, 95 95 00:03:32,070 --> 00:03:34,560 I can attempt to piece together those data fragments 96 96 00:03:34,560 --> 00:03:36,810 from all the unallocated and slack spaces 97 97 00:03:36,810 --> 00:03:38,640 to reconstruct the deleted files. 98 98 00:03:38,640 --> 00:03:40,500 And if I can't get the whole file, 99 99 00:03:40,500 --> 00:03:42,810 I can at least get parts of those files. 100 100 00:03:42,810 --> 00:03:45,090 This is why if you have a hard drive that's failing on you 101 101 00:03:45,090 --> 00:03:47,070 and you want somebody to analyze it and recover 102 102 00:03:47,070 --> 00:03:49,920 the lost files for you, or you delete something by mistake, 103 103 00:03:49,920 --> 00:03:51,120 the first thing we tell you is, 104 104 00:03:51,120 --> 00:03:53,280 immediately stop using the computer. 105 105 00:03:53,280 --> 00:03:55,740 Don't touch it anymore, because the more you use it, 106 106 00:03:55,740 --> 00:03:58,230 the more chance something's going to get overwritten, 107 107 00:03:58,230 --> 00:04:00,150 and we won't be able to recover your files. 108 108 00:04:00,150 --> 00:04:02,130 But if you just stop what you're doing 109 109 00:04:02,130 --> 00:04:03,720 and bring us that computer immediately, 110 110 00:04:03,720 --> 00:04:05,790 we can bring those files back to life for you. 111 111 00:04:05,790 --> 00:04:07,110 Now, there are lots and lots 112 112 00:04:07,110 --> 00:04:09,180 of tools out there that can do file carving. 113 113 00:04:09,180 --> 00:04:12,270 EnCase can do it, FTK can do it and of course, 114 114 00:04:12,270 --> 00:04:14,850 Autopsy can do it using the Sleuth Kit. 115 115 00:04:14,850 --> 00:04:16,050 For instance, here on the screen, 116 116 00:04:16,050 --> 00:04:19,230 you'll see the graphical user interface for Autopsy 117 117 00:04:19,230 --> 00:04:21,960 and we went in here and we are carving a file. 118 118 00:04:21,960 --> 00:04:23,490 Notice in the upper right-hand corner, 119 119 00:04:23,490 --> 00:04:26,760 you see that PDF file it says ebook.pdf 120 120 00:04:26,760 --> 00:04:27,840 and there's two or three of those 121 121 00:04:27,840 --> 00:04:29,670 and then there's another PDF file under that 122 122 00:04:29,670 --> 00:04:32,340 and there's a red X over the file icon. 123 123 00:04:32,340 --> 00:04:35,610 That means, this was an unallocated space on the hard drive 124 124 00:04:35,610 --> 00:04:38,190 and we found something that looks like a PDF file. 125 125 00:04:38,190 --> 00:04:43,190 We believe this to be the file, 000-000+ebook.pdf. 126 126 00:04:44,670 --> 00:04:45,630 And if you look at the bottom, 127 127 00:04:45,630 --> 00:04:47,640 you can see the metadata associated with it, 128 128 00:04:47,640 --> 00:04:49,230 and we can go through a recovery operation 129 129 00:04:49,230 --> 00:04:51,060 to put that piece back together 130 130 00:04:51,060 --> 00:04:52,980 and be able to get that file back, hopefully, 131 131 00:04:52,980 --> 00:04:54,390 and use it as evidence. 132 132 00:04:54,390 --> 00:04:56,520 Now, the great thing about using something like Autopsy 133 133 00:04:56,520 --> 00:04:58,470 is it is a graphical user interface, 134 134 00:04:58,470 --> 00:05:00,330 so it's really easy to point and click 135 135 00:05:00,330 --> 00:05:02,010 and recover your files. 136 136 00:05:02,010 --> 00:05:04,410 Now, another tool you can use is Scalpel. 137 137 00:05:04,410 --> 00:05:06,570 And Scalpel is actually the tool that's being used 138 138 00:05:06,570 --> 00:05:09,660 by Autopsy, but it's actually a command line tool. 139 139 00:05:09,660 --> 00:05:11,460 This is an open-source command line tool 140 140 00:05:11,460 --> 00:05:12,870 that is part of the Sleuth Kit 141 141 00:05:12,870 --> 00:05:14,610 and it's used to conduct the file carving 142 142 00:05:14,610 --> 00:05:16,470 on Linux and Windows systems. 143 143 00:05:16,470 --> 00:05:18,690 When you're using Autopsy to do file carving, 144 144 00:05:18,690 --> 00:05:20,160 you're actually using Scalpel. 145 145 00:05:20,160 --> 00:05:21,930 And you can use Scalpel directly 146 146 00:05:21,930 --> 00:05:23,580 and use it from the command line environment, 147 147 00:05:23,580 --> 00:05:25,440 but it is a lot more complex. 148 148 00:05:25,440 --> 00:05:27,840 But for the exam, you don't need to know how to use Scalpel 149 149 00:05:27,840 --> 00:05:30,240 from the command line or even from the user interface. 150 150 00:05:30,240 --> 00:05:32,340 You just need to know the concept that file carving 151 151 00:05:32,340 --> 00:05:34,650 is used to bring back pieces of a file, 152 152 00:05:34,650 --> 00:05:36,480 or the full file, if you're lucky 153 153 00:05:36,480 --> 00:05:38,943 as evidence in a digital forensics investigation.