File System, Imaging and Recovery Tools

What it is

These are the core tools of an examination: copy the evidence without changing it, prove the copy matches, then read the file systems and recover what was deleted or lost. The investigator works on the copy, never on the original.

The exam asks which tool performs a task and which category it belongs to.

How it works

File system analysis tools

TSK commands include mmls (partition layout), fsstat (file system details), fls (list files, including deleted ones), istat (inode or MFT record details) and icat (extract a file by inode).

mmls disk.dd
fls -r -o 2048 disk.dd
icat -o 2048 disk.dd 1234 > recovered.bin

The offset 2048 is the partition start sector reported by mmls.

File format analyzing tools

These identify and inspect files by content. Hex editors (HxD, 010 Editor, Hex Workshop), the Linux file command, ExifTool for metadata, and signature based identification in suites.

Volatile and non volatile acquisition tools

Acquire volatile data before powering off, following the order of volatility. Disk images are written in raw (dd), E01 (EnCase) or AFF formats.

Data acquisition validation tools

Validation proves the copy equals the source. Compute a hash of the source and of the image and compare. Tools: the built in verify of FTK Imager and EnCase, md5sum and sha256sum on Linux, Get-FileHash in PowerShell, and HashMyFiles. Use SHA-256 where possible because MD5 and SHA-1 have known collision weaknesses.

sha256sum disk.dd
Get-FileHash -Algorithm SHA256 .\disk.dd

eDiscovery tools

eDiscovery collects, processes and produces electronically stored information for legal matters. The EDRM model stages are information governance, identification, preservation, collection, processing, review, analysis, production and presentation. Platforms include Relativity, Nuix, Exterro and Logikcull. They support legal holds, deduplication, search, review and production.

Digital forensic imaging solutions

Hardware imagers copy drives at high speed with built in write protection: Tableau, Logicube Falcon and Atola imagers. Hardware write blockers sit between the evidence drive and the examiner computer. Software imaging uses a read only mount plus a tool such as FTK Imager.

Tools for examining images

Mount images read only. FTK Imager mounts on Windows. On Linux use a loop device with the ro option, or tools like ewfmount for E01 images. On macOS, use hdiutil with read only options. Autopsy and other suites open image files directly.

sudo mount -o ro,loop,offset=1048576 disk.dd /mnt/evidence

The offset is the partition start in bytes (2048 sectors of 512 bytes is 1,048,576).

Tools for carving files

Carving recovers files from unallocated space using signatures, without file system metadata.

Carved files lose names and timestamps, and fragmented files may come out incomplete.

Partition recovery tools

When a partition table is damaged or deleted, tools search for file system structures. TestDisk finds lost partitions and rebuilds the table. Others are Active@ Partition Recovery and EaseUS Partition Recovery. Work on an image, not the original disk.

A worked example

An examiner receives a USB drive. A hardware write blocker is attached, FTK Imager creates an E01 image, and the verify step shows source and image hashes match.

The examiner then runs mmls to see a deleted partition, uses TestDisk on a copy to restore it, and carves JPEG files from unallocated space with PhotoRec.

How the exam asks about this

• "Which tool is the graphical front end for The Sleuth Kit?" → Autopsy.
• "Which tool finds lost partitions and repairs the table?" → TestDisk.
• "Which technique recovers files without file system metadata?" → File carving.