NTFS File System and Data Security

Yanhui Tu
KingSoft
 Index
1 File System kernel analysis
2 Stream and Data security
3 Data recover
4 Date overwrite
NTFS File System Analysis
• File
• There are 2 different kinds
• Metafiles: user can’t access
• User files: User data
 NTFS File System Analysis
• NTFS meta file
Metadata Function
$MFT MFT itself
$MFTMirr Part image of MFT
$LogFile Log file
$Volume Volume file
$AttrDef Attribute definition list
$Root root directory
$Bitmap Bitmap file
$Boot Boot file
$BadClus Bad cluster file
$Quota（NTFS4） Quota file
$Secure Secure file
$UpCase Capitalized file
$Extend Metadata Extended Metadata directory
directory
$Extend\$Reparse Reparse Points file
$Extend\$UsnJrnl Log changing file
$Extend\$Quota Quota management file
$Extend\$ObjId Object ID file
 NTFS File System Analysis
• $MFT（Master File Table ）
• Includes all information about files, and these
information called attributes
• The NTFS file system contains a file called the master file
table, or MFT. There is at least one entry in the MFT for
every file on an NTFS file system volume, including the
MFT itself
 NTFS File System Analysis
Normal file MFT
Š MFT header
Š 10H
$STANDARD_INF
ORMATION
Š 30H
$FILE_NAME
Š 80H $DATA and
$BITMAP
Š MFT End
NTFS File System Analysis
Resident attribute
and non-resident
attribute
Š Resident attribute
save data in file data
area
Š Non-resident
attributes saved in
MFT
NTFS File System Analysis
Directory’s MFT
Š MFT header
Š 10H（STANDARD
INFORMATION）
Š 30H（File Name）
Š 90H（Index Root ）
Š A0H（ Index
Allocation）
Š B0H（BitMap
Š MFT END
NTFS File System Analysis
Structure of file
index
• Index header
（every 4KB index
block has a file
index header.）
• Index item（every
item record a
file’s filename，
MFT number,
parent directory
MFT number etc. ）
 NTFS File System Analysis
• $LogFile’s
MFT
log file’s
structure is
very
complicated
and it’s
structures
details are still
unknown
 NTFS File System Analysis
• $LogFile log
file
log file’s
structure is very
complicated and
it’s structures
details are still
unknown, we
only know it’s
separated into
many 4k blocks
and each block
start with RCRD
NTFS File System Analysis
• $LogFile log
file
recorded a
example of
file
rename
 NTFS File System Analysis
• Volume
file
• Label in
offset 60H
NTFS File System Analysis
• $AttrDef
file
• List of record all
attributes
NTFS File System Analysis
• Content
of
$AttrDef
• Records all
attributes
definition
NTFS File System Analysis
• “.” file
（root）
• Root of
directory tree
NTFS File System Analysis
• 90H
attribute
of root
directory
NTFS File System Analysis
• $Bitmap
file
NTFS File System Analysis
• Content of
$Bitmap
file
NTFS File System Analysis
• $Boot file
MFT
 NTFS File System Analysis
• Content of
$Boot
NTFS File System Analysis
• Content of
$Boot
 NTFS File System Analysis
• $UpCase
file MFT
NTFS File System Analysis
• Content of
$UpCase
file
 NTFS File System Analysis
• $BadClus
file MFT
• It maintains a
list of bad
clusters on the
drive.
Stream and Data Security
• Put file in
stream
 Stream and Data Security

• 29A released a stream based virus

at 2000
• Currently no Anti-virus support
stream scaning in China
Stream and Data Security
• Stream
in disk
Stream and Data Security
• Stream in
disk
 and Data Security Stream

• Stream
can put in
directory
 Stream and Data Security
• API designed for stream
programing
• 1、Travel ：
– FindFirstStreamW and FindNextStreamW
（Win2003server）
– BackupRead 和BackupSeek（Win2000）
• 2、Delete：
– DeleteFile
• And if you can access stream without
above APIs with knowledge of NTFS data
structure
 Data Recover
• Normally, user access
files by using file system,
these files store on user’s
hard disk and organized
by file system and supply
files to users.
• What users see are only
files, users don’t care
about how these file
stored in disk, they can
use commands supplied
by OS to read and write
files, but if one of data or
file system is corrupted
user can’t access files
anymore.
 Data Recover
• When file system is corrupt, we have 2
methods to recover data.
• First method: Rebuild this file
system ,fix corrupt part, and system
can access this file system normally
and recover the lost data. For
example: When hard disk’s partition
table is corrupt, we can rebuild
partition table to recovery data; If
some partitions can’t access normally,
we can rebuild BPB to fix that. This
method is suitable for repairing
some of key data, only need very
small data of rebuild.
• Second method: Rebuild lost
data to files from source devices.
When try to rebuild some extremely
unstable file system, like file data
unsure before corrupted, or need large
mount of data writing. This method
is suitable for recovering deleted
files, partition format scenarios.
 File Recover
• Scenario：When files deleted or
format but not destroyed file data
just deleted some file information
on file system and release file
spaces.
 File Deleting Processing
• Deleting file in FAT
• 1、Replace first byte of directory’s
filename area to E5H
• 2、Mark this directory to unused
 File Deleting Processing
• Deleting file in NTFS
• When deleting a file in NTFS need 3
changes:
– 1. There is a byte at offset 16H of this
file’s MFT header. If 0 means this file is
deleted, 1 means this file is using, 2
means this is a directory, 3 means this
directory is deleted;
– 2. Parent directory attribute INDEX_ROOT
（90H）or attribute INDEX_ALLOCATION
（A0H）；
– 3. Set 0 to file’s corresponding bits in
$Bitmap.
 Recover Demo
• FAT recover demo
• 1、Locate file directory items
• 2、Analysis directory items
• 3、Locate data area
• 4、Save recovered file
 Recover Demo
• NTFS label recover
• 1、locate file MFT
• 2、MFT attribute analysis
• 3、locate date erea
• 4、Save recovered file
•
Data Overwrite
（DoD ）5220.22-M
• a. Degauss with a Type I degausser
• b. Degauss with a Type II degausser.
• c. Overwrite all addressable locations with a single character.
• d. Overwrite all addressable locations with a character, its
complement, then a random character and verify. THIS METHOD
IS NOT APPROVED FOR SANITIZING MEDIA THAT CONTAINS TOP
SECRET INFORMATION.
• e. Overwrite all addressable locations with a character, its
complement, then a random character.
• f. Each overwrite must reside in memory for a period longer than
the classified data resided.
• g. Remove all power to include battery power.
• h. Overwrite all locations with a random pattern, all locations with
binary zeros, all locations with binary ones.
• i. Perform a full chip erase as per manufacturer's data sheets.
• j. Perform i above, then c above, a total of three times.
• k. Perform an ultraviolet erase according to manufacturer's
recommendation.
• l. Perform k above, but increase time by a factor of three.
• m. Destroy - Disintegrate, incinerate, pulverize, shred, or melt.
• n. Destruction required only if classified information is contained.
 Data Overwrite
Media Clear Sanitize

Magnetic Tape1

Type I a or b a, b, or m

Type II a or b b or m

Type III a or b m

Magnetic Disk

Bernoullis a, b, or c m

Floppies a, b, or c m

Non-Removable Rigid Disk c a, b, d , or m

Removabel Rigid Disk a, b, or c a, b, d , or m

Optical Disk

Read Many, Write Many c m

Read Only m, n

Write Once, Read Many (Worm) m, n

 Data Overwrite
Media
Memory
Dynamic Random Access memory
(DRAM)
Electronically Alterable PROM
(EAPROM)
Electronically Erasabel PROM
(EEPROM)
Erasable Programmable (ROM
(EPROM)
Flash EPROM (FEPROM)
Programmable ROM (PROM)
Magnetic Bubble Memory
Magnetic Core Memory
Magnetic Plated Wire
Magnetic Resistive Memory
Nonvolatile RAM (NOVRAM)
Read Only Memory ROM
Static Random Access Memory
(SRAM)
• http://www.zdelete.com/dod.htm
Clear Sanitize
c or g c, g, or m
i j or m
i h or m
k l, then c, or m
i c then i, or m
c m
c a, b, c, or m
c a, b, e, or m
c c and f, or m
c m
c or g c, g, or m
m
c or g c and f, g, or m
 D or E level of Overwrite

• Method 1：
• 1、Open file
• 2、Write file
• 3、Close file
• Features：Simple but not safe
 D or E level of Overwrite
• Method 2：
• 1、Locate file’s MFT or Index in file
system
• 2、Locate file’s physical address in
disk3、Write disk
• Features：Complex（need very deep
knowledge in file system and disk
structure）、Safe（can make sure
overwrite on same place of file）
 References
• 涂彦晖 戴士剑. 《数据安全与编程技术》.
北京：清华大学出版社，2005
• 戴士剑 涂彦晖. 《数据恢复技术》（第2
版）.北京：电子工业出版社，2005
Thank
YOU!