Module 2 Part 2

Module – 2
Part – 1
Disk Partition
FAT
1
File Systems

The hard disks and other media provide the
physical space for storing data.

The file system provides the logical structure
of organizing data on a physical drive.

It provides the mechanism to locate data any
where on a given disk or drive.

It provides the hierarchical structure of
directories in which individual files are stored.
Microsoft File Structures
• In Microsoft file structures, sectors are grouped to form clusters

• Storage allocation units of one or more sectors
• Clusters range from 512 bytes up to 32,000 bytes each
• Combining sectors minimizes the overhead of writing or reading files to a disk
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-
3
protected website for classroom use.
Microsoft File Structures
• Clusters are numbered sequentially starting at 0 in NTFS and 2 in FAT

• First sector of all disks contains a system area, the boot record, and a file structure
database
• OS assigns these cluster numbers, called logical addresses
• Sector numbers are called physical addresses
• Clusters and their addresses are specific to a logical disk drive, which is a disk
partition
4
Disk Partitions
5
A hard drive can be divided into 1 or more partitions
that are identified by a letter such as drive 6C: or drive D:
Disk Partitions
• A partition is a logical drive

• Windows OSs can have three primary partitions followed by an extended
partition that can contain one or more logical drives
• Hidden partitions or voids
• Large unused gaps between partitions on a disk
• Partition gap
• Unused space between partitions
7
Disk Partitions
• The partition table is in the Master Boot Record (MBR)

• Located at sector 0 of the disk drive
• In a hexadecimal editor, such as WinHex, you can find the first partition at offset
0x1BE
• The file system’s hexadecimal code is offset 3 bytes from 0x1BE for the first partition
8
The Master Boot Record
Address Description Size (Bytes)
Hex Dec
0x000 0 Bootstrap code area 446
Includes the starting
0x1BE 446 Partition Entry #1 16 LBA and length of the
0x1CE 462 Partition Entry #2 16 partition
0x1DE 478 Partition Entry #3 16
0x1EE 494 Partition Entry #4 16
0x1FE 510 Magic Number 2
Total: 512
Partition 1 Partition 2 Partition 3 Partition 4

Disk 1
MBR
(ext3) (swap) (NTFS) (FAT32)
Disk 2
Partition 1
MBR
(NTFS)
9
Disk Partitions
10
Mounting a File System
1. Read the super block for the target file system
– Contains meta-data about the file system
– Version, size, locations of key structures on disk, etc.
2. Determine the mount point
– On Windows: pick a drive letter
– On Linux: mount the new file system under a
specific directory
Filesystem Size Used Avail Use% Mounted on

/dev/sda5 127G 86G 42G 68% /media/cbw/Data
/dev/sda4 61G 34G 27G 57% /media/cbw/Windows
11
/dev/sdb1 1.9G 352K 1.9G 1% /media/cbw/NDSS-2013
File Allocation Tables (FAT)
• Simple file system popularized by MS-DOS
– First introduced in 1977
– Most devices today use the FAT32 spec from 1996
– FAT12, FAT16, VFAT, FAT32, etc.
• Still quite popular today
– Default format for USB sticks and memory cards
– Used for EFI boot partitions
• Name comes from the index table used to track directories and files
12
Examining FAT Disks
• File Allocation Table (FAT)

• File structure database that Microsoft originally designed for floppy disks
• FAT database is typically written to a disk’s outermost track and contains:
• Filenames, directory names, date and time stamps, the starting cluster number, and
file attributes
• Three current FAT versions
• FAT16, FAT32, and exFAT (used for mobile personal storage devices)
• Cluster sizes vary according to the hard disk size and file system
13
• Stores basic info about the file system
• FAT version, location of boot files
• Total number of blocks
• Index of the root directory in the FAT
• File allocation table (FAT)

• Marks which blocks are free or in-use
• Linked-list structure to manage large files
• Store file and directory data

• Each block is a fixed size (4KB – 64KB)
• Files may span multiple blocks
Super
Disk Block
14
Examining FAT Disks
The various FAT systems are:
FAT12 - used on volumes smaller than 16MB (Floppies)
FAT16 - used on volumes 16MB to 2GB (Hard Drives)
FAT32 - used on volumes 512MB to 2TB (Hard Drives)
15
• Directories are special files
– File contains a list of entries inside
Windows the directory
• Possible values for FAT entries:
C:\ – 0 – entry is empty
Users – 1 – reserved by the OS
– 1 < N < 0xFFFF – next block in a chain
– 0xFFFF – end of a chain
2 3 4 5 6 7 8 9 2 3 4 5 6 7 8 9
Super
Disk Block C:\
Name Index Dir? Perms
Root directory
index = 2 . 2 Y rwx
Windows 3 Y rwx
Users 4 Y rwx 16
Fat Table Entries
• len(FAT) == Number of clusters on the disk
– Max number of files/directories is bounded
– Decided when you format the partition
• The FAT version roughly corresponds to the size in
bits of each FAT entry
– E.g. FAT16  each FAT entry is 16 bits
– More bits  larger disks are supported
17
Fragmentation
• Blocks for a file need not be contiguous
56 57 58 59 60 61 62 63 64 65 67 68
FAT 0 0 65 0 0 0xFF 0 58 0 67 61 0
FF
d Sta
En rt
56 57 58 59 60 61 62 63 64 65 67 68
Blocks
Possible values for FAT entries:
• 0 – entry is empty
• 1 < N < 0xFFFF – next block in a chain
• 0xFFFF – end of a chain
18
FAT: The Good and the Bad
• The Good – FAT supports:
– Hierarchical tree of directories and files
– Variable length files
– Basic file and directory meta-data
• The Bad
– At most, FAT32 supports 2TB disks
– Locating free chunks requires scanning the entire FAT
– Prone to internal and external fragmentation
• Large blocks  internal fragmentation
– Reads require a lot of random seeking
19
Lots of Seeking FAT may have very low spatial
• Consider the following code: locality, thus a lot of random
seeking
int fd = open(“my_file.txt”, “r”);
int r = read(fd, buffer, 1024 * 4 * 4); // 4 4KB blocks
56 57 58 59 60 61 62 63 64 65 67 68
FAT 67 0xFF 0 0xFF 63 0 56 57 0 0 59 60

FF FF
56 57 58 59 60 61 62 63 64 65 67 68
Blocks
20
Examining FAT Disks
• Microsoft OSs allocate disk space for files by clusters

• Results in drive slack
- Unused space in a cluster between the end of an active file’s content and the end of
the cluster
-
• Drive slack includes:

• RAM slack and file slack
• File Slack, also called 'slack space', is the leftover space on a drive where a file is stored
• An unintentional side effect of FAT16 allowing large clusters was that it reduced
fragmentation
• As cluster size increased
21
Examining FAT Disks
22
Examining FAT Disks
• When you run out of room for an allocated cluster

• OS allocates another cluster for your file
• As files grow and require more disk space, assigned clusters are chained
together
• The chain can be broken or fragmented
• When the OS stores data in a FAT file system, it assigns a starting cluster
position to a file
• Data for the file is written to the first sector of the first assigned cluster
23
Examining FAT Disks
24
Examining FAT Disks
• When this first assigned cluster is filled and runs out of room
• FAT assigns the next available cluster to the file
• If the next available cluster isn’t contiguous to the current cluster
• File becomes fragmented
25
Deleting FAT Files
• In Microsoft OSs, when a file is deleted

• Directory entry is marked as a deleted file
- With the HEX E5 character replacing the first letter of the filename
- FAT chain for that file is set to 0
• Data in the file remains on the disk drive
• Area of the disk where the deleted file resides becomes unallocated disk space
• Available to receive new data from newly created files or other files needing more
space
26
Examining NTFS Disks (1 of 3)
• NT File System (NTFS) - New Technology File System

• Introduced with Windows NT
• Primary file system for Windows 10
• Improvements over FAT file systems
• NTFS provides more information about a file
• NTFS gives more control over files and folders
• NTFS was Microsoft’s move toward a journaling file system
• It records a transaction before the system carries it out
• A journaling file system is a file system that keeps track of changes not yet committed
to the file system's main part by recording the goal of such changes in a data structure
known as a "journal"
27
• In NTFS, everything written to the disk is considered a file

• On an NTFS disk
• First data set is the Partition Boot Sector
• Next is Master File Table (MFT)
• NTFS results in much less file slack space
• Clusters are smaller for smaller disk drives
• NTFS also uses Unicode
• An international data format
28
29
NTFS System Files (1 of 3)
• MFT contains information about all files on the disk

• Including the system files the OS uses
• In the MFT, the first 15 records are reserved for system files
• Records in the MFT are called metadata
30
NTFS File System (2 of 3)
32
NTFS File System (3 of 3)
33
MFT and File Attributes (1 of 7)
• In the NTFS MFT

• All files and folders are stored in separate records of 1024 bytes each
• Each record contains file or folder information
• This information is divided into record fields containing metadata
• A record field is referred to as an attribute ID
• File or folder information is typically stored in one of two ways in an MFT
record:
 Resident - files less than 512 bytes
 Nonresident > 512 bytes
• Files larger than 512 bytes are stored outside the MFT
• MFT record provides cluster addresses where the file is stored on the drive’s partition
 This cluster address are referred to as data runs
34
• Each MFT record starts with a header identifying it as a resident or nonresident

attribute
• The first 4 bytes (characters) for all MFT records are FILE
• The header information contains additional data specifying where the first attribute ID
starts, which is typically at offset 0x14 from the beginning of the record
• Each attribute ID has a length value in hexadecimal defining where it ends and where the
next attribute starts
• The length value is located 4 bytes from the attribute ID
35
36
37
38
39
40
• When a disk is created as an NTFS file structure

• OS assigns logical clusters to the entire disk partition
• These assigned clusters are called logical cluster numbers (LCNs)
• Become the addresses that allow the MFT to link to nonresident files on the disk’s
partition
• When data is first written to nonresident files, an LCN address is assigned to the
file
• This LCN becomes the file’s virtual cluster number (VCN)
41
MFT Structures for File Data (1 of 11 )
42
MFT Structures for File Data (2 of 11)
43
44
45
46
47
48
49
50
51
52
Multiple data runs

NTFS Alternate Data Streams (1 of 2)
• Alternate data streams

• Ways data can be appended to existing files
• Can obscure valuable evidentiary data, intentionally or by coincidence
• In NTFS, an alternate data stream becomes an additional file attribute
• Allows the file to be associated with different applications
• Eg: a graphics programcan store a thumbnail image of a bitmap in a named data
stream within the NTFS file containing the image
• You can only tell whether a file has a data stream attached by examining that
file’s MFT entry
57
• Alternate data streams

• Ways data can be appended to existing files
• Can obscure valuable evidentiary data, intentionally or by coincidence
• In NTFS, an alternate data stream becomes an additional file attribute
• Allows the file to be associated with different applications
• Eg: a graphics programcan store a thumbnail image of a bitmap in a named data
stream within the NTFS file containing the image
• You can only tell whether a file has a data stream attached by examining that
file’s MFT entry
• C:\echo text_string > myfile.txt:stream_name
• C:\type textfile.txt > myfile.txt:stream1
• C:\more > myfile.txt:stream1
58
59
NTFS Compressed Files
• NTFS provides compression similar to FAT DriveSpace 3 (a Windows 98

compression utility)
• With NTFS, files, folders, or entire volumes can be compressed
• Most computer forensics tools can uncompress and analyze compressed
Windows data
60
NTFS Encrypting File System (EFS)
• Encrypting File System (EFS)

• Introduced with Windows 2000
• Implements a public key and private key method of encrypting files, folders, or disk
volumes
• When EFS is used in Windows 2000 and later
• A recovery certificate is generated and sent to the local Windows administrator
account
• Users can apply EFS to files stored on their local workstations or a remote
server
61
EFS Recovery Key Agent
• Recovery Key Agent implements the recovery certificate

• Which is in the Windows administrator account
• Windows administrators can recover a key in two ways: through Windows or
from a command prompt
• Commands:
• cipher
• copy
62
Deleting NTFS Files
• Using File explorer, When a file is deleted in Windows NT and later
• The OS renames it and moves it to the Recycle Bin
• Can use the del (delete) MS-DOS command
• Doesn't rename and move to recyle bin, but Eliminates the file from the MFT listing in
the same way FAT does
Tasks during delete

1.Windows changes the filename and moves the file to a subdirectory with a unique identity
in the Recycle Bin.
2.Windows stores information about the original path and filename in the Info2file , which is
the control file for the Recycle Bin. It contains ASCII data, Unicode data, and the date and
time of deletion for each file or folder.
63
Deleting NTFS Files
• Following steps apply when a user empties the Recycle Bin
1. The associated clusters are designated as free—that is, marked as
available for new data.
2. The $Bitmap file attribute in the MFT is updated to reflect the file’s
deletion, showing that this space is available.
3. The file’s record in the MFT is marked as being available.
4. VCN/LCN cluster locations linked to deleted nonresident files are then
removed from the original MFT record.
5. A run list is maintained in the MFT of all cluster locations on the disk for
nonresident files. When the list of links is deleted, any reference to the links
is lost.
NTFS is more efficient than FAT at reclaiming deleted space. Deleted files are overwritten
more quickly
64
Resilient File System
• Resilient File System (ReFS) - designed to address very large data storage needs
• Such as the cloud
• Features incorporated into ReFS’s design:
• Maximized data availability
• Improved data integrity
• Designed for scalability
• ReFS uses disk structures similar to the MFT in NTFS
• Its main intention for storage, so it cannot be used for BOOT drive
• Supported on Window 8/8.1 and above windows server 2012 and above
• its storage engine uses a B+ tree sort method for fast access to large data sets
• It uses a method called “allocate-on-write” that copies updates of data files to new locations,
similar to shadow paging, it prevents overwriting the original data files
• The purpose of writing updates to new locations is to ensure that the original data can be
recovered easily if a failure occurs in the update write to disk
65
In NTFS, file names are limited to 255 characters, while ReFS allows up to
32768 characters in a file name
Solution

WHOLE DISK ENCYRPYION

WDE
Understanding Whole Disk Encryption (1
of 3)
• In recent years, there has been more concern about loss of
• Personal identity information (PII) and trade secrets caused by computer theft
• Of particular concern is the theft of laptop computers and handheld devices
• To help prevent loss of information, software vendors now provide whole disk
encryption
69
of 3)
• Current whole disk encryption tools offer the following features:
 Preboot authentication -single sign-on password, fingerprint scan, or
token (USB device)
• Full or partial disk encryption with secure hibernation
• Advanced encryption algorithms
• Key management function
70
of 3)
• Whole disk encryption tools encrypt each sector of a drive separately
• Many of these tools encrypt the drive’s boot sector
• To prevent any efforts to bypass the secured drive’s partition
• To examine an encrypted drive, decrypt it first
• Run a vendor-specific program to decrypt the drive
• Many vendors use a bootable CD or USB drive that prompts for a one-time
passphrase
71
Examining Microsoft BitLocker
• Available Vista Enterprise/Ultimate, Windows 7, 8, and 10

Professional/Enterprise, and Server 2008 and later
• Hardware and software requirements
• A computer capable of running Windows Vista or later
• The TPM microchip, version 1.2 or newer
• A computer BIOS compliant with Trusted Computing Group (TCG)
• Two NTFS partitions
• The BIOS configured so that the hard drive boots first before checking other bootable
peripherals
73

BitLocker™ Drive Encryption
BitLocker™ Drive Encryption gives you improved data
protection on your Windows Vista and Windows Server
codenamed “Longhorn” systems
Notebooks – Often stolen, easily lost in transit
Desktops – Often stolen, difficult to safely decommission
Servers – High value targets, often kept in insecure locations
All three can contain very sensitive IP and customer data
Designed to provide a transparent user experience that
requires little to no interaction on a protected system
Prevents thieves from using another OS or software hacking
tool to break OS file and system protections
Prevents offline viewing of user data and OS files
Provides enhanced data protection and boot validation
through use of a Trusted Platform Module (TPM) v1.2

TPM Services Architecture
(Simplified)
Feature Map
TPM Admin Third Party
Tools Applications
Windows Vista BitLocker™
Enterprise
Ultimate
TPM WMI Provider TSS*
Windows Vista TPM Base Services

All SKUs
TPM Driver
Trusted Platform
Module (TPM)
*TCG Software Stack

What Is A Trusted Platform
Module (TPM)?
Smartcard-like module on the motherboard
Protects secrets
Performs cryptographic functions
RSA, SHA-1, RNG
Meets encryption export requirements
Can create, store and manage keys
Provides a unique Endorsement Key (EK)
Provides a unique Storage Root Key (SRK) TPM 1.2 spec:
www.trustedcomputinggroup.org
Performs digital signature operations
Holds Platform Measurements (hashes)
Anchors chain of trust for keys
and credentials
Protects itself against attacks

BitLocker™ Drive Encryption Architecture
Static Root of Trust Measurement of boot components

Disk Layout And Key Storage
OS Volume Contains Where’s the Encryption Key?
Encrypted OS 1. SRK (Storage Root Key)
Encrypted Page File contained in TPM
Encrypted Temp Files 2. SRK encrypts FVEK (Full Volume

Encryption Key) protected by
Encrypted Data TPM/PIN/USB Storage Device
Encrypted Hibernation File 3. FVEK stored (encrypted by SRK) on
hard drive in the OS Volume
3
OS Volume
2 
FV 1 
SRK
System EK
System Volume Contains:
MBR, Boot manager, Boot Utilities
(Unencrypted, small)

Spectrum of Protection
BitLocker™ offers a spectrum of
Ease of Deployment / Maintenance

protection, allowing an organization to
customize according to its own needs
TPM Only
“What it is”
TPM + PIN
TPM + USB USB Only “What it is + what
“What it is + what “What you have” you know”
you have” Protects Against: Protects Against:
Protects Against: Protects Against: Many HW attacks Most SW attacks
HW attacks HW attacks Vulnerable To: Vulnerable To:
Vulnerable To: Vulnerable To: Hardware attacks Hardware attacks
Stolen USB key Stolen USB key
No boot validation User Must: User Must:
User Must: User Must: Enter PIN to boot N/A
Protect USB key Protect USB key No user impact
Examining Third-Party Disk Encryption
Tools
• Some available third-party WDE utilities:
• Endpoint Encryption
• Voltage SecureFile
• Jetico BestCrypt Volume Encryption
81

Module 2 Part 2

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Module 2 Part 2

Uploaded by

Copyright:

Available Formats

Module – 2

• In Microsoft file structures, sectors are grouped to form clusters

• Clusters are numbered sequentially starting at 0 in NTFS and 2 in FAT

• A partition is a logical drive

• The partition table is in the Master Boot Record (MBR)

0x1EE 494 Partition Entry #4 16

0x1FE 510 Magic Number 2

Partition 1 Partition 2 Partition 3 Partition 4

Filesystem Size Used Avail Use% Mounted on

• File Allocation Table (FAT)

• File allocation table (FAT)

• Store file and directory data

Name Index Dir? Perms

FAT 67 0xFF 0 0xFF 63 0 56 57 0 0 59 60

• Microsoft OSs allocate disk space for files by clusters

• Drive slack includes:

• When you run out of room for an allocated cluster

• In Microsoft OSs, when a file is deleted

• NT File System (NTFS) - New Technology File System

• In NTFS, everything written to the disk is considered a file

• MFT contains information about all files on the disk

• In the NTFS MFT

• Each MFT record starts with a header identifying it as a resident or nonresident

• When a disk is created as an NTFS file structure

Multiple data runs

• Alternate data streams

• Alternate data streams

• NTFS provides compression similar to FAT DriveSpace 3 (a Windows 98

• Encrypting File System (EFS)

• Recovery Key Agent implements the recovery certificate

Tasks during delete

• Available Vista Enterprise/Ultimate, Windows 7, 8, and 10

Windows Vista TPM Base Services

Encrypted Temp Files 2. SRK encrypts FVEK (Full Volume

Ease of Deployment / Maintenance

You might also like