Windows File Systems

Windows File Systems

• 1.
  Windows File Systems
• 2.
  Exploring Microsoft FileStructures • In Microsoft file structures, sectors are grouped to form clusters • Storage allocation units of one or more sectors(blocks) • Clusters range from 512 bytes up to 32,000 bytes each • Combining sectors minimizes the overhead of writing or reading files to a disk • Clusters are numbered sequentially starting at 0 in NTFS and 2 in FAT • First sector of all disks contains a system area, the boot record, and a file structure database • OS assigns these cluster numbers, called logical addresses • Sector numbers are called physical addresses • Clusters and their addresses are specific to a logical disk drive, which is a disk partition
• 3.
  Disk Partitions • Apartition is a logical drive • Windows OSs can have three primary partitions followed by an extended partition that can contain one or more logical drives • Question: How many partitions on a Linux drive? • Hidden partitions or voids are known as Partition gap • Unused space between partitions
• 4.
  Disk Partitions • Thepartition table is in the Master Boot Record (MBR) • Located at sector 0 of the disk drive • MBR stores information about partitions on a disk and their locations, size, and other important items • In a hexadecimal editor, such as HxD, you can find the first partition at offset 0x1BE • The file system’s hexadecimal code is offset 3 bytes from 0x1BE for the first partition
• 5.
  Examining FAT Disks •File AllocationTable (FAT) • File structure database that Microsoft originally designed for floppy disks • FAT database is typically written to a disk’s outermost track and contains: • Filenames, directory names, date and time stamps, the starting cluster number, and file attributes • Three current FAT versions • FAT16, FAT32, and exFAT (Xbox systems) • Cluster sizes vary according to the hard disk size and file system
• 6.
  Examining FAT Disks •Microsoft OSs allocate disk space for files by clusters • Results in drive slack • Unused space in a cluster between the end of an active file and the end of the cluster • Drive slack includes: • RAM slack – Space between end of file and sector • File slack – Space between end of file and end of cluster • An unintentional side effect of FAT16 having large clusters was that it reduced fragmentation • As cluster size increased
• 7.
  Examining FAT Disks •When you run out of room for an allocated cluster • OS allocates another cluster for your file, which creates more slack space on the disk • As files grow and require more disk space, assigned clusters are chained together • The chain can be broken or fragmented • When the OS stores data in a FAT file system, it assigns a starting cluster position to a file • Data for the file is written to the first sector of the first assigned cluster • When this first assigned cluster is filled and runs out of room • FAT assigns the next available cluster to the file • If the next available cluster isn’t contiguous to the current cluster • File becomes fragmented
• 8.
  Deleting FAT Files •In Microsoft OSs, when a file is deleted • Directory entry is marked as a deleted file • With the HEX E5 character replacing the first letter of the filename • FAT chain for that file is set to 0 • Data in the file remains on the disk drive • Area of the disk where the deleted file resides becomes unallocated disk space • Available to receive new data from newly created files or other files needing more space • Sdelete from sysinternals removes files from unallocated space.
• 9.
  Examining NTFS Disks •NT File System (NTFS) • Improvements over FAT file systems • NTFS provides more information about a file • NTFS gives more control over files and folders • NTFS was Microsoft’s move toward a journaling file system • It records a transaction before the system carries it out • NTFS results in much less file slack space • Clusters are smaller for smaller disk drives • NTFS also uses Unicode • An international data format (Encoding Scheme) • On an NTFS disk • First data set is the Partition Boot Sector • Next is Master FileTable (MFT)
• 10.
  NTFS System Files •MFT contains information about all files on the disk • Including the system files the OS uses • Each file in an NTFS volume has a record in the MFT • In the MFT, the first 15 records are reserved for system files • Records in the MFT are called metadata
• 11.
  MFT and FileAttributes • In the NTFS MFT • Begins after the Partition table • All files and folders are stored in separate records of 1024 bytes each • Each record contains file or folder information • This information is divided into record fields containing metadata • A record field is referred to as an attribute ID • File or folder information is typically stored in one of two ways in an MFT record: • Resident - Files less than or equal to 512 bytes are stored inside the MFT • Nonresident - Files larger than 512 bytes are stored outside the MFT • Question: What address is stored for file location if it is nonresident? • Each MFT record starts with a header identifying it as a resident or nonresident attribute • First 42 bytes contains the File Record Header (file or dir, in use or deleted, allocated size, resident or non-resident)
• 12.
  Resident File inMFT Record
• 13.
  Non-Resident File inMFT Record
• 14.
  MFT Record AttributeInformation
• 15.
  MFT $SIA • Allrecords have a $STANDARD_INFORMATION_ATTRIBUTE • 72 Bytes Contains the 64bit timestamps for MAC • Written in UTC • Times do not always match the activity • NTFS delays writing the last accessed time to improve disk performance • Registry key: • HKLMSYSTEMCurrentControlSetControlFilesystemNtfsDisableLastAccessUpdate =1 • Values stored in the $SIA can be an Indicator of Compromise (IOC) • Question:Why would the $SIA values indicate a compromise?
• 16.
  MFT $FNA • Allhave a $FILE_NAME_ATTRIBUTE • 66 Bytes of metadata plus the filename • Contains a reference to the parent directory
• 17.
  NTFS Data Streams •Each file can contain multiple streams • Similar to a DVD with multiple language tracks • Used to store additional file attributes • Developed to convert between NTFS and HFS file systems, since mac file systems store data as a data and resource fork. • Not displayed inWindows Explorer • Show as attribute 0x80 in the record
• 18.
  Deleting NTFS Files •When a file is deleted inWindows NT and later • The OS renames it and moves it to the Recycle Bin • Files deleted from the CLI are marked as unallocated and not places in the Recycle Bin • Can use the Del (delete) MS-DOS command • Eliminates the file from the MFT listing in the same way FAT does
• 19.
  Understanding Microsoft StartupTasks • Learn what files are accessed when Windows starts • This information helps you determine when a suspect’s computer was last accessed • Important with computers that might have been used after an incident was reported • When you start aWindows XP NTFS workstation, several files are accessed immediately • The last access date and time stamp for the files change to the current date and time • Destroys any potential evidence • Startup Files for Windows: • The Ntldr program inWindows XP used to load the OS has been replaced with these three boot utilities: • Bootmgr.exe • Winload.exe • Winresume.exe
• 20.
  Summary • The MasterBoot Record (MBR) stores information about partitions on a disk • When files are deleted in a FAT file system, the Greek letter sigma (0x05) is inserted in the first character of the filename in the directory • NTFS is more versatile because it uses the Master FileTable (MFT) to track file information • Records in the MFT contain attribute IDs that store metadata about files • Analysis of MFT can provide indicator of compromise (IOC) • File slack, RAM slack, and drive slack are areas in which valuable information can reside on a drive