Hi there. Today I am going to be showing you how to find files that have been deleted on a storage device (in our case, a flash drive). But before I can show you how to do this, I need to make sure that you are doing it in a digitally safe manner.
To follow along in this tutorial, you will need:
The Demo Version of\\Forensic Toolkit 1.81: Available Here
ThumbScrew Write-blocking freeware: Available Here
A copy of the flash drive we will be analyzing: Coming Soon
_________________________________________________________________________________
For the sake of this exercise, lets use the following scenario:
"A friend of ours, Theseus, has come to us with a concern. He fears that his girlfriend Helen, has been unfaithful to him. He brings us a flashdrive of hers, and asks us to see if we can find anything to confirm his suspicion."
So we begin.
First, we want to activate our write blocking software, ThumbScrew, on the computer we will use for the examination. In our computer's system tray, we click the the Thumbscrew Icon, choosing to make "USB write only"
What this will do is modify our computer's registry to prevent us from accidentally writing to Helen's USB flashdrive when we plug it into our computer. This is important because we want to return the flashdrive in the exact same way we found it. Forensically speaking, we are ensuring that the evidence will not be altered by our investigatory process. Now we can plug in Helen's flash drive.
Next, we need a productive way to look through the flashdrive. We could use Windows Explorer, but without special forensic software, our analysis options are very limited.
We will use Forensic Tool Kit. At the opening screen, we select the option that allows us to go directly into working in FTK.
We go to FILE>ADD EVIDENCE and click NEXT twice.
We will be asked to choose the format of the evidence that you wish to add to the case. We want to select the "Physical Drive" option. Now, we can select Helen's flashdrive.
Once we have selected the flashdrive as evidence, we should see a screen that looks like this:
FTK has taken Helen's flashdrive, and has analyzed and organized all of the files on it. Just one problem though. What files? FTK is reporting "0" for the number of files for every type (with the exception of a few file system folders). It even shows there are no deleted files on the flashdrive.
We double check in Windows Explorer, and sure enough, nothing. It would appear as if Helen's flashdrive is empty. But wait! Before we tell Theseus anything, we need to take a closer look. Doesn't it seem odd that Helen would carry around a flashdrive with nothing on it?
Maybe she wiped or reformatted her flashdrive before Theseus could get a hold of it. After all, Helen is more tech-savvy than most. This would have performed an advanced delete on any files that were on the flashdrive. If there were any incriminating files, they would now be hidden from the flash drive's file directory- and wouldn't appear in any of FTK's categories.
To make sure we aren't missing anything , we need to take a look at the hexadecimal values of the flashdrive's storage space. To do this, select the "Total File Items" pane in FTK, and select the FAT1 storage area. Doing so will display the hexadecimal values for all of the files on Helen's flashdrive. If there is really nothing on the drive, we should see the empty HEX value "00" all of the way through.
We can see that this isn't the case. So we know that Helen tried to get rid of something, But how do we find out what it was?
We can make use of a tool in FTK that specializes in reading this kind of data. The tool is the data carver. To use it, We Select TOOLS>DATA CARVING, and press "okay" to the pop up box that appears. We have just instructed FTK to read and interpret the information that corresponds to files that we cannot see.
Sure enough, the data carving tool produces two files that were previously not view-able a .jpg file and a .pdf file-good thing we double checked. We can view either file by double-clicking.
Judging by the nature of the files, its probably best that we call Theseus and tell him the bad news.
To preserve what we found, FTK allows us to add the carved files to the case, and then export them onto our computer.
________________________________________________________________________
I hope that this blog post has provided you with an insightful-yet easy to follow- guide to doing a basic file restoration from a storage device that has been reformatted. My next post will demonstrate how to crack open a password protected file.
Haha! The premise for this blog is great, and combined with relatively easy to follow instructions this blog is very helpful. Great Job!
ReplyDeleteThanks Mark, my goal was to make this mock investigation a bit more light-hearted than what usually occurs in the digital forensics profession. Glad you enjoyed it.
DeleteThis is a really cool topic. I loved your mythological examples presented in the blog post. Will this also work if the flash drive or drive in question was formatted with a complete format rather than a quick format? Is there anything that can keep my data protected from these methods (are programs like TrueCrypt secure?) I would love to try this myself once I get the time!
ReplyDeleteI'm glad that the combination of mythology and computer forensics mixed well for you.
ReplyDeleteFor your first question, my answer is that it depends. If the OS that was used to do the FULL partition was something beyond Windows XP, the OS actually takes the time to rewrite every sector on the drive with a "0", meaning that the data would actually be deleted from the drive, and not just hidden from the file system directory. We wouldn't have the ability to use the method in this blog post. However, in the world of computer forensics, data recovery techniques are always developing. There is an extensive process that allows for data recovery-even from a full re-format. Such a process is very expensive and time consuming, and is almost never done outside of major criminal and national security cases.
For your concern with your personal data, I like to think of it as a balance between the level of security you want over your files v.s. the level of accessibility you need to them. In general, the two have an inverse relationship. In general, programs like TrueCrypt will do a good job of keeping the weekend investigator or nosy significant other away from your files. However, don't put too much faith in such encryption tools when it comes to the professional level. Files that are encrypted with TrueCrypt passwords are usually detected by programs like the one used in this blog. After that, the investigator can subject the file to countless "brute force" password attacks- an attack where essentially every possible combination of characters is tried against a file in rapid succession. Additionally, I believe that TrueCrypt stores its passwords in RAM, when one of its encrypted files are selected. There are many success stories from forensic teams that use a firewire cable to do a live dump of a computer's RAM, and then "dig: through the RAM to find the TrueCrypt password hashes they need.
In short, the only way to be absolutely sure that no one will ever access your files is to delete them using a DOD standard wipe. Of course, your data will be gone, but like I said- its a balance between security and accessibility.