Question on ext3/ex...
 
Notifications
Clear all

Question on ext3/ext4 filesystem forensics

3 Posts
2 Users
0 Reactions
652 Views
(@alistair)
Eminent Member
Joined: 12 years ago
Posts: 23
Topic starter  

Hello,

I just read the SANS institute paper http//www.sans.org/reading_room/whitepapers/forensics/advantage-ext3-journaling-file-system-forensic-investigation_2011

In summary, the author recovers a deleted file's blocks through the ext3 journal and with the use of dd, manages to recover the entire file (the iNode of the file to be recovered was previously saved to simplify the proof of concept).

My question is, instead of going through this complicated procedure of tracking blocks, couldn't the author have just done a physical acquisition of the partition in question and run a file carving procedure on it?

What are the differences between these two methods?

Thanks!


   
Quote
(@mscotgrove)
Prominent Member
Joined: 17 years ago
Posts: 940
 

Carving does not produce file names, file dates, or handle fragmented files.

Enough differences?


   
ReplyQuote
(@alistair)
Eminent Member
Joined: 12 years ago
Posts: 23
Topic starter  

Quite enough thanks )


   
ReplyQuote
Share: