Frag find - Revision history

Simsong: /* AVAILABILITY */

2013-04-06T18:09:19Z

‎AVAILABILITY

Simsong at 01:50, 1 June 2010

2010-06-01T01:50:16Z

Simsong at 23:31, 1 March 2009

2009-03-01T23:31:07Z

Simsong at 23:26, 1 March 2009

2009-03-01T23:26:09Z

Simsong: New page: frag_find is a program for finding blocks of a TARGET file in a disk IMAGE file. This is useful in cases where a TARGET file has been stolen and you wish to establish that the file has be...

2009-03-01T23:25:40Z

New page: frag_find is a program for finding blocks of a TARGET file in a disk IMAGE file. This is useful in cases where a TARGET file has been stolen and you wish to establish that the file has be...

New page

frag_find is a program for finding blocks of a TARGET file in a disk
IMAGE file. This is useful in cases where a TARGET file has been
stolen and you wish to establish that the file has been present on a
subject's drive. If most of the TARGET file's sectors are found on the
IMAGE drive---and if the sectors are in consecutive sector
runs---then the chances are excellent that the file was once there.

The idea of using individual sector hashes in this manner has been
discussed in the forensic community for several years. Frag_find is an
efficient and easy-to-use tool that perform this process.

frag_find relies on two observations about files and file systems:

# Most file systems tend to block-align files stored within the file system. So if you break up an 8K file into 16 different 512-byte blocks, then store that file in a file system, it's likely that those 16 different "file blocks" will be stored each in its own individual disk sector.
# Most 512-byte blocks within most files are "unique" --- that is, they do not appear by chance in other files. This is especially true for files that are compressed (like zip and docx files) and files that are encrypted. It is less true of files such as Microsoft Word doc files that are likely to have one or more blocks filled with NULLs or some other constant.

frag_find deals with the problem of non-unique blocks by looking
for runs of matching blocks, rather than individual blocks.

frag_find is fast because:

* Initial filtering of presence/absence is done using the NPS Bloom filter implementation, an efficient memory-mapped Bloom implementation designed to be used with hash functions.
* Hashes are stored in efficient C++ structures.
* All computations are done in binary, rather than hex.

==OPTIONS==

The following options are available:
-b blocksize - sets the blocksize (default is 512 bytes).
-s <start> - start the image scan at <start> (default is start
of image)
-e <end> - stop the image scan at <end> (default is end of image)
-r - prints the raw association map, in addition to the cleaned one

==MEMORY USAGE==

frag_find uses 512MB of RAM for the Bloom filter, approximately 1MB
of RAM for bookkeeping, and roughly 64 bytes for every block of the
target file.

==AVAILABILITY==

frag_find is part of the NPS Bloom package, which can be downloaded
from http://www.afflib.org/.

The current version is:

http://www.afflib.org/downloads/bloom-1.0.0.tar.gz

Just type ./configure && make && make install

==LICENSE==
The NPS Bloom Filter implementation is Public Domain.

← Older revision		Revision as of 23:31, 1 March 2009
Line 1:		Line 1:
		+	{{Infobox_Software \|
		+	name = frag_find \|
		+	maintainer = [[Simson Garfinkel]] \|
		+	os = {{Linux}}, {{MacOS}}, {{FreeBSD}} \|
		+	genre = [[Carving]] \|
		+	license = {{Public Domain}} \|
		+	website = http://www.afflib.org/
		+	}}
		+
		+
		+
	frag_find is a program for finding blocks of a TARGET file in a disk		frag_find is a program for finding blocks of a TARGET file in a disk
	IMAGE file. This is useful in cases where a TARGET file has been		IMAGE file. This is useful in cases where a TARGET file has been

@@ Line 47: / Line 47: @@
 ==AVAILABILITY==
-frag_find is part of the NPS Bloom package, which can be downloaded
+* Download: http://digitalcorpora.org/downloads/frag_find
-from http://www.afflib.org/.
+* github: https://github.com/simsong/frag_find

@@ Line 10: / Line 10: @@
-frag_find is a program for finding blocks of a TARGET file in a disk
+frag_find is a program for finding blocks of one or more MASTER files in a disk IMAGE file.  This is useful in cases where a MASTER file has been stolen and you wish to establish that the file has been present on a subject's drive. If most of the MASTER file's sectors are found on the IMAGE drive---and if the sectors are in consecutive sector runs---then the chances are excellent that the file was once there.
-IMAGE file.  This is useful in cases where a TARGET file has been
 stolen and you wish to establish that the file has been present on a
-subject's drive. If most of the TARGET file's sectors are found on the
 IMAGE drive---and if the sectors are in consecutive sector
 runs---then the chances are excellent that the file was once there.
-The idea of using individual sector hashes in this manner has been
+The idea of using individual sector hashes in this manner has been discussed in the forensic community for several years. Frag_find is an efficient and easy-to-use tool that perform this process.
 discussed in the forensic community for several years. Frag_find is an
 efficient and easy-to-use tool that perform this process.
 frag_find relies on two observations about files and file systems:
@@ Line 50: / Line 43: @@
 of RAM for bookkeeping, and roughly 64 bytes for every block of the
 target file.
@@ Line 57: / Line 49: @@
 frag_find is part of the NPS Bloom package, which can be downloaded
 from http://www.afflib.org/.

@@ Line 15: / Line 15: @@
 # Most 512-byte blocks within most files are "unique" --- that is,  they do not appear by chance in other files. This is especially   true for files that are compressed (like zip and docx files) and    files that are encrypted. It is less true of files such as    Microsoft Word doc files that are likely to have one or more    blocks filled with NULLs or some other constant.
-    frag_find deals with the problem of non-unique blocks by looking
+frag_find deals with the problem of non-unique blocks by looking    for runs of matching blocks, rather than individual blocks.
-    for runs of matching blocks, rather than individual blocks.