Difference between pages "Scalpel" and "File Systems"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
 
(Cryptographic File Systems)
 
Line 1: Line 1:
{{Infobox_Software |
+
= Conventional File Systems =  
  name = Scalpel |
+
  maintainer = [[Golden Richard]] |
+
  os = {{Linux}}, {{Windows}}, {{Mac OS X}} |
+
  genre = [[Carving]] |
+
  license = {{Unknown license}} |
+
  website = [http://www.digitalforensicssolutions.com/Scalpel/ digitalforensicssolutions.com/Scalpel/] |
+
}}
+
  
'''Scalpel''' is an [[open source]] program for [[recovering deleted data]] originally based on [[foremost]], although significantly more efficient. Written by [[Golden G. Richard III]] and presented at the [[Digital Forensic Research Workshop|DFRWS]] conference in 2005, it allows an examiner to specify a number of headers and footers to recover filetypes from a piece of media.
+
; ffs
 +
: The Fast File System, a variant of ufs that is faster and supports symbolic links.
  
== External Links ==
+
; ext2fs, ext3
 +
: ext2fs was introduced with Linux. ext3 is a journaled version of ext2 which allows for speedy disk recovery after a crash.
  
* [http://www.digitalforensicssolutions.com/Scalpel/ Official website]
+
; FAT
* [http://dfrws.org/2005/proceedings/richard_scalpel.pdf Scalpel: A frugal, high-performance file carver] from the Proceedings of the 2005 [[Digital Forensic Research Workshop]]
+
: Originally used by MSDOS. Includes FAT12 (for floppy disks), FAT16 and FAT32
 +
 
 +
; NTFS
 +
: The New Technology File System, introduced by Microsoft with Windows NT 4.0. Now used on XP.
 +
 
 +
; ufs
 +
: The Unix File System, introduced with Unix.
 +
 
 +
;
 +
 
 +
 
 +
= Cryptographic File Systems =
 +
Cryptographic file systems encrypt information before it is stored on the media. Some of these file systems store encrypted files directly. Others are better thought of as device drivers, which are then used to store some of the file systems discussed above.
 +
 
 +
; Apple's File Vault
 +
: A clever user interface to Apple's encrypted disk images. Uses the ".sparseimage" extension on disk files.
 +
 
 +
; CFS - Matt Blaze's Cryptographic File System for Unix
 +
: http://www.crypto.com/papers/cfskey.pdf Key Management in an Encrypting File System], Matt Blaze, USENIX Summer 1994 Technical Conference, Boston, MA, June 1994.
 +
: http://www.crypto.com/papers/cfs.pdf A Cryptographic File System for Unix], Matt Blaze, Proceedings of the First ACM Conference on Computer and Communications Security, Fairfax, VA, November 1993.
 +
 
 +
 
 +
; NCryptfs
 +
: http://www.fsl.cs.sunysb.edu/docs/ncryptfs/ncryptfs.pdf NCryptfs: A Secure and Convenient Cryptographic File System ], Charles P. Wright, Michael C. Martino, and Erez Zadok, Stony Brook University ,USENIX 2003 Annual Technical Conference.
 +
 
 +
 
 +
 
 +
; Transparent Cryptographic File System
 +
: http://www.tcfs.it/
 +
 
 +
 
 +
== Full Disk Encryption ==
 +
; Seagate FDE
 +
: http://www.seagate.com/docs/pdf/marketing/PO-Momentus-FDE.pdf
 +
 
 +
; Network Appliance
 +
: http://www.netapp.com/ftp/decru-fileshredding.pdf
 +
 
 +
; Jetico BestCrypt
 +
: http://www.jetico.com/

Revision as of 23:26, 13 November 2005

Conventional File Systems

ffs
The Fast File System, a variant of ufs that is faster and supports symbolic links.
ext2fs, ext3
ext2fs was introduced with Linux. ext3 is a journaled version of ext2 which allows for speedy disk recovery after a crash.
FAT
Originally used by MSDOS. Includes FAT12 (for floppy disks), FAT16 and FAT32
NTFS
The New Technology File System, introduced by Microsoft with Windows NT 4.0. Now used on XP.
ufs
The Unix File System, introduced with Unix.


Cryptographic File Systems

Cryptographic file systems encrypt information before it is stored on the media. Some of these file systems store encrypted files directly. Others are better thought of as device drivers, which are then used to store some of the file systems discussed above.

Apple's File Vault
A clever user interface to Apple's encrypted disk images. Uses the ".sparseimage" extension on disk files.
CFS - Matt Blaze's Cryptographic File System for Unix
http://www.crypto.com/papers/cfskey.pdf Key Management in an Encrypting File System], Matt Blaze, USENIX Summer 1994 Technical Conference, Boston, MA, June 1994.
http://www.crypto.com/papers/cfs.pdf A Cryptographic File System for Unix], Matt Blaze, Proceedings of the First ACM Conference on Computer and Communications Security, Fairfax, VA, November 1993.


NCryptfs
http://www.fsl.cs.sunysb.edu/docs/ncryptfs/ncryptfs.pdf NCryptfs: A Secure and Convenient Cryptographic File System ], Charles P. Wright, Michael C. Martino, and Erez Zadok, Stony Brook University ,USENIX 2003 Annual Technical Conference.


Transparent Cryptographic File System
http://www.tcfs.it/


Full Disk Encryption

Seagate FDE
http://www.seagate.com/docs/pdf/marketing/PO-Momentus-FDE.pdf
Network Appliance
http://www.netapp.com/ftp/decru-fileshredding.pdf
Jetico BestCrypt
http://www.jetico.com/