Difference between pages "New Technology File System (NTFS)" and "Category:Disk imaging"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Transactional NTFS (TxF))
 
(Unix-based imagers)
 
Line 1: Line 1:
The '''New Technology File System''' ('''NTFS''') is a [[file system]] developed and introduced by [[Microsoft]] in 1995 with [[Windows]] NT. As a replacement for the [[FAT]] file system, it quickly became the standard for [[Windows 2000]], [[Windows XP]] and [[Windows Server 2003]].
+
<div style="margin-top:0.5em; border:2px solid #ff0000; padding:0.5em 0.5em 0.5em 0.5em; background-color:#dddddd; align:center;">
 +
'''Note:''' We're trying to use the same [[tool template]] for all devices. Please use this if possible.
 +
</div>
  
The features of NTFS include:
+
'''TODO: Not all of the following are tools, most are simply company names. The tools should have their own articles...'''
  
* [[Hard-links]]
+
= Hardware imagers =
* Improved performance, reliability and disk space utilization
+
; [[DeepSpar Disk Imager]]
* Security [[access control lists]]
+
: Handles Data Recovery Imaging issues, drive instability, and bad sectors. http://www.deepspar.com/products-ds-disk-imager.html  - Data Sheet and Whitepaper available for download from product web page.
* File system journaling
+
; [[ICS Solo3]]
 +
: Supports USB, Firewire and SCSI drives. http://www.icsforensic.com/
 +
; [[Logicube Talon]]
 +
: Supports USB
 +
; [[PSIClone]]
 +
: Built-in PATA, SATA, USB and write blocker. http://www.thepsiclone.com/
 +
: Enhanced Error Handling and Logging
 +
; [[Voom HardCopy III]]
 +
: Allows destination drive to be formatted in NTFS.
  
== Time Stamps ==
+
= Unix-based imagers=
  
NTFS keeps track of lots of time stamps. Each file has a time stamp for 'Create', 'Modify', 'Access', and 'Entry Modified'. The latter refers to the time when the MFT entry itself was modified. These four values are commonly abbreviated as the 'MACE' values. Note that other attributes in each MFT record may also contain timestamps that are of forensic value.
+
; [[ewfacquire]]
 +
: Part of the [[libewf]] library package, [[ewfacquire]] can create evidence files in the EnCase and FTK Imager [[E0*]] (EWF-E01) and SMART s0* (EWF-S01) formats. [[ewfacquire]] calculates an MD5 hash while the data is being acquired. Ewfacquire provides support for byte swapping of media bytes. This is useful for dealing with big endian media on and little endian architectures and vice versa. It also has intelligent error recovery.
 +
:https://libewf.sourceforge.net/
  
Additional information on how NTFS timestamps work when files are moved or copied is available here: [http://support.microsoft.com/kb/299648 Microsoft KB 299648]
+
; [[Adepto]]
 +
: http://www.e-fense.com/helix/
  
=== Changes in Windows Vista ===
+
; [[aimage]]
 +
: Part of the [[AFF]] system, [[aimage]] can create files is raw, AFF, AFD, or AFM formats. AFF and AFD formats can be compressed or uncompressed. [[aimage]] can optionally compress and calculate [[MD5]] or [[SHA-1]] hash residues while the data is being copied. It has intelligent error recovery, similar to what is in [[ddrescue]].
  
In Windows Vista, NTFS no longer tracks the Last Access time of a file by default. This feature can be enabled by the user if desired via setting the registry key 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate' to '0'.
+
; [[AIR]]
 +
: AIR (Automated Image and Restore) is a GUI front-end to dd/dcfldd designed for easily creating forensic bit images.
 +
: http://air-imager.sourceforge.net/
  
== Alternate Data Streams ==
+
; [[dcfldd]]
The '''NTFS''' file system includes a feature referred to as Alternate Data Streams (ADSs).  This feature has also been referred to as "multiple data streams", "alternative data streams", etc.  ADSs were included in '''NTFS''' in order to support the resource forks employed by the Hierarchal File System ([[HFS]]) employed by Macintosh systems.
+
: A version of [[dd]] created by the [[Digital Computer Forensics Laboratory]]. [[dcfldd]] is an enhanced version of [[GNU]] dd with features useful for forensics and security, such as calculating [[MD5]] or [[SHA-1]] [[hash]]es on the fly and faster disk wiping.
  
As of [[Windows XP]] SP2, files downloaded via Internet Explorer, Outlook, and Windows Messenger were automatically given specific "zoneid" ADSs.  The [[Windows]] Explorer shell would then display a warning when the user attempted to execute these files (by double-clicking them).
+
; [[dd]]
 +
: A program that converts and copies files, is one of the oldest [[Unix]] programs. I can copy data from any Unix "file" (including a [[raw partition]]) to any other Unix "file" (including a disk file or a raw partition). This is one of the oldest of the imaging tools, and produces [[raw image files]]. Extended into [[dcfldd]].
  
Sysadmins should be aware that prior to Vista, there are no tools native to the [[Windows]] platform that would allow you to view the existence of arbitrary ADSs.  While ADSs can be created and their contents executed or viewed, it wasn't until the "/r" switch was introduced with the "dir" command on Vista that arbitrary ADSs would be visible.  Prior to this, tools such as [http://www.heysoft.de/Frames/f_sw_la_en.htm LADS] could be used to view the existence of these files.
+
; EnCase [[LinEn]]
 +
: Linux-based version of EnCase's forensic imaging tool.
  
Examiners should be aware that most forensic analysis applications, including [[EnCase]] and ProDiscover, will display ADSs found in acquired images in red.
+
; GNU [[ddrescue]]
 +
: http://www.gnu.org/software/ddrescue/ddrescue.html
  
== Advanced Format (4KB Sector) Hard Drives ==
+
; [[dd_rescue]]
NTFS does not natively handle drives that use the new standard of 4KB sectors. For information on this, see [[Advanced Format]].
+
: http://www.garloff.de/kurt/linux/ddrescue/
 +
: A tool similar to [[dd]], but unlike dd it will continue reading the next sector, if it stumbles over bad sectors it cannot read.
  
== Transactional NTFS (TxF) ==
+
; iLook [[IXimager]]
 +
: The primary imaging tool for [[iLook]]. It is [[Linux]] based and produces compressed authenticatable [[image file]]s that may only be read in the iLook analysis tool.
  
According to [http://msdn.microsoft.com/en-us/library/bb968806%28v=VS.85%29.aspx MSDN] Transactional NTFS (TxF) allows file operations on an NTFS file system volume to be performed in a transaction.  
+
; [[MacQuisition Boot CD]]
 +
: Provides software to safely image [[Macintosh]] drives.
  
Several TxF related file-system-metadata files can be found in the file-system-metadata directory: \$Extend\$RmMetadata\. TxF also uses the MFT attribute $LOGGING_UTILITY_STREAM with the name $TXF_DATA.
+
; [[rdd]]
 +
: http://sourceforge.net/projects/rdd
 +
: Rdd is robust with respect to read errors and incorporates several other functions: MD5 and SHA-1 hashing, block hashing, entropy computation, checksumming, network transfer, and output splitting.
  
TxF uses the [[Common Log File System (CLFS)]]
+
; [[sdd]]
 +
: Another [[dd]]-like tool. It is supposed to be faster in certain situations.
  
== External links ==
+
= Windows-based imagers =
* [http://en.wikipedia.org/wiki/NTFS Wikipedia: NTFS]
+
 
[[Category:Disk file systems]]
+
; [[AccessData]]
 +
: Their ultimate tool lets you "READ, ACQUIRE, DECRYPT, ANALYZE and REPORT (R.A.D.A.R.)."
 +
 
 +
; [[ASR]]
 +
: A tool for [[imaging]] and analyzing disks.
 +
 
 +
; [[DIBS]]
 +
: Can image and convert many file formats. Also builds mobile toolkit.
 +
 
 +
; [[EnCase]]
 +
: Can image with out dongle plugged in. Only images to E0* file.
 +
 
 +
; [[FTK Imager]] by [[AccessData]]
 +
: Can image and convert many image formats. Including [[E0*]] (EWF-E01), s0* (EWF-S01) and [[dd]]. Also a free tool.
 +
 
 +
; [[Ghost]]
 +
: FTK can read forensic, uncompressed [[Ghost image]]s.
 +
 
 +
; [[iLook]]
 +
: The [[IRS]]'s set of forensic tools and utilities.  iLook V8 can image in Windows.
 +
 
 +
; [[Paraben]]
 +
: A complete set of tools for [[Windows]] (and [[handheld]]) products.
 +
 
 +
; [[ProDiscovery]]
 +
: Images and searches [[FAT12]], [[FAT16]], [[FAT32]] and all [[NTFS]] files.
 +
 
 +
; [[X-Ways Forensics]]
 +
: Has some limited imaging capabilities. The output is [[raw format]].
 +
 
 +
; [[X-Ways Replica]]
 +
: Performs [[hard disk]] [[cloning]] and imaging. The output is [[raw format]].
 +
 
 +
 
 +
[[Category:Tools]]
 +
 
 +
[[Category:Tools]]

Revision as of 05:56, 31 January 2009

Note: We're trying to use the same tool template for all devices. Please use this if possible.

TODO: Not all of the following are tools, most are simply company names. The tools should have their own articles...

Hardware imagers

DeepSpar Disk Imager
Handles Data Recovery Imaging issues, drive instability, and bad sectors. http://www.deepspar.com/products-ds-disk-imager.html - Data Sheet and Whitepaper available for download from product web page.
ICS Solo3
Supports USB, Firewire and SCSI drives. http://www.icsforensic.com/
Logicube Talon
Supports USB
PSIClone
Built-in PATA, SATA, USB and write blocker. http://www.thepsiclone.com/
Enhanced Error Handling and Logging
Voom HardCopy III
Allows destination drive to be formatted in NTFS.

Unix-based imagers

ewfacquire
Part of the libewf library package, ewfacquire can create evidence files in the EnCase and FTK Imager E0* (EWF-E01) and SMART s0* (EWF-S01) formats. ewfacquire calculates an MD5 hash while the data is being acquired. Ewfacquire provides support for byte swapping of media bytes. This is useful for dealing with big endian media on and little endian architectures and vice versa. It also has intelligent error recovery.
https://libewf.sourceforge.net/
Adepto
http://www.e-fense.com/helix/
aimage
Part of the AFF system, aimage can create files is raw, AFF, AFD, or AFM formats. AFF and AFD formats can be compressed or uncompressed. aimage can optionally compress and calculate MD5 or SHA-1 hash residues while the data is being copied. It has intelligent error recovery, similar to what is in ddrescue.
AIR
AIR (Automated Image and Restore) is a GUI front-end to dd/dcfldd designed for easily creating forensic bit images.
http://air-imager.sourceforge.net/
dcfldd
A version of dd created by the Digital Computer Forensics Laboratory. dcfldd is an enhanced version of GNU dd with features useful for forensics and security, such as calculating MD5 or SHA-1 hashes on the fly and faster disk wiping.
dd
A program that converts and copies files, is one of the oldest Unix programs. I can copy data from any Unix "file" (including a raw partition) to any other Unix "file" (including a disk file or a raw partition). This is one of the oldest of the imaging tools, and produces raw image files. Extended into dcfldd.
EnCase LinEn
Linux-based version of EnCase's forensic imaging tool.
GNU ddrescue
http://www.gnu.org/software/ddrescue/ddrescue.html
dd_rescue
http://www.garloff.de/kurt/linux/ddrescue/
A tool similar to dd, but unlike dd it will continue reading the next sector, if it stumbles over bad sectors it cannot read.
iLook IXimager
The primary imaging tool for iLook. It is Linux based and produces compressed authenticatable image files that may only be read in the iLook analysis tool.
MacQuisition Boot CD
Provides software to safely image Macintosh drives.
rdd
http://sourceforge.net/projects/rdd
Rdd is robust with respect to read errors and incorporates several other functions: MD5 and SHA-1 hashing, block hashing, entropy computation, checksumming, network transfer, and output splitting.
sdd
Another dd-like tool. It is supposed to be faster in certain situations.

Windows-based imagers

AccessData
Their ultimate tool lets you "READ, ACQUIRE, DECRYPT, ANALYZE and REPORT (R.A.D.A.R.)."
ASR
A tool for imaging and analyzing disks.
DIBS
Can image and convert many file formats. Also builds mobile toolkit.
EnCase
Can image with out dongle plugged in. Only images to E0* file.
FTK Imager by AccessData
Can image and convert many image formats. Including E0* (EWF-E01), s0* (EWF-S01) and dd. Also a free tool.
Ghost
FTK can read forensic, uncompressed Ghost images.
iLook
The IRS's set of forensic tools and utilities. iLook V8 can image in Windows.
Paraben
A complete set of tools for Windows (and handheld) products.
ProDiscovery
Images and searches FAT12, FAT16, FAT32 and all NTFS files.
X-Ways Forensics
Has some limited imaging capabilities. The output is raw format.
X-Ways Replica
Performs hard disk cloning and imaging. The output is raw format.