File System Forensics

Imagine this. You're watching a crime drama, right, and the detective they're dusting for fingerprints. Classic stuff.

Yeah, you see it all the time, but honestly.

In the real world today that's almost quaint, like a rotary phone. Today, the fingerprints, they're digital and they're.

Everywhere, absolutely everywhere.

We're talking the smartphone in your pocket, the sat NAV in your car, even your home CCTV that's running twenty four to seven. These digital traces, they used to be just for specific cybercrimes, but now now they're found in almost every case. It's not just evidence anymore. It's really an explosion of it.

It truly is. The sheer amount and well the variety of digital devices mean pretty much any incident, you know, from a minor theft all the way up to a major criminal investigation, it leaves a digital footprint something that wasn't even really conceivable a few decades back, exactly.

And for you listening in this deep dive, it's your shortcut to getting properly well informed about this hidden world. We're not just going to scrap it's the surface of what information is found, No, definitely not. Our mission here is to pull back the curtain on how it stored, how it gets retrieved, and maybe most importantly, why understanding those hidden mechanics, Well, why it fundamentally reshapes an investigation and maybe even our idea of digital truth.

Yeah, and our deep dive today it's built from sources that really focus on file system forensics. So we're going to give you a detailed look at how data is organized write down at its most fundamental level. We'll look at the essential tools investigators used to uncover it and the fascinating, sometimes pretty complex challenges that lie ahead in this field because it's evolving so fast.

Okay, so we've painted this picture digital evidence exploding everywhere. But here's where it starts to get tricky. The very basic rules for collecting this evidence they've been shifting under our feet. Let's dig into what we're calling the shifting sands of digital evidence, because what worked maybe ten years ago could actually compromise an entire case.

Now, that's right.

For years, the standard advice for seizing a computer and an investigation was just dead simple, pull the plug, just cut the power immediately. Yep, that was the gold standard.

But today doing that can be a huge mistake. Why is that old rule suddenly so well dangerous.

What's fascinating, I think is that modern operating systems, in hardware, they've introduced features that directly conflict with that old advice. Think of it like this. For encrypted storage, right, the decryption keys often only live in the computer's volatile memory. It's RAM, basically, it's short term digital brain. Okay, So you pull the plug, those keys just vanish instantly, and all that data becomes a locked box, you know, permanently inaccessible.

Right gone forever. And people aren't just saving things locally anymore, are they. They're using remote storage, cloud services, email, social.

Media constantly connects.

So if you yank the power, all those live connections, all that access to potentially crucial data, it's instantly.

Lost, exactly. And this is why live data forensics or LDF has become so critical. It lets analysts capture that live data from a running computer system before it disappears. But hang on, that sounds like it completely contradicts one of the most fundamental principles of forensics, doesn't it.

It absolutely does, And this raises a really critical point. The first principle in digital forensics. It's often called ACPO principle one. It states that no action taken by law enforcement agencies should change data which may subsequently be relied upon in court. Okay, LDF, well, it inherently breaks this principle. I mean, even just moving a mouse on a running system leaves digital traces. So the tension there, it's very real.

So, Okay, if you're altering the data, how on earth can it be admissible in court? Doesn't that just open the evidence up to immediate challenge, Say you changed it?

Well, not necessarily the principles themselves, they're actually still fit for purpose, but they kind of adapt. So while LDF does alter data, it can be admissible in court when you combine it with ACPO principle two, which emphasizes investigator competence, and principle three, which demands a really thorough audit trail.

Ah okay, the paperwork.

Essentially, yeah, it means every single step taken, every command run, every change made, it has to be meticulously documented. And it's that meticulous record keeping that allows the court to understand and hopefully trust, the context of the altered data. The integrity of the whole investigation now relies on understanding that fundamental shift in collection and then just rigorously documenting every single step.

Right. Speaking of integrity, let's talk about maybe an unsung hero of digital forensics. Linux. It's often called an open source powerhouse in this field. But what does open source actually mean? Is it just about software you don't have to pay for.

That's a common misconception. To really get open source, it helps to contrast it with closed source software. So imagine I write a simple Hello World program and see.

Right, okay.

With closed source, i'd give you the compile executable file. You can run it, sure, but you can't see the underlying code. You can't change it. It's like a mystery box that just well does its thing right.

You just trust it works exactly.

With open source, though, I give you the actual c program file, the source code. You can read it, you can understand exactly what it does, and you can even modify it if you've got the skills. Richard Stallman, the founder of the Free Software Foundation. He famously said that free in open source means free as in free speech, not free as in free beer.

Ah. That's a great distinction.

It is so while it's often free of costs because of the lightnsing, the core idea is really the freedom to examine, use, and modify the code.

That distinction is key. So why is this open source model, particularly Linux, such an advantage for forensics. It seems a bit counterintuitive that something anyone can tinker with would be more trustworthy.

Maybe well, it's precisely because anyone can modify it, or at least examine it, that it's often seen as more trustworthy. There are a few big reasons. First, there's community power. Open source projects often have these huge communities of users, developers, testers, all working together. This collective effort often leads to new features being introduced faster and crucially, issues being resolved much quicker than with small proprietary teams.

So it's not just about speed then, does that community scrutiny also directly help with the trustworthiness and accuracy of the tools, which must be absolutely paramount when potentially lives depend on them.

That's exactly it. More eyes on the code, more brain solving problems. This leads directly to greater trust and correctness. With closed source software, you're essentially relying on the developers having got everything right, and we've all seen the infamous blue screen of death in Windows. For example, With open source, the community can review and fix the code at any point. That provides a lot more confidence in the tool's accuracy, which, as you say, is vital when people's lives might depend

So when we talk about Linux as an operating system, what are its main parts? You hear about the kernel, but what else makes it a functioning OS?

Yeah, good question. At its very heart is the kernel, which was created by Linus Torvold's that's the bit that directly controls the hardware and manages the software. Then layered on top of that are the GNU utilities. These are standard programs that let users control files, run programs, that sort of thing. It's really the combination of the Linux kernel and these GENU utilities that forms the functional operating

Okay, let's get practical then. What are some basic, really fundamental forensic commands in Linux that investigators are using day to day. These must be like the digital equivalent of a magnifying glass and dusting powder.

Definitely, one of the most fundamental is hashing. This is absolutely crucial for ensuring data integrity.

Okay, how did that work? Well?

Hashing algorithms like say MD five or the Saha family. They create a unique digital fingerprint for any piece of data. If even a single bit is changed in a file, its hash value will change traumatically. It's like if you change just one letter in the entire collected works of Shakespeare, the hash would completely change instantly, confirming even the tiniest alteration.

Wow. So if someone sends you a file and you calculate its hash, you can instantly verify it hasn't been tampered with since they calculated their ash. Yeah, that's powerful.

It is very powerful. Now. While some smaller hashes like CRC threety two maybe can sometimes experience hash collisions, that's where different inputs accidentally produce the same hash, using larger outputs like SAHA five twelve, or maybe using multiple different algorithms together, that greatly reduces that probability to almost zero.

Got it? What else?

Another really useful tool is hex viewers like XXD. This lets analysts examine raw binary data, bite by byte, things like a discs partition table for example. It's like looking at the absolute purest form of the computer's language, the ones and zeros represented compactly. This often requires root access, though, using the pseudo command.

Okay, and then there's strings I've heard that's a really really powerful one for investigators. What makes it so special? It really is?

The strings command is deceptively simple but incredibly useful. It displays all the printable as key carecharacters it finds within any file, even binary file, so even.

In like an image file or a program exactly.

Even if a file is an image or an executable program, strings can pull out any plain text that happens to be embedded within it. And when you combine it with EGREP for text searching, it becomes a very powerful forensic tool for quickly finding keywords or phrases within potentially massive amounts of raw data. That sounds incredibly useful, and the AT option is particularly useful. It displays the bite offset,

So it's not just about finding a keyword, it's about the context, seeing what's around it. I imagine that's crucial when you're dealing with huge amounts of data where a word might appear harmlessly in one place, but maybe sinatraily in another, all hidden away in binary code.

Precisely, it's not just finding the needle in the haystack. It's like finding a specific pollen grain on that needle, and it's precise digital address. It's truly granular work.

That's incredible. Okay, that's a great segue into understanding the hidden language, how computers speak in ones and zeros. I mean, at the end of the day, it's all just zeros and ones, right, But how do they turn that into something we actually understand, like text or numbers.

It is all zeros and ones. But how those zeros and ones are interpreted? That's the key. Computers, as you say, use the binary number system base two. Humans we generally use decimal base ten, but in computing you'll very often encounter hexadecimal or hex, which is base sixteen. It uses the digits zero through nine and then the letters A through F to represent the values ten to fifteen. Hexadeesimal is simply a much more compact way to represent binary data for human eyes.

Okay, so it's like a shorthand exactly.

For example, the binary number ten eleven that's one zero, one one is equivalent to eleven in our decimal system. In hex, it would be b. It just makes reading long strings of binary data much easier.

Okay, that makes sense. Then there's text. My computer understands what I type, But how does it turn the letter a into numbers and then back again.

Ah, that's where character encodings come in. They basically assign a unique numerical code to each character. Letter's numbers, symbols everything like a secret codebook kind of Older encodings like ASE and ISO eight eight five nine, they were quite limited. They worked well for English, but struggled with special characters like maybe the A character in Spanish or other European languages. They simply didn't have enough codes assigned for every symbol used across.

The world, Which is where Unicode and UTF eight step in, I guess correct.

Unicode is this huge standard that supports a vast range of characters from pretty much all the world's writing systems. It covers virtually every character you could imagine, and UTF eight is a specific encoding method for Unicode. It's a variable width encoding, which cleverly solves the storage inefficiency you'd get if every single character took up say four bites. UTF eight uses anywhere from one to four bytes per character, so it adapts exactly. This makes it the de facto

That's smart. And what about time? How do computers keep track of that down to the you know, the millisecond or even nanosecond, which must be crucial for an investigation and timeline.

Time representation in computing is another fascinating area. Many systems, especially Unix like systems like Linux and mac os, use what's called Unix time.

Right, I've heard of that.

It's measured as a number of seconds that have elapsed since midnight UTC on January first, nineteen seventy. That specific moment is known as the epoch.

Okay, so just a big counter of seconds. But what if two things happen really fast, like within the same second, would they have the exact same time stamp? That could be a real problem for investigators trying to figure out the exact order of events, especially if automated processes are involved.

It absolutely could be, and it was a limitation. While maybe not an issue for things happening at human speed, automated processes can access or modify many files within a single second. This meant older filesystems like say x two to two, which only had second level granularity, couldn't always definitively say which isn't happened first if they occurred in the same second.

So how do they fix that?

Well, most modern implementations of UNIX time, like you find in the XT four filesystem, for example, they now include a nanosecond subcomponent. Nanosecond yeah, billions of a second. This significantly improves the granularity, allowing for incredibly precise ordering of events and file creation timestamps that can be absolutely crucial for building an accurate forensic timeline.

That's a huge leap in precision. Okay, one more weird term before we move on. Indian thiss. That sounds like something out of Gulliver's Travels or I don't know, a really obscure technical debate. What's that about?

Huh? It does sound a bit strange, doesn't it, But it's actually crucial for correctly interpreting raw Heck's data off a disc. Indianness is just about the order in which computers store or read multi byte numbers. Okay, how so imagine writing down a date. Do you write month, day year like in the US or day month year like in Europe. It's the same information, right, just a different order.

Gotcha.

Computers have a similar choice for numbers. Big Indian is like writing one twenty three. The most significant bite, the one hundred's part, comes first. Little Indian, which is more common on PCs, is like writing three twenty one. The least significant bite, the ones part, comes first.

So why does that matter for forensics?

Because if you pull raw data off a disc, maybe from a critical system boot file or a timestamp field, and you don't know the reading order, the indianness of the system that wrote it, you'll completely misinterpret what those bites actually report. It could be the difference between seeing December fifth and May twelfth in a critical timestamp, just based on reading the bytes in the wrong order.

Okay, crucial detail. Then, with that secret language sort of decoded, let's zoom out a bit from the individual bits and bytes to the actual landscape where all this data lives. We're moving to the disks, partitions, and file system fundamentals, the very architecture of digital storage. Starting with how computers organize information physically, What are the different types of storage and which ones are most relevant for forensics?

Right? Computer storage is usually classified into a few tiers, primary, secondary, tertiary, and offline. Primary storage is typically RAM random access memory, and the key thing about RAM is that it's volatile, meaning all the information stored in it is lost as soon as the power is removed. This is exactly why

Stuff you lose if you just pull.

A plug precisely. Then you have secondary storage. This includes your traditional hard disk drives HDDs and the now very common solid state drives SSDs. This is where most of our persistent data resides, the stuff that stays when the power is off.

And SSDs would you're everywhere now. Because they're so fast and efficient, they bring their own unique forensic headaches, don't they. I've heard they can be kind of a forensic investigator's nightmare compared to the old spinning hard drives.

They absolutely do post some unique SSD specific challenges because of how they work fundamentally differently from HDDs see. Unlike HDDs, the flash memory components inside an SSD can only be written to a limited number of times before they wear out, so to extend the drives lifespan, the SSD controller employs

So the controller is shuffling data behind the.

Scenes exactly, which makes predicting the precise physical location of a specific piece of data for forensic analysis much harder. You can't just assume data stays put in one physical spot like you mostly could on an HDD.

So data might not be where the operating system thinks it is. That sounds like a constant game of digital hide and seek.

It can be, and it gets worse even more critically when the operating system marks data as unallocated, which happens when you delete a file. Modern SSDs use a function called trim. The OS basically tells the SSD controller, Hey, we don't need the data in these.

Blocks anymore, and the controller.

The controller can then internally mark those blocks for erasure, often almost immediately, as part of its garbage collection routines. This means that deleted files are much less likely to be present and recoverable on SSDs than on traditional HDDs, where the data just sat there until overwritten.

Wow, so deleting really means deleting much more often on ans sat often.

Yes, And here's the real kicker for forensics. These SSD controllers run their garbage collection routines in the background while the drive is powered on. This means that potentially data is changing on the device in question, even if it's just sitting there, plugged in as evidence doing nothing.

From the OS perspective, WHOA, So the evidence is potentially altering itself.

Exactly, which, as you can imagine, directly breaks the principle of not altering evidence. It's a fundamental conflict that investigators have to be acutely aware of when dealing with SSDs.

That's a huge, huge challenge to the core ideas of forensics. Okay, so physical discs, whether HDD or SSD, they're often divided into partitions. Why do we do that? What's the purpose of these logical divisions?

Partitions are essentially logical divisions of a single physical disc. They allow that one physical disc to be split into multiple logical areas, each of These areas can then contain a different file system or even a different operating system. For you might have one partition for Windows and another for Linux on the same drive, or maybe a separate partition just for your user data.

Okay, and there are different ways these partitions are laid out on the disc. Right, Like MBR versus GPT. What's the practical difference there for someone investigating a system.

Yes, MBR Master Boot Record and GPTGII Partition Table are the two main schemes used to define how partitions are organized on a disc. MBR is the older standard. GPT is more modern and allows for well far more partitions on a single disk, and also provides greater space for storing partition information compared to the very limited.

Space in the MBR, so more robust.

Generally, Yes, For an investigator, knowing which scheme is used tells you where to look on the disc for critical boot information and how that disc is logically structured overall.

Got it. Let's zoom in again now to the core filesystem concepts. These are the real nuts and bolts of how files actually live on a disc, and understanding them can reveal hidden data. What's a cluster or block, and why does that basic unit mate or so much?

Right? A cluster, sometimes called a block, is the basic, smallest allocatable unit of storage within a file system. Think of it like building blocks. Even if you have a tiny file that's only say, one byte in size, the filesystem has to alligate an entire cluster to store it. That cluster might be, for instance, forty ninety six bytes, so.

One byte of data, except forty ninety six bytes of.

Space exactly the remaining forty ninety five bytes in that cluster. The space between the end of the actual file data and the end of the cluster. That's known as slack space.

And that's interesting because.

Because this slack space isn't necessarily empty, it can contain data from previous files that happen to occupy this cluster before the current file was written there. It might hold fragments of old documents, emails, chatlogs, religual evidence that was never fully overwritten. It can be a real gold mine for investigators.

Wow, okay, and unallocated space. That sounds like just empty space, But I have a feeling it's not always truly empty either.

You're right, it often isn't. Unallocated space is simply disk space that isn't currently assigned to any active file by the filesystem. But crucially, when a file is deleted, especially on older hgds, less so on trim abled SSDs, its content often isn't wiped immediately. The space is just marked as available. The actual data might still be physically present in that unallocated space, just waiting to be overwritten by new data eventually.

Which is why you need a full copy exactly.

This is precisely why forensic investigators always aim to create a bit by bit image of the device. This ensures that all the unallocated space is captured and can be analyzed later. If you just copied the active files, you'd miss all that potential evidence of deleted but still recoverable files.

Makes sense, What about file fragmentation? Does that just make file slow to load or does it complicate forensics too?

File fragmentation happens when there isn't a single large enough continuous area on the disc to store an entire file when it's first written or when it grows, so the file system has to split the file into multiple pieces or fragments, and store them in different physical locations on the disc. Okay, while it can definitely affect performance for forensics. It means that to recover or analyze that file, you first have to find and correctly reassemble all those scattered fragments.

It adds complexity, right, and something called copy on write or COWW. That sounds like maybe a way to preserve data rather than lose it.

It is in a way copy on righte. COWW is a strategy used in many modern file systems like APFS and others. When a resource like a file block is about to be modified. Instead of overwriting the original data directly, the filesystem first makes a copy of the original block and then writes the changes to the new block.

Ah, so the old version sticks around for a while.

Potentially yes, it means the original data might still be present somewhere on the disc, offering the potential to discover earlier versions of artifacts or files. This is also fundamental to how filesystem snapshots work. The preserve a view of the filesystem at a specific point in time by referencing these older, unmodified blocks. These snapshots are great for backups but also incredibly valuable for forensic analysis to see what the system look like at a previous state.

Very cool. Finally, in this section, what's RAID? I usually hear that mentioned in the context of big server storage or maybe backups.

RAID stands for a redundant array of independent discs. It's a technology that combines multiple physical disc drives into a single logical unit that the operating system sees as one big disc.

Why do that?

It can be done for various reasons. Sometimes it's just to create one large, consolidated filesystem from several smaller discs. That's RAID zero, which focuses on performance or size but offers no redundancy. Or more commonly, it's done for redundancy and fault tolerance. For instance, RAD one marrors data exactly across two or more drives. If one fails, the data is safe on the other. RAT five uses parity information striped across drives, allowing for a single drive to fail without any data.

Loss and for forensics.

For forensics, analyzing a RATE array means understanding how the data is striped or mirrored across those multiple physical discs. You often need to image all the member discs and then use specialized software to reconstruct the original logical volume before you can even start analyzing the filesystem on top of it. It adds another layer of complexity.

Fascinating. Okay, let's move on and take a quick tour of con file systems. These are like the different languages or organizational schemes and operating systems used to manage all these bits, bytes, clusters and partitions we've been talking about. We'll start with the old, reliable FAT and its newer cousin x fat sure.

The FAT file Allocation Table filesystem is well, very old and relatively simple in its structure. It basically consists of only three main components, the boot sector, the file allocation table itself which tracks cluster usage, and the directory entries. Because of its simplicity and wide compatibility, you still find it very commonly on removable media like USB drives and older SD cards, but it.

Had limitations, especially with file size.

Big Time FAT thirty two, the most common version, famously had a four gigabyte limit for single files, which is tiny by today's standards. That's where x fat comes in. It's a newer file system, also for Microsoft, designed specifically for larger removable media. Like modern high capacity SD cards and USB drives.

What's the key difference?

A key improvement is its support for much larger files. XPECT can handle files up to theoretically one hundred and twenty eight petabytes that's pb, which is enormous. It achieves this partly by using eight byte values to store file sizes compared to FAT thirty two's four byte values, so it's much better suited for things like large video files on flash drives.

Okay, then there's the standard for Windows for a long time now and TFS. What are it is? Defining features? What makes it such a robust system? And what kind of hidden details might it hold for investigation? Right?

NTFS New Technology Filesystem has been the default for Windows for decades now, and it's a much more complex and robust filesystem than FAT. One key feature is journaling.

What does that do?

Journaling means the filesystem records pending changes to its metadata in a log or journal before actually committing those changes to the main filesystem structures. This makes NTFS much more fault tolerant. If the system crashes mid operation, it can use the journal to recover and ensure the filesystem structure remains consistent reducing the risk of data corruption.

That sounds important very.

NTFS also supports something called alternate data streams or ADS. This allows multiple separate streams of data to be associated with a single.

File name like hidden attachments.

Kind of Yeah, the main file data is in one stream, but you can attach other hidden streams. These aren't always visible through standard tools like Windows Explore, so they have sometimes been used to hide information maybe malware components or other data. Instigators definitely need to check for ADS.

So it's like a hidden digital tag or a secret compartment within a file. Have investigators found surprising ways these ADS are used, maybe to trace a file's origin absolutely.

For example, a common ADS you might encounter, maybe without realizing it, is the zone dot identifier. Windows often automatically attaches this stream to files downloaded from the Internet, and it records information like the original URL it came from. That can be crucial evidence for tracing malware or suspicious documents back to their source.

Interesting. What else is key in NTFS?

Well, the heart of NTFS is the Master Filetable or MFT. Think of it as a highly detailed database or library catalog for every single file and folder on the volume. Each file has an entry in the MFT.

And what information is in that entry.

Lots of metadata. It stores file attributes, including things like objectives. These are unique identifiers UUIDs that can act like digital fingerprints, potentially linking a file back to the specific computer it was a real created on, even if the file itself has been copied around. It includes creation time stamps and even the m MASS address of the network card of the creating machine sometimes WOW. And the MFT also holds

Okay, moving across to the Linux world, now we have the EXT family of filesystems. How has that evolved over the years and what does the latest version XT four offer investigators?

Right, the EXT family is native to Linux. It started with X two, which was simpler and stored file metadata in structures called inodes. Each file or directory has an inode containing information like permissions, time stamps, and pointers to the actual data blocks.

But X two lacks something important, Right?

Yes, X two lacked journaling, making it vulnerable to corruption if the system crashed during rites. So X three was developed and its main addition was journaling, providing that resilience similar to NTFS. X three also introduced h tree directory indexing, which was a significant performance improvement, allowing directories to efficiently handle millions of files, overcoming a major limitation of X two for large file systems.

And X four is the modern standard now right, what really makes it stand out? Especially for forensics?

Yes, xdoor is the default for many Linux distributions today and brought several important X to four innovations. One major change was the introduction of extents. Instead of using individual block pointers for large files, extends to find a starting block and a length, making storage much more efficient for large contiguous files and simplifying.

Recovery any other key features Yeah.

Another one is inline storage for very small files, X four can actually store the file's data directly within the inode structure itself, saving space and eliminating the need for separate data blocks entirely all interesting and crucially for investigators. XT four dramatically improved timestamp granularity down to nanosecond precision. It also officially added support for a file creation timestamp sometimes called cre time or b time, which was often

Nine seconds again, okay, finally in our tour, Apple's next generation system, APFS. How does that compare? Especially given Apple's big focus on security and user privacy.

APFS Apple filesystem was introduced relatively recently to replace their older HFS plus filesystem on macOS iOS and other Apple devices. A big architectural change was moving to sixty four bit enodes. This vastly increases the theoretical number of files possible on a volume compared to HFS plus tin essential for handling the massive amounts of data on modern devices.

Makes sense. What about features?

Well? APFS was designed with modern hardware like SSD's and mind. It features robust built in encryption, which can be applied at the whole disc level or even per file. This obviously makes forensic analysis much more challenging if you don't have the decryption keys, a.

Big hurdle definitely.

However, APFS also has really robust snapshot creation capabilities built in. These are used by time Machine for backups, but they also mean that older versions of the filesystem state might be easily accessible, which can be very useful for forensic analysis, allowing you to roll back and see previous file versions or system.

States interesting, anything else unique.

One other notable feature is space sharing. In APFS, multiple logical volumes can exist within a single physical container and share the underlying free space. This is flexible for users, but can make tracking exact data allocation and free space a bit more complex for forensic analysis compared to traditional fixed partitions.

Wow, it's a lot of complex hidden infrastructure under the hood. So how do investigators actually get to all this data, these bits bytes in odes, MFT records without altering the original evidence or causing more problems like those SSD changes. What's in the investigator's toolkit acquiring and analyzing digital evidence right?

The first and absolutely critical step is forensically sound acquisition. The goal here is to create a perfect copy of the original storage device without changing the original in any way.

How do they guarantee that?

Primarily through the use of right blockers. These can be specialized hardware devices that sit between the investigator's computer and the evidence drive, physically preventing any right commands from reaching the evidence, or they can be software based, like specific settings and Linux that mount a device and read only mode. At a very low level, the idea is to put that fragile artifact, the original drive, in a protective glass case, metaphorically speaking, before you even begin to study it.

Okay. Essential step and a core Linux command for making that copy is DAD. I hear. That's incredibly powerful, but maybe a little dangerous if you're not careful.

Yes. The AAD command is a classic, very powerful Linux tool for creating raw images, which are exact bit by dick copies of a device or partition. It's sometimes nicknamed data destroyer if you mix up the input and output. Uh hot, Yeah, you have to be careful, but used correctly, it copies everything every sector, including all the unallocated space and slack space we talked about earlier, which is vital.

Okay, So once they have that pristine, forensically sound image, that bit for bit copy, how do they start actually picking it apart finding those hidden files, deleted remnants, or specific pieces of metadata.

That's where analysis tools come in. A very widely used suite, especially in the open source world, is the sleuth kit, often abbreviated as TSK.

Okay, what does that do?

TSK is actually a collection of command line tools designed specifically for filesystem forensics. For example, a tool called fusstat can analyze the image and determine the filesystem type NTFS, XT four, FAT, et cetera, and provide overall information about the volume like block size and total blocks, so like an initial assessment exactly. Then there's FLS, which is used

Organized, and getting the actual data for that.

You'd use tools like astat to recover specific file metadata, timestams, permissions, size as block pointers by referencing its inode number or MFT entry id, and then iicat in use to recover the actual file content itself, essentially concatenating together the data blocks associated with that specific file or structure.

So TSK can also help put together timelines and maybe even recover deleted files more automatically.

Indeed, TSK includes tools like mac time, which can parse various timestamps collected from across the filesystem metadata like modified access change times from inodes or MFT entries, and generate

What if the metadata is completely gone, though, the filesystem structures are corrupted, but maybe the raw data for say a picture, is still sitting out there in unallocated space. Ah.

That's where a technique called data carving comes up.

That sounds like digital arc cheology, like trying to reconstruct a shattered vase from its unique edge patterns.

That's a great analogy. Data carving works by bypassing the file system entirely and instead searching for known file signatures directly within the raw data stream of the image. These signatures are unique sequences of bytes that typically mark the beginning header and sometimes the end footer of specific file types. For example, JPEG image files almost always start with the hex bytes zero ox f ft eight and end with zero ox f ft nine, so.

You just scan the whole image for those patterns.

Essentially, yes, carving tools scan the raw data looking for these known headers and footers, and then extract the data in between as a potential file. It's like looking for specific patterns of color and texture to identify pieces of that shattered vase. However, it's important to know that data carving is not fully reliable. Files can be fragmented, meaning the header and footer might be separated. By unrelated data,

Makes sense? Okay? Looking ahead now, with all this technology evolving so incredibly rapidly, SSD's new file systems, encryption, what are some of the biggest things on the horizon future challenges in digital forensics? What keeps investigators up at night?

Well, probably the single biggest challenge is simply the data volume problem. We've seen this vast increase in the quantity of digital evidence phones, with terabies of storage, cloud accounts, IoT devices, it's everywhere, right, This creates a kind of vicious cycle because the resources available for analysis, skilled human analysts,

And new file systems keep popping up too, right, Yeah, constantly changing the rules of the game.

Absolutely. New file systems like APFS when it first appeared, and even Extra four. Historically, they often require significant reverse engineering by forensic researchers, especially if official documentation is scarce or non existent. This takes a huge amount of time and specialized skill, and there's always a risk of misinterpretation, which has obvious implications if the findings are presented in court.

And you mentioned live data forensics earlier LDF, that comes with its own set of ongoing challenges too.

Yes, definitely, Live data forensics revisited is a constant topic. We already talked about how it inherently breaks ACPO Principle one by altering data, making it impossible to realize that principle fully. But there are other.

Risks too, sugg as like the system crashing maybe or that crucial audit trail.

We talked about exactly. System crashes are a real possibility, especially when performing intrusive actions like acquiring the contents of RAM directly, which can sometimes destabilize a running system, and maybe more fundamentally, LDF is inherently non repeatable. Unlike deadbox forensics, where you can rerun analysis commands on a static image multiple times and get the same result, LDF changes the live system with every action. You can't perfectly recreate the state later, so.

The documentation becomes even more critical.

Absolutely paramount that documentation. The ACPO audit trail becomes the only way to verify the process, to show what was done, when and why, because you can't simply rerun the experiment.

Okay, And then there's the elephant in the room for any digital investigation today. Encryption. It's fantastic for user privacy obviously, but it can be a massive hurdle, sometimes a complete dead end for an investigation.

Encryption really is the classic double edged sword. It protects legitimate users privacy and security, which is essential, but it equally protects criminal communications and data from investigators if they can't get the keys.

Are there any proposed solutions?

Well, Ideas like key escro systems have been proposed, where decryption keys would perhaps be held by a trusted third party under specific legal conditions, but these face huge technical and ethical challenges. For one, criminals could simply choose to use other encryption software or methods that aren't part of the escrosystem. And second, there are massive privacy concerns about governments or other entities having potential access to everyone's encrypted data. It's a really difficult balance.

So we're kind of back to square one on that.

In many ways, and many ways yes, it remains a major challenge and finally sort of tying a lot of this together, there's a significant ongoing need for better standardization and tool testing in the field, meaning developing standardized TORBA basically large, well defined data sets of known digital evidence containing specific artifacts. These could then be used to rigorously test and validate the accuracy and reliability of different forensic

Wow, what a journey that was. We've really delved deep into the hit and structures of file systems, haven't we From the absolute basics of bits and bytes, through the intricate designs of different operating system formats like ntfs and XT four and apfs, and then explore the cutting edge techniques investigators use to try and uncover digital truths from all that complexity. It's a world that is just constantly, constantly changing.

It really is. The evolution is relentless. Every new app, every new device, every new way we interact digitally, it creates new challenges, but also potentially new opportunities for digital forensics. And as that digital world keeps expanding, so does this invisible landscape of information hidden beneath our everyday interactions. It's honestly a constant race just to keep up to understand the new hidden languages that are always emerging.

So here's something to think about as we wrap up. Given how deeply digital evidence now intertwines with almost every aspect of our lives, how might our growing understanding of these invisible file systems the stuff we talked about today, How might that reshape the very definition of truth in a modern investigation? And maybe more intriguingly, what new hidden languages, what new forms of digital evidence might emerge next that