Download Version 2 - Linux LEO

v. 3.78 The Law Enforcement and Forensic Examiner's Introduction to Linux root@rock:~/ntfs_pract # istat -o 59 ntfs_pract.dd 112
MFT Entry Header Values:
Entry: 112
Sequence: 2
$LogFile Sequence Number: 4201668
Not Allocated File
Links: 2
$STANDARD_INFORMATION Attribute Values:
Flags: Archive
Owner ID: 0
Created:
Sat Apr 7 00:52:53 2007
File Modified:
Sat Oct 14 10:37:13 2006
MFT Modified:
Sat Apr 7 00:52:53 2007
Accessed:
Sat Apr 7 20:00:04 2007
$FILE_NAME Attribute Values:
Flags: Archive
Name: bandit-streetortrack2005056.jpg
Parent MFT Entry: 110
Sequence: 1
Allocated Size: 0
Actual Size: 0
Created:
Sat Apr 7 00:52:53 2007
File Modified:
Sat Apr 7 00:52:53 2007
MFT Modified:
Sat Apr 7 00:52:53 2007
Accessed:
Sat Apr 7 00:52:53 2007
Attributes:
Type: $STANDARD_INFORMATION (16-0)
Type: $FILE_NAME (48-3)
Name: N/A
Type: $FILE_NAME (48-2)
Name: N/A
Type: $DATA (128-4)
Name: $Data
60533 60534 60535 60536 60537 60538
60541 60542 60543 60544 60545 60546
60549 60550 60551 60552 60553 60554
60557 60558 60559 60560
Name: N/A
Resident
size: 72
Resident
size: 90
Resident
size: 128
Non-Resident
size: 112063
60539 60540
60547 60548
60555 60556
The information istat provides us from the MFT shows values directly from the $STANDARD_INFORMATION attribute (which contains the basic meta data for a file), the $FILE_NAME attribute and basic information for other attributes that are part of an MFT entry. The data blocks that contain the actual file content are listed at the bottom of the output (for Non­Resident data).
Take note of the fact that there are two separate attribute identifiers for the $FILE_NAME attribute, 48­3 and 48­2. It is interesting to note we can access the contents of each attribute separately using the icat command. The two attributes store the DOS (8.3) filename and the Win32 (long) file name. By piping the output of icat to xxd we can see the difference. By itself, this may not be of much investigative interest, but again we are illustrating the capabilities of the Sleuthkit tools.
Barry J. Grundy
166