{"id":795,"date":"2020-03-07T20:48:33","date_gmt":"2020-03-07T19:48:33","guid":{"rendered":"https:\/\/privat.andreas-klingler.de\/itsec\/?p=795"},"modified":"2025-03-20T13:47:11","modified_gmt":"2025-03-20T12:47:11","slug":"file-systems","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=795","title":{"rendered":"File systems"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">ext3\/ext4<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Design prin\u00adci\u00adples:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Data blocks are close\u00adly togeth\u00ader due to per\u00adfor\u00admance reasons.<\/li>\n\n\n\n<li>Impor\u00adtant meta data is stored mul\u00adti\u00adple&nbsp;times.<\/li>\n\n\n\n<li>Meta\u00adda\u00adta of files and direc\u00adto\u00adries is stores in an index node (inode). A inode con\u00adtains meta data (own\u00ader, group, per\u00admis\u00adsions, \u2026) and a ref\u00ader\u00adence to data blocks.&nbsp;<ul class=\"wp-block-list\">\n<li>inode = 2 =&gt; root directory<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Superblock:\n<ul class=\"wp-block-list\">\n<li>A block only with con\u00adfig\u00adu\u00adra\u00adtion data like num\u00adber of blocks in the filesys\u00adtem, num\u00adber of blocks pro block&nbsp;group,&nbsp;\u2026<\/li>\n\n\n\n<li>Is stored mul\u00adti\u00adple times on a filesystem.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Block group:\n<ul class=\"wp-block-list\">\n<li>A large area on the filesys\u00adtem. Ext tries to store all blocks of a file in the same block group due to (<span class=\"caps\">HDD<\/span>\u2026) per\u00adfor\u00admance reasons.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>When a file is delet\u00aded, ext over\u00adwrites direct\u00adly the address of an inode with zero and sets the changed data to the delete data. This makes it hard\u00ader to retrieve delet\u00aded&nbsp;data.&nbsp;<ul class=\"wp-block-list\">\n<li>In <span class=\"caps\">NTFS<\/span>, the file\u00adname is stored in the <span class=\"caps\">MFT<\/span> mas\u00adter file table. In ext, the file\u00adnames are not in the inodes and can there\u00adfore not nec\u00ades\u00adsary be recov\u00adered when files \/ data was par\u00adtial\u00adly delet\u00aded. File carv\u00ading can then be&nbsp;used.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Process:\n<ul class=\"wp-block-list\">\n<li>The sys\u00adtem opens inode = 2 for the root directory.<\/li>\n\n\n\n<li>This con\u00adtains a&nbsp;list:&nbsp;<ul class=\"wp-block-list\">\n<li>0 0 0600 etc&nbsp;400<\/li>\n\n\n\n<li>0 0 0777 tmp&nbsp;500<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>The user wants to open tmp. Then, the sys\u00adtem reads the inode at posi\u00adtion&nbsp;500.<\/li>\n\n\n\n<li>This inode&nbsp;has&nbsp;<ul class=\"wp-block-list\">\n<li>1000 1000 0644 file.txt 6330<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>If the user wants to access the file at posi\u00adtion 6330, the sys\u00adtems loads the mem\u00ado\u00adry from this position.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Jour\u00adnal\u00ading\n<ul class=\"wp-block-list\">\n<li>Since ext3<\/li>\n\n\n\n<li>Changes are logged before the action was per\u00adformed on the file system.<\/li>\n\n\n\n<li>Only when the action was logged and com\u00admit\u00adtet, then the changes were applied on the filesystem.<\/li>\n\n\n\n<li>Show the jour\u00adnal:<br><code>jls -o 4096 ext_image.img<\/code><\/li>\n\n\n\n<li><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Information about the file system<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Gen\u00ader\u00adal information<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">fsstat \/dev\/sda1<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Infor\u00adma\u00adtion of an inode (2 = root directory):<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">istat \/dev\/sda1 2<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Get the par\u00adti\u00adtions of an&nbsp;image<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">mmls server.img<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">mmls shows the start off\u00adset of each par\u00adti\u00adtion. Show details of the par\u00adti\u00adtion which starts at&nbsp;4096:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">fsstat -o 4096 server.img<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Show all files of a partition:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">fls -o 4096 server.img &gt; \/tmp\/server_files.txt<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Cre\u00adate a time\u00adlime of cre\u00adat\u00aded files from the filesystem:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">fls -pro 4096 -rm '\/' server.img &gt; bodyfile.txt<br>mactime -b bodyfile.txt -d -h &gt; timeline.txt<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Get the con\u00adtent of a file. Assume, we found this in the body\u00adfile. Here, we have also the&nbsp;inode.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">0|\/etc\/ssh\/sshd_config.d\/hardening.conf|<strong>13437<\/strong>|r\/rrw-r--r--|0|0|...<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">We can now use the inode to get the file&nbsp;info:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">istat -o 4096 server.img 13437<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">And we cat get the (ascii) file&nbsp;with<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">icat -o 4096 server.img 13437<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Tip: If you are ana\u00adlyz\u00ading an image, try to get inodes in a sim\u00adi\u00adlar range. If you have an inter\u00adest\u00ading file, e.g. a mal\u00adware file, try to get inodes a bit before and after\u00adwards. Maybe there are oth\u00ader files which were cre\u00adat\u00aded in the same&nbsp;time.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Recovering data<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Try <a href=\"http:\/\/extundelete.sourceforge.net\/\">extun\u00addelete<\/a> to recov\u00ader&nbsp;files.&nbsp;<ul class=\"wp-block-list\">\n<li>extun\u00addelete \/dev\/sda1 \u2013restore-file \/tmp\/<span class=\"caps\">SSH<\/span>\/file<\/li>\n\n\n\n<li>extun\u00addelete \/dev\/sda1 \u2013restore-direc\u00adto\u00adry \/tmp\/<span class=\"caps\">SSH<\/span>\/<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">base64 search<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Use <a href=\"https:\/\/github.com\/heyitsmikeyv\/base64-keystrings\">GitHub \u2014 hey\u00aditsmikeyv\/base64-keystrings: Find key search strings to locate base64-encod\u00aded ver\u00adsions of <span class=\"caps\">ASCII<\/span> strings.<\/a> to search also for base64 strings.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>ext3\/ext4 Design prin\u00adci\u00adples: Infor\u00adma\u00adtion about the file sys\u00adtem Gen\u00ader\u00adal infor\u00adma\u00adtion fsstat \/dev\/sda1 Infor\u00adma\u00adtion of an inode (2 = root direc\u00adto\u00adry): istat \/dev\/sda1 2 Get the par\u00adti\u00adtions of an&nbsp;image mmls server.img mmls shows the start off\u00adset of each par\u00adti\u00adtion. Show details of the par\u00adti\u00adtion which starts at&nbsp;4096: fsstat \u2011o 4096 server.img Show all files of&nbsp;a&nbsp;[\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[468],"tags":[201,202,203,200],"class_list":["post-795","post","type-post","status-publish","format-standard","hentry","category-general","tag-ext3","tag-ext4","tag-extundelete","tag-file-systems"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/795","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=795"}],"version-history":[{"count":15,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/795\/revisions"}],"predecessor-version":[{"id":4784,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/795\/revisions\/4784"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=795"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=795"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=795"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}