ISO-9660 file system interpretations in digital forensic investigations

¶ … Systems

COMPUTER SCIENCE

Computer forensic is a scientific method of analyzing the digital information which is used as evidence for the criminal, administrative and civil cases. In the contemporary legal environment, computer forensic has become a vital part in solving the complex crimes. Since computer forensic experts use data to solve high level cases, effective data storage and retrieval is critical aspect of forensic investigation and effective data storage is very essential to assist in achieving the data integrity. ISO9660 file system has become an effective method that forensic experts employ to store and retrieve data. (Dixon, 2005). Preserving and storing the critical data and information without alteration of the original state of data is the most important aspect of Computer Forensics. Some of the techniques employed are by using the ISO9660 file system to store data. It is essential to realize an employee might inadvertently overwrite valuable data. Otherwise, a cyber criminal might plant a program to erase the valuable data. Manipulation of valuable data might make a trained law professional to raise doubt about the validity of evidence presented in the court of law in order to defend a case. (Coward, 2009). To address this problem, ISO9660 file system is generally employed to store data on the CDROMs. While ISO9660 file system stores data on the CDROMs, however, ISO9660 file systems are different in design which allows for different interpretation.

Fundamental objective of this paper is to investigate the method digital forensic interprets ISO9660 ?le system.

The study is structured as follows:

First, the study presents the overview of ISO9660 File Systems. The study also discusses different forensic tools and the evaluation methodology to carry out the different interpretations of ISO9660 File Systems. Finally, the paper presents the evaluation results revealing different interpretations of ISO9660 File Systems.

Overview of ISO9660 File Systems

An ISO9660 ?le system which is often referred as CDFS (Compact Disc File System) is a file system that stores data in block and grouping consecutive sectors. However, ISO9660 file system is different in design which allows for different interpretations. Within the first sector of the ISO9660 volume, there is multiple data structure and directory trees that have ability to store file within the ISO9660 structure. There are also data structure that serves purposely to store file system data in both big-endian byte orderings and little-endian byte orderings.

Generally, ISO9660 store data in consecutive blocks and primarily, ISO9660 ?le systems contains one primary and secondary volume descriptors, and these identify size and layout of the file system. Typically, ISO9660 stores data in block and the block sizes are stored in a volume descriptor. More importantly, ISO9660 supports name that could involve the maximum of 8 Latin characters within the file name and 3 Latin characters within the extension. ISO9660 ?le systems also have Joliet extension that store longer names within the Unicode. The starting block of the root directory within the ISO9960 is listed within the volume descriptor and the directory tree assists in locating a file when opening the root directory. While ISO9660 store files in the big Endian orderings and little Endian orderings, however, data stored within the big Endian orderings is the most significant and big Endian orderings considers the byte within the data first before considering the byte stored within the little-endian ordering.

There are different strategies that Forensic tools employed to hide data. One of strategies is the Endian ordering. The ISO9660 stores data structures in both big- and little-endian orderings and there is ability to hide data if the value of the starting block within the directory entries has different values within the locations of big- and little-endian storage. Typically, if the forensic tool is to carry out the analysis, it only locates one of the locations where the hider's tools use the other, and there is high level of possibility that the hidden data may not be identified. Typically, the starting block within the big-endian ?eld is 0x00000020 while the starting block within the little-endian ordering is 0x00000030. Based on the field structure of endian, the forensic stores data within little- and big endian ordering system which are being used to hide data. (Carrier, 2010). With different methods of designing ISO9660, forensic tools interpret the data within the ISO9660 differently.

Computer Forensic Tools for ISO9660 File Systems

"CFTs (Computer Forensic Tools) assist investigators to recover deleted files, reconstruct an intruder's activities, and gain intelligence about a computer's user." (Garfinkel, 2007 P. 1). CFT assists forensics experts in collecting valuable information from computer system as well as making true copy of the information so that it could be useful in the legal proceedings. Typically, CFT falls into two classes:

Persistent data tools assist in analyzing the data stored within the computer system when computer is turned off. Volatile data tools also analyze information in transitory and information that would have been lost. (Garfinkel, 2007). The paper analyzes different computer forensic tools to present different interpretations of ISO9660 File Systems within the forensic field using the following computer forensic tools:

EnCase 6.15 provided by Guidance Software

FTK (Forensic Tool Kit) 1.60 delivered by Access Data.

ISOBuster 2.7, which is also X-Ways Inc.

Linux 2.6 named Lefebvre

Power PC and Apple Inc. OS X 10.4.11

Microsoft Windows XP

Intel and Apple Inc. OS X 10.6.2

TSK ( Sleuth Kit) Carrier

Smart Projects Windows Vista

Evaluation Methodology

The study carries out different evaluations of forensic tools using Endian ordering, Inconsistent directory trees and empty root directory within the secondary volume descriptor. The first evaluation is carried out to determine the inconsistent directory trees to determine whether it will be possible to view an image within the two inconsistent directory trees. The evaluation provides which of the two files will be revealed. The ISO9660 was created using Joliet extensions with "File1.txt" and "File2.txt" within root directory.

Further technique to carry out the evaluation is through secondary volume descriptor that assists in hiding data because some of the tools only rely on the first or secondary volume descriptor. The study identifies which of the files within the volume descriptor to enhance greater understanding of the evaluation procedure. Typically, the secondary volume descriptor is named as File2.txt while the primary volume descriptor is tagged as File1.txt.

The study also carries out the evaluation using the Endian ordering, which has the ability to read one or both of the values stored within the little -- and big ordering.

Results of the Evaluation

Based on the analysis of the tools listed above it is revealed that modified ISO9660 image burnt within the forensic tools and mounted with different operating systems could provide different interpretations. All the forensic tools listed above are designed in different versions leading to different interpretation of ISO9660 File Systems. One of the different interpretations of ISO9660 is that there can be multiple directory hierarchies where each of the directories has its own root directory where one directory has 8 characters within the name and 3 characters within the extension.

As being revealed in Table 1, Win Hex Forensics, Forensic Tool Kit as well as Sleuth Kit shows the two directory hierarchies where the primary hierarchy consists of file named File1.txt while the secondary hierarchy contains file named called File2.txt. Ideally, the ISO9660 needs to reveal both File1.txt and File2.txt. On the other hand, FTK, WinHex and ISOBuster reveal the individual file which is under each of the two volume descriptors. Sleuth Kit provides different interpretation by showing File1.txt as an orphan ?le that could be accessed from root directory and File2.txt as a normal file a normal system. Typically, all the ten forensic tools reveal only one file where five of the tools revealed the contents primary volume descriptor while other five revealed the contents of the secondary volume descriptor. The conclusion the study draws from the forensic evaluation is that the CDs do not have the ability to reveal all data. Thus, it could be risky for individual to use this data hiding approach.

Table 1: Interpretation of ISO9660 File Systems using Inconsistent directory trees

CFT

File1.txt

File2.txt

EnCase

Y

Forensic Tool Kit

Y

Y

ISOBuster

Y

Y

Linux (default options, mount image)

Y

Linux (nojoliet option, mount image)

Y

Linux (norock option, mount image)

Y

Linux CD

Y

OS X mount image

Y

OS X CD

Y

Sleuth kit

Y

Y

Windows XP CD

Y

Windows Vista CD

Y

Default Win Hex Forensics

Y

Win Hex Read ISO9660 Forensics

Y

Y

Table 2 reveals different interpretation of ISO9660. While the some of the findings are similar to the data in the Table 1, however, there are still different interpretations. For example, some of the tools could not reveal the two files. Encase does not reveal the File1.txt and File2.txt. The Linux mounted with noRock, Window XP and Window Vista also reveals different results from the results presented in Table 1. These CFTs do not reveal File1.txt and File2.txt. Similar to the Table 1, other tools reveal both files and one of the files. Sleuth kit, ISOBuster and Win Hex Read ISO9660 Forensics reveal both File1.txt and File2.txt. On the other hand, other CFT tools only reveal File 1.txt. The evaluation of the CFT reveals the inconsistent by which the file is displayed.

Table 2:Interpretation of ISO9660 File Systems using Secondary Volume Descriptor

Tool/OS

File1.txt

File2.txt

EnCase

Forensic Tool Kit

Y

Y

ISOBuster

Y

Y

Linux (default options, mount image)

Y

Linux (nojoliet option, mount image)

Y

Linux (norock option, mount image)

Linux CD

Y

OS X mount image

Y

OS X CD

Y

Sleuth Kit

Y

Y

Windows XP CD

Windows Vista CD

Default Win Hex Forensics

Y

Read ISO9660 Win Hex Forensics

Y

Y

Further interpretation of ISO9660 with reference to the processing of the Big endian and Little endian reveal different results. ISOBuster, Forensic Tool Kit, and Sleuth Kit have ability to process the big-endian value. While other tools only process the Little endian value. However, non-of the tools has ability to process both Big endian and Little endian at the same time.

Table 3: Interpretation of ISO9660 File Systems using Endian ordering Evaluation

OS / Tool

Big endian

Little endian

EnCase

Y

Forensic Tool Kit

Y

ISOBuster

Y

Linux (default options mount image)

Y

Linux (nojoliet option, mount image,)

Y

Linux (norock option, mount image)

Y

Linux CD

Y

OS X, 10.4.11 using CD)

Y

mount image OS X 10.6.

Y

OS X 10.6.2 CD

Y

Sleuth Kit

Y

Windows XP CD

Y

Windows Vista CD

Y

Default Win Hex Forensics

Y

Win Hex Forensics which Read

Y

Discussion

This study reveals the different interpretations of ISO9660 File Systems and based on the evaluation of the forensic tools using different methodologies, the study has been able to demonstrate that there are different interpretations of ISO9660 File Systems. Typically, the evaluation results reveal within the Inconsistent directory trees and Secondary Volume Descriptor show that Sleuth Kit appear on both File1.txt and File2.txt of the two evaluation procedures. However, Sleuth Kit only appears on the Big-Endian of the Endian ordering evaluation technique. Moreover, The Forensic tool kit appear on both File1.txt and File2.txt of the Inconsistent directory trees and Secondary Volume Descriptor, however, the Forensic tool kit only appears within the Big-Endian of the Endian ordering evaluation system. ISOBuster also appears within the File1.txt and File2.txt Inconsistent directory trees and Secondary Volume Descriptor. However, ISOBuster only appears on the Big-Endian of the Endian ordering. Based on the results presented in the previous section, there is different interpretation of ISO9660 File Systems.

Conclusion

The existing tool and operating system that are used for different methods allow for the different interpretations of interpret ISO9660 ?le systems. Typically, the analysis tools used for ISO9660 File Systems may not reveal the same data which media's users were viewing leading an investigator to miss important data. Meanwhile, it is important to note the risk of missing data during the forensic investigation, and the best method to reduce the missing of important data is by using multiple tools to carry out different analysis to enhance effective data capture. Typically, it is critical to use the forensic tools that reveal only one of the files. Meanwhile, it is hopeful that the tools will provide clear ISO9660 interpretations in the future. To carry out the efficient data hiding techniques, there is a need to carry further research to investigate the strategies CDs have been created using CD mastering software. There is a need to carry out the further study on the efficient use of ISO9660 ?le system to allow for effective ISO9660 interpretation.