11 03 2012

So here we are with Part 3 - fls. After receiving some feedback I have decided to use images that you all can download and follow along with. So, for this example we will use an image from Digital Corpora, specifically M57-Jean.

So go ahead and pull the image down and also pull down the slides. I will be using .E01

fls is a Sleuth Kit tool that is used to list files and directory names within an image. It operates at the file system layer. fls can also list file names of deleted files for a directory when the inode is supplied.

Go ahead and type fls into the command prompt without any other arguments. You should get something like this:

sansforensics@SIFT-Workstation:~$ fls
Missing image name
usage: fls [-adDFlpruvV] [-f fstype] [-i imgtype] [-b dev_sector_size] [-m dir/] [-o imgoffset] [-z ZONE] [-s seconds] image [images] [inode]
If [inode] is not given, the root directory is used
-a: Display “.” and “..” entries
-d: Display deleted entries only
-D: Display only directories
-F: Display only files
-l: Display long version (like ls -l)
-i imgtype: Format of image file (use ‘-i list’ for supported types)
-b dev_sector_size: The size (in bytes) of the device sectors
-f fstype: File system type (use ‘-f list’ for supported types)
-m: Display output in mactime input format with
     dir/ as the actual mount point of the image
-o imgoffset: Offset into image file (in sectors)
-p: Display full path for each file
-r: Recurse on directory entries
-u: Display undeleted entries only
-v: verbose output to stderr
-V: Print version
-z: Time zone of original machine (i.e. EST5EDT or GMT) (only useful with -l)
-s seconds: Time skew of original machine (in seconds) (only useful with -l & -m)

These are the different options we can choose from when we are working with fls. We won’t cover all of them here, but we will go over a few so you can get an idea of what kind of output they will produce. They are pretty self explanatory.

As you can see from the mmls output our NTFS partition starts at sector 63, which will allow us to specify the -o (offset) argument when we start running the fls command against our image.Let’s go ahead and see if  fls will even work.

One of the neat features that fls can do is generate a bodyfile. A bodyfile is an intermediate file that we can use when we are creating a timeline of file activity.So let’s see how to create a body file (note the command highlighted).

Here is a portion of the output from the bodyfile we created. We specified the -r and -m arguments. The -r says to recurse the directory entries and the -m “/” tells it to display output in mactime input format with dir/ as the actual mount point of the image.

We are going to deviate a bit and use another tool within TSK called mactime. Mactime takes the output from fls (our bodyfile) and turns it into an ASCII timeline of file activity that’s human readable. In order to use mactime we needed to specify the -m when we ran the fls command above (which we did).

Let’s go ahead and run mactime and convert our bodyfile into the ASCII timeline that’s easier to read.In this command I specified the -b (bodyfile to use) and -d (delimited output) so we can put it into a csv file and review it using Microsoft Excel or OpenOffice Spreadsheet, which is what I used most of the time for this. One item I didn’t include that you will want to do is specify the timezone using the -z argument. To get a list of additional arguments you can simply type, mactime in your command line and it will show you a list of them.

Here is what the output looks like after I opened it up using OpenOffice Spreadsheet.

So there we have a decent timeline of file system activity by way of using the fls command along with another Sleuth Kit tool called mactime.

Now that we have this file system activity let’s do a quick search against it and see if we can’t locate the m57plan.xlsx Excel file. I don’t see anything named this, so let’s just go back to using fls and do a couple
searches against the image file.So here we are running a -r (recursive) search for only files (-F) at offest (-o) 63, which is the start of our NTFS partition. As we list these files we are grepping for anything with .xls.

So now we can run icat and also take an md5sum of it.

Now let’s open up this file in OpenOffice Spreadsheet and check it out.

Now, let’s verify that the file we extracted using icat matches the actual file in the image to ensure it wasn’t modified during our extraction process. To do this we will mount the image and then run an md5sum against the file.

Running this command will create a raw image (non-E01) in the /mnt/ewf directory. I moved it to my desktop for ease of use purposes.

Then we can create a “jean” directory under /mnt (mount). Once the directory is created we can mount the image using the mount command.

Now let’s run md5sum against the file. We knew the path to the file from the fls command above.

Looks like a match to me!

At this point I am going to stop because I don’t want to ruin this case for anyone that might want to give this a try and actually find out all the answers based off the questions contained within the slides.

I think I have given you decent enough overview of how fls can be used, and how it can be useful within your investigation(s). I personally enjoy using command line tools. You might not, but hopefully this
demonstrates how easy they are to use. Not to mention they are free.

Tweet

References:

[1] http://wiki.sleuthkit.org/index.php?title=Mactime_output

Digital Forensics, Forensic Artifacts, mmls, offset, sans investigative forensic toolkit, The Sleuth Kit, timeline, TSK

Forensics Journey into Python Zeus v2 Malware Analysis – Part I