Disk Forensics

Scope

What this is: Analysing disk images to extract evidence, recover deleted files, and reconstruct timelines.

Competition relevance: Digital forensics and incident response. Core forensics skill using Autopsy, FTK Imager, and command-line tools.

Why it matters: Disk forensics is central to most forensics tasks. Flags are often in deleted files, slack space, or filesystem metadata.

WSOS 2026 alignment: This topic directly supports Section 8: Investigation and digital forensics (examining digital evidence from storage media).

Competition area: Core to the digital forensics and incident response area, where you analyse compromised systems by examining disk images for indicators of compromise, deleted evidence, and hidden data.

Offline competence: Autopsy, Foremost, Sleuth Kit, and PhotoRec all function offline. Use man foremost, man fls, and Autopsy’s built-in help. Pre-load Autopsy case files and disk images locally. File carving and timeline analysis require no network access.

---

Competency Matrix

Level	Expectation
Regional	Use Autopsy to extract deleted files. Basic keyword searching. File recovery with Foremost/PhotoRec.
National	Filesystem analysis (MFT, journal). Timeline creation. Slack space examination. Advanced Autopsy modules.
Squad/Team Selection	Manual filesystem parsing. Encrypted volume analysis. Artifact correlation across multiple images.
International	Advanced anti-forensics detection. Custom parser development. Multi-image correlation and attribution.

---

Technical Content

Autopsy Basics

Starting Autopsy:

9999/autopsy

# Launch Autopsy
autopsy

Creating a case:

1. New Case → Enter case name and directory
2. Add Host → Host name
3. Add Image → Browse to disk image (.dd, .E01, .vmdk)
4. Image Type: Disk / Partition
5. Import Method: Symlink (faster)

Essential analysis steps:

1. File Analysis:

   • Expand Image → Volume → Root directory
   • Check “Deleted Files” directory (red X icon)
   • Sort by Modified/Accessed/Created times

2. Keyword Search:

   • Keyword Search tab
   • Add keywords (flag, password, secret, etc.)
   • Search → View results

3. File Type Analysis:

   • File Type → Images / Documents / Archives
   • Look for hidden files (e.g., .jpg in /etc)

4. Timeline:

   • Tools → Timeline → Generate
   • View file activity by date/time

Extracting files:

• Right-click file → Export
• Save to case directory for analysis

Competition context: Flags are often in deleted files, hidden files, or files with wrong extensions. Check everything.

---

File Carving

Foremost (file recovery):

# Recover all file types
foremost -i diskimage.dd -o output/

# Recover specific types
foremost -t jpg,png,pdf -i diskimage.dd -o output/

# Check output directory
ls output/jpg/  # Recovered JPG files

PhotoRec (alternative):

# Interactive mode
photorec diskimage.dd

# Navigate through menus:
# - Select partition
# - Select file types to recover
# - Choose output directory

Scalpel (faster, config-based):

# Edit /etc/scalpel/scalpel.conf to enable file types
# Uncomment lines for jpg, png, pdf, etc.

# Run scalpel
scalpel -b -o output/ diskimage.dd

# -b = carve without headers (more recovery, more false positives)

Competition context: Deleted images/documents often contain flags. Carve everything, then grep for flag formats.

---

MFT Analysis

Master File Table (NTFS):

# Extract MFT using icat (Sleuth Kit)
icat diskimage.dd 0 > mft.raw

# Parse MFT with analyzeMFT
analyzeMFT.py -f mft.raw -o mft.csv

# View in spreadsheet
libreoffice mft.csv

# Look for:
# - Deleted files (still in MFT)
# - Timestamp anomalies
# - Alternate Data Streams (ADS)

Finding Alternate Data Streams:

# In Autopsy, enable "Hash Lookup" module
# ADS shows as separate file entries with :stream_name

# Command-line (Windows):
dir /R C:\  # Shows ADS

# Extract ADS
more < file.txt:hidden.txt

---

Slack Space Analysis

What is slack space: Unused space between end of file and end of cluster. May contain remnants of previous files.

Analyzing slack:

# Using Sleuth Kit
blkls -s diskimage.dd > slack.raw

# Search slack for keywords
strings slack.raw | grep -i flag

# Hex analysis
xxd slack.raw | less

---

Filesystem Timeline

Creating timeline with Sleuth Kit:

# Generate body file (all timestamps)
fls -r -m C: diskimage.dd > body.txt

# Create timeline
mactime -b body.txt -d > timeline.csv

# Filter by date
mactime -b body.txt -d 2024-01-01..2024-01-31 > january_timeline.csv

Autopsy timeline:

• Tools → Timeline
• Filter by date range
• Group by file type or directory
• Export to CSV for analysis

---

Competition Strategy & Marking

What gets marked:

• Deleted files recovered (screenshot of file content)
• Flags extracted from images (exact flag value)
• Timeline analysis (sequence of events)
• Evidence documentation (file paths, timestamps, hashes)

Evidence and reporting requirements:

• Screenshot of Autopsy showing file location in directory tree with full path
• Extracted file with flag visible (screenshot of file content)
• MD5/SHA1 hash of evidence file (calculated with md5sum or Autopsy)
• Written explanation of how file was found (method: deleted file recovery, carving, keyword search, etc.)
• Timeline of file activity showing creation, modification, and access times
• Inode number and file offset for forensic precision
• Export of recovered files with chain of custody documentation
• Keyword search terms used and number of hits
• Clear naming: disk_deleted_flag_txt_recovered.png, disk_carved_image_with_flag.png

Time allocation:

• Autopsy setup and image import: 5 minutes
• Deleted file recovery: 20-30 minutes
• File carving: 15-20 minutes
• Keyword search and analysis: 20-30 minutes

Workflow:

1. Import image into Autopsy
2. Run keyword search for common flag patterns
3. Check deleted files directory
4. Carve unallocated space
5. Analyse timestamps for suspicious activity
6. Document findings

Time-boxed drill suggestion: 90-minute disk forensics sprint: Given a disk image (.dd or .E01), import into Autopsy, run keyword searches for “flag”, “password”, “secret”, recover all deleted files, carve unallocated space with Foremost for images/documents, analyse MFT for deleted entries, create a filesystem timeline, identify at least 3 flags, and document all findings with screenshots, hashes, and written explanations.

---

False Flags / Wrong Paths

Common Traps

Carved files with corrupted headers Not all carved files are valid. Verify files open correctly before claiming as evidence.

Timezone confusion Timestamps may be UTC, local, or mixed. Note timezone in documentation.

Partial recovery Carved files may be incomplete. Check file size and content integrity.

Decoy files Competition may plant files named “flag.txt” with fake flags. Verify against flag format.

---

Practice Checklist

• Can import disk image into Autopsy
• Can navigate filesystem and locate deleted files
• Can perform keyword searches
• Can extract files and calculate hashes
• Can use Foremost/PhotoRec to carve deleted files
• Can analyse MFT for deleted entries
• Can create filesystem timeline
• Can identify Alternate Data Streams
• Can document chain of custody for evidence
• Can complete full disk analysis in under 90 minutes

---

References

• Regional Roadmap: Digital forensics
• National Roadmap: Digital forensics
• Cheat Sheet: Forensics Tools (planned)