<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-disk-forensics
description: >-
  Performs forensic disk imaging, filesystem analysis, artifact extraction, and
  deleted file recovery using dd, FTK Imager, Autopsy, and Sleuth Kit.
domain: cybersecurity
subdomain: incident-response
tags:
  - disk-forensics
  - imaging
  - file-recovery
  - NTFS-analysis
  - artifact-extraction
  - sleuth-kit
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1005"]
---

# Performing Disk Forensics

## Overview

Disk forensics examines non-volatile storage to recover evidence including deleted
files, filesystem metadata, registry artifacts, browser history, and program
execution traces. Proper forensic imaging creates bit-for-bit copies that preserve
evidence integrity for legal proceedings. Analysis uses timeline data from MFT,
USN journal, prefetch, and registry hives.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| dc3dd / dcfldd | Forensic disk imaging with hashing | Package manager |
| FTK Imager | Windows forensic imaging GUI | AccessData download |
| Autopsy | Open-source forensic platform | https://www.autopsy.com |
| Sleuth Kit | CLI forensic analysis | `apt install sleuthkit` |
| MFTECmd | MFT parser | Eric Zimmerman tools |
| RECmd | Registry parser | Eric Zimmerman tools |
| photorec | File carving / recovery | `apt install testdisk` |

## Key Concepts

### Forensic Imaging Standards

- **Raw (dd)** — Bit-for-bit copy, largest output, universally compatible
- **E01 (EnCase)** — Compressed, segmented, with metadata and built-in hashing
- **AFF4** — Open format with compression and metadata support

### Write Blocking

**NEVER mount evidence drives read-write.** Always use:
- Hardware write blocker (Tableau, CRU)
- Software write blocking: `blockdev --setro /dev/sdX`
- Linux mount options: `mount -o ro,noexec,noatime`

### Key Filesystem Artifacts (Windows)

| Artifact | Location | Evidence |
|----------|----------|----------|
| $MFT | Root of NTFS | File creation/modification times |
| $UsnJrnl | $Extend\$UsnJrnl | Recent file operations |
| Prefetch | C:\Windows\Prefetch | Program execution history |
| Amcache | C:\Windows\appcompat | Program installation history |
| Registry hives | C:\Windows\System32\config | System configuration |
| ShimCache | SYSTEM hive | Program execution evidence |
| UserAssist | NTUSER.DAT | GUI program execution |
| Jump Lists | AppData\Roaming\Microsoft | Recent file access |

## Workflow

### Step 1 — Create Forensic Image

```bash
# dd with hashing (Linux)
dc3dd if=/dev/sdb hof=/evidence/disk.raw hash=sha256 log=/evidence/disk.log

# Split into segments
dc3dd if=/dev/sdb hofs=/evidence/disk.raw.000 ofsz=2G hash=sha256

# Verify image integrity
sha256sum /evidence/disk.raw
# Compare with hash in dc3dd log

# Mount image read-only for analysis
mkdir /mnt/evidence
mount -o ro,loop,offset=$((512*2048)) /evidence/disk.raw /mnt/evidence
```

### Step 2 — Filesystem Analysis with Sleuth Kit

```bash
# List partitions
mmls /evidence/disk.raw

# List files in a directory
fls -r -o 2048 /evidence/disk.raw

# Show file metadata by inode
istat -o 2048 /evidence/disk.raw $INODE

# Extract a file by inode
icat -o 2048 /evidence/disk.raw $INODE > /evidence/extracted_file

# Create file timeline
fls -r -m "/" -o 2048 /evidence/disk.raw | mactime -b - > /evidence/fs-timeline.csv

# Search for deleted files
fls -r -d -o 2048 /evidence/disk.raw
```

### Step 3 — Parse NTFS Artifacts

```bash
# Parse MFT
MFTECmd.exe -f /evidence/$MFT --csv /evidence/parsed/ --csvf mft.csv

# Parse USN Journal
MFTECmd.exe -f /evidence/$J --csv /evidence/parsed/ --csvf usn.csv

# Parse Prefetch
PECmd.exe -d /evidence/Prefetch/ --csv /evidence/parsed/ --csvf prefetch.csv

# Parse Amcache
AmcacheParser.exe -f /evidence/Amcache.hve --csv /evidence/parsed/ --csvf amcache.csv

# Parse registry hives
RECmd.exe --bn BatchExamples/AllRegExecKeys.reb -d /evidence/registry/ \
  --csv /evidence/parsed/ --csvf registry-exec.csv
```

### Step 4 — File Carving and Recovery

```bash
# Carve deleted files with photorec
photorec /evidence/disk.raw

# Carve specific file types with scalpel
scalpel -c /etc/scalpel/scalpel.conf -o /evidence/carved/ /evidence/disk.raw

# Search for strings in unallocated space
blkls -o 2048 /evidence/disk.raw | strings -a > /evidence/unallocated-strings.txt
```

### Step 5 — Browser and Application Artifacts

```bash
# SQLite browser history (Chrome)
sqlite3 "/evidence/Users/*/AppData/Local/Google/Chrome/User Data/Default/History" \
  "SELECT datetime(last_visit_time/1000000-11644473600,'unixepoch'), url, title FROM urls ORDER BY last_visit_time DESC LIMIT 100;"

# SQLite browser downloads
sqlite3 "/evidence/Users/*/AppData/Local/Google/Chrome/User Data/Default/History" \
  "SELECT datetime(start_time/1000000-11644473600,'unixepoch'), target_path, tab_url FROM downloads ORDER BY start_time DESC;"
```

## Detection

```yaml
title: Disk Forensics Detection
id: 2afef9d1-234e-43a1-bffd-e264c52f2a64
status: experimental
description: Detects suspicious activity related to performing disk forensics techniques in incident response context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*disk*"
  condition: selection
level: high
tags:
  - attack.t1005
  - attack.impact
falsepositives:
  - Incident response team running authorized forensic collection tools
```

## Verification

- [ ] Forensic image created with cryptographic hash verification
- [ ] Write blocking confirmed before any evidence access
- [ ] Filesystem timeline generated from MFT and USN journal
- [ ] Prefetch and Amcache parsed for program execution
- [ ] Registry hives analyzed for persistence and configuration
- [ ] Deleted file recovery attempted on unallocated space
- [ ] Browser artifacts examined for attacker activity
- [ ] All extracted artifacts hashed and documented

## References

- NIST SP 800-86: Guide to Integrating Forensic Techniques
- Sleuth Kit Documentation: https://www.sleuthkit.org
- Eric Zimmerman Tools: https://ericzimmerman.github.io
- SANS FOR500: Windows Forensic Analysis
- Autopsy Documentation: https://www.autopsy.com/documentation
