Forensics and Cyber Threat Research Area

Threat Intelligence | Insider Threat Detection | User Behavior Analytics | Cyber Threat Management | Data Security Intelligence | Cloud Security Intelligence Application Security Intelligence | Anomaly & Pattern Detection |  Security Information Event Management | Digital Forensics | Data Recovery | Malware Investigation | Packet Analytics | Packet Forensics | security operations and analytics platform architecture (SOAPA)

Home » Blog » Advance Data Recovery

 Posted in Data Recovery

Advance Data Recovery

   22nd February 2015  Leave a Comment on Advance Data Recovery 0 640

Advance Data Recovery

1.    Chances for Data Recovery of Deleted files

2.    Chances for Data Recovery of Formatted File Systems

Advance Data Recovery
Advance Data Recovery

Chances for Data Recovery of Deleted files

Windows file systems

Famous Windows file systems which includes FAT (with FAT32 extension), NTFS and newly produced file system ReFS for Windows Servers. It gives special importance or value to that data recovery from these file systems in comparision to any other file systems & it is higly possible until the circumstances of files overwriting.

  1. File system: FAT/FAT32
  • File deletion: Directory record is signed as ‘unused’. Clusters of HDD marked as ‘free’ that destroys chain of clusters, used by file.
  • Data Recovery of non-fragmented file: File name, File size and on-disk position which remains inside the directory record increases the  chances of file recovery.
  • Data Recovery of fragmented file: Chain of file clusters is vanished & no information is traced about file fragments. Known file name, file size and start position of respective file remains. Using detailed method it is possible to guess fragment locations, however, without any guarantees as for correct guess.
  1. File system: NTFS
  • File deletion: When a file is deleted in NTFS Master File Table a record is noticed as ‘unused’. Bitmap of used space is updated to release used clusters. File entry is deleted from directory record.
  • File recovery: File name, File size and on-HDD position remains inside Master File Table.This is very helpful to recover file in NTFS.
  1. File system: ReFS
  • File deletion: Metadata structure of a file is modified with CoW operation noticed the area as free for new references
  • File recovery: The operating system stores huge amount of previous backup copies that makes data analysis & recovery possible with maximum coverage.

MacOS file systems

Apple Mac OS uses HFS+ file system as a priority file system for their Mac computers, iPhone, iPod etc. It gives special importance that data recovery from HFS+, like from any other systems, is possible till files overwriting.

File system: HFS+

  • File deletion: The file system eliminate completely data from records metadata records for the file and updates map of free space allocation.
  • File recovery: File name, Files size and respective position of file on HDD are wiped, regardless of this, the file system journal still may contain this information that allows to recover good amount of files.

Linux file systems

Current Linux operating systems use Ext2, Ext3 and Ext4, XFS, ReiserFS, JFS (JFS2) file systems.

File system: XFS

  • File deletion: XFS removes a sort of information about file node and updates tree of free blocks. Fact about file name is separate from directory entry.
  • Recovery of non-fragmented file: Using detailed approach method, it is possible to find file name and file size and respective position of file on HDD rounded to block. Chances for recovering it is having two factors one is file & second one is it’s name.
  • Recovery of fragmented file: File name, File size and fragments series of linked can be retrieved using detailed approach method. If file data is not in usefulness, Chances for recovering it having two factors one is file & second one is it’s name.2. File system: Ext2
  • File deletion: Ext2 files systems signs file node as free and updates map of available blocks. Facts about file name is separate from directory entry. File name to node reference is vanished.
  • Recovery of non-fragmented file: Information about file beginning and file size could exists on disk. Data Analysis of nodes can be fruitful to recover good files.  At the same time, information about file name is lost.
  • Recovery of fragmented file: The same as for non-fragmented files.

 File system: Ext3/Ext4

  • File deletion: The file system removes completely the file node and updates map of free blocks. Information about file name is separate from directory entry, yet it references the right node.
  • Recovery of non-fragmented file: Information about file start and size is vanished permanently. Nevertheless, it may remain in file system journal. The link between file name and physical location on-disk lacks. Detailed method approach and journal analysis may make possible to recover good files even with real names.
  • Recovery of fragmented file: In most of the cases, the information about the first 12 blocks of a file lacks. As the file information & file size is damaged completely, chances for recovering a deleted file is very poor. However, information about most nearby deleted files may still remain in the file system journal that gives hope to recover a file with real file name upto 100%.

File system: ReiserFS

  • File deletion: The system update it’s S+-tree to exclude a file and renew the area ground of free space.
  • Recovery of non-fragmented file: S+-tree node may persist on disk (a copy in the file system journal and an old copy, created with copy-on-write). In this scenario file recovery chances could be more.
  • Recovery of fragmented file: The same is for non-fragmented files.

File system: JFS (JFS2)

  • File deletion: Journaling File System updates the counter of object use and releases inode in inode use map. The set of all entries are rebuilt to reflect changes.
  • Recovery of non-fragmented file: File inode present on the disk gives potential chances of files recovery upto almost 100%. Recovery chances are a bit poor for file name.
  • Recovery of fragmented file: The same as for non-fragmented files.

BSD, Solaris, Unix file systems

These file systems commonly use UFS and UFS2 file systems.

  1. File system: UFS/UFS2
  • File deletion: UFS clears file node and makes map of unused blocks. Information about file name is seperate from directory entry.
  • Recovery of non-fragmented file: The information on disk drive which contains entry of file start and file size is destroyed permanently. The connection between file name and on-disk location lacks. Detailed approached methods make possible to recover good files of available known file type. At the same time, you will rarely come across non-fragmented files on UFS due to specific of its Soft Updates algorithm.
  • Recovery of fragmented file: The information about the first 12 blocks of a file lacks. There also remains no information about file name and size. Chances to recover deleted file are quite poor, yet possible.

Chances for Data Recovery of Formatted File Systems

HDD Formated Data Recovery
Formated Data Recovery

Windows file systems

Windows file systems include FAT/FAT32 and NTFS.

  1. File system: FAT/FAT32
  • Formatting: File allocation table is vanished. New root folder is devloped by system on HDD.
  • Recovery of non-fragmented file: All the file name, size and respective position on disk persist inside directory record (other than root directory) this mechanism give potential file recovery chances up to almost 100%.
  • Recovery of fragmented file: Series of file clusters is vanished leaving no information about file consecutive chunks. Known factors will be persisted as file name, file size and start position on respective HDD. By applying detailed method approach it is possible to guess fragment locations of files on disk, however, without any assurity as for correct guess.
  1. File system: NTFS
  • Formatting: Master File Table entry is shown as ‘unused’. Bitmap of allready allocated space is updated to release used clusters. File entry is deleted from directory record.
  • Recovery of non-fragmented file: File name, size and on-disk position remain inside Master File Table record increasing file recovery chances up to almost 100%.
  • Recovery of fragmented file: Known factors will be persisted as file name, file size and start position on respective inside Master File Table record increasing file recovery chances up to almost 100%. Potential data recovery chances are lower for fragmented files which uses more than one Master File Table entry.

Linux file systems

Linux file systems include Ext2, Ext3 and Ext4, XFS, ReiserFS.

File system: XFS

  • Formatting: XFS removes the map of used clusters and writes new root directory. It also updates File allocation groups.
  • Recovery of non-fragmented file: Most of the valuable information about user files persist on hard disk. Potential data recovery is near 100%, but retrieve real file name are near 95%.
  • Recovery of fragmented file: The same as for non-fragmented files.

File system: Ext2

  • Formatting: All allocation sectors as well as file nodes are destroyed completely.
  • Recovery of non-fragmented file: Only detailed method approach allows to recover good files but potential of getting real file is difficult.
  • Recovery of fragmented file: Only advanced detailed method approch allows to recover good files but without real file names.

File system: Ext3/Ext4

  • Formatting: All allocation groups as well as file nodes are destroyed completely. Depending on driver file system journal may still contain information about some most recently created files.
  • Recovery of non-fragmented file: Only advanced heuristics and journal analysis allow to recover good files, however, in most cases without real file names.
  • Recovery of fragmented file: Only advanced heuristics and journal analysis allow to recover good files, however, in most cases without real file names.

File system: ReiserFS

  • Formatting: The file system develops new S+-tree over the existing one.
  • Recovery of non-fragmented file: There are potential chances of remaining of S+-tree node on disk (a copy in file system journal and an old copy, created with copy-on-write). In this case file recovery chances could be up to more.
  • Recovery of fragmented file: The same as for non-fragmented files.

BSD, Solaris, Unix file systems

Unix-like file systems include UFS and UFS2.

File system: UFS/UFS2

  • Formatting: All allocation groups as well as file nodes are destroyed completely.
  • Recovery of non-fragmented file: Only detailed method of analysis allows to recover good files but without original file names.
  • Recovery of fragmented file: Only advanced detailed method approach allows to recover good files, however protential of getting real file name is very difficult.
Author: Rohit Sadgune
Core Working Areas :- Threat Intelligence, Digital Forensics, Incident Response, Fraud Investigation, Web Application Security Technical Certifications :- Computer Hacking Forensics Investigator | Certified Ethical Hacker | Certified Cyber crime investigator | Certified Professional Hacker | Certified Professional Forensics Analyst | Redhat certified Engineer | Cisco Certified Network Associates | Certified Firewall Solutions | Certified Network Monitoring Solution | Certified Proxy Solutions
Website

Leave a Reply

Your email address will not be published. Required fields are marked *

Enter Captcha Here : *

Reload Image

Indicator of Attacks | Indicator of Compromise

Top SIEM Use Cases | Threat Hunting Hypothesis | Deep Packet Inspection | Insider Threat Hunting | Hunting Data Exfiltration | Banking Fraud | ATM Use Cases | Cross Channel Data Exfiltration | Hunting Endpoint Anomaly | Denial-of-service | Man-in-the-middle (MitM) attack | Spear phishing attacks | Drive-by attack | Eavesdropping attack | Birthday attack