¸¶½ºÅÍÆ÷À¯(Master4U)
Monday, 17 of January
 

Á¦¸ñ: ¸®´ª½º ext3 ÆÄÀϽýºÅÛ¿¡¼­ÀÇ ÆÄÀϺ¹±¸ (debugfs, sleuthkit, foremost)
ºÐ·ù: ¸®´ª½º
À̸§: °ü¸®ÀÚ * http://www.master4u.net


µî·ÏÀÏ: 2017-01-27 17:52
Á¶È¸¼ö: 10347
 
¸®´ª½º ext3 ÆÄÀϽýºÅÛ¿¡¼­ÀÇ ÆÄÀϺ¹±¸ (debugfs, sleuthkit, foremost)

http://livemedia-soft.com/4589

¡°¸®´ª½º ext3 ÆÄÀϽýºÅÛ¿¡¼­ »èÁ¦µÈ ÆÄÀÏÀº º¹±¸ ÇÒ ¼ö ¾ø´Ù.¡± ¶ó°í
¾Ë°í °è½Å ºÐµéµµ ÀÖÁö¸¸ ÀڷḦ ã¾Æº¸´Ï º¹±¸ °¡´ÉÇϱº¿ä.

ext2 ÆÄÀϽýºÅÛÀº °£´ÜÇÏ°Ô debugfs(ext2/ext3 file system debugger)Åø·Î º¹±¸ÇÒ¼ö ÀÖ¾úÀ¸³ª,
¿¹) debugfs: dump /home/invain/linux-2.6.20.tar.gz

ext3 ÆÄÀϽýºÅÛ¿¡¼­´Â Journaling Transaction Filesystem ±¸Á¶·Î ÀÎÇØ
IBM¿¡¼­ ¸¸µç sleuthkit µµ±¸¸¦ Ȱ¿ëÇÏ¿© ºí·ÏÁ¤º¸¸¦ ¾ò¾î °è»êÇÏ¿© foremost ¶ó´Â Åø·Î º¹±¸ °¡´ÉÇÕ´Ï´Ù.

¸ÕÀú ÇÊ¿äÇÑ À¯Æ¿¸®Æ¼¸¦ yum(YellowDog Update Manager; À³À̶ó ºÎ¸¨´Ï´Ù.)À¸·Î ¼³Ä¡ÇÕ´Ï´Ù.
root# yum install foremost

sleuthkit Àº yumÀ» ÅëÇÑ ¼³Ä¡°¡ Áö¿øµÇÁö ¾ÊÀ¸¹Ç·Î, ¾Æ·¡¿Í °°ÀÌ ¼Ò½ºÄڵ带 Á÷Á¢ ÄÄÆÄÀÏÇÏ¿© ¼³Ä¡ÇÕ´Ï´Ù.
http://www.sleuthkit.org/sleuthkit/desc.php

root# wget http://jaist.dl.sourceforge.net/sourceforge/sleuthkit/sleuthkit-3.0.1.tar.gz
root# tar xvfz sleuthkit-3.0.1.tar.gz
root# cd sleuthkit-3.0.1
root# ./configure --prefix=/usr ; make ; make install


º¹±¸Çϱâ

¸ÕÀú Áö¿öÁø ÆÄÀÏÀÇ ÆÄƼ¼Ç È®ÀÎÈÄ
1) debugfs Åø·Î º¹±¸ÇÒ ÆÄÀÏÀÇ ºí·ÏÁ¤º¸ ¾ò±â
root# debugfs /dev/sdb2
debugfs: cd /home/user/ (Áö¿öÁø ÆÄÀÏÀÇ °æ·Î·Î À̵¿)
debugfs: ls -d (Áö¿öÁø ÆÄÀÏÀÇ ¸ñ·ÏÃâ·Â)
5113273 (12) . 5079050 (4084) .. 2050 (508)
5113275 (28) 032612_0759_22.png 5113276 (28) 032612_0759_1.png
5113277 (28) 032612_0759_10.png 5113278 (28) 033012_0538_31.jpg
5113279 (36) 040312_0631_iDESKCMS64.png
5113398 (12) 2012
0 (28) 033012_0538_19.jpg 5113407 (28) 032612_0759_47.png
5113408 (36) 040312_0631_iDESKCMS62.png 5113409 (28) 033012_0538_49.jpg
5113410 (36) 040312_0631_iDESKCMS10.png 5113411 (28) 032612_0759_61.png
0 (36) 040312_0631_iDESKCMS8.png
5113413 (36) 040312_0631_iDESKCMS19.png 0 (28) 032612_0759_54.png
0 (36) 040312_0631_iDESKCMS42.png 0 (68) 032612_0759_66.png
0 (964) PIC780.png 1900545 (944) mobile-c.png
5113301 (28) 032612_0759_58.png 5113326 (92) 040312_0631_iDESKCMS25.png
5113286 (28) 032612_0759_31.png 5113384 (28) 032612_0759_5.png
5111959 (232) mobile-c100-100¡¿150.gif 5113382 (80) 033012_0538_40.jpg
5113290 (52) 032612_0759_8.png
..ÀÌÇÏ ¸ñ·Ï »ý·«
*ÀúÀÇ °æ¿ì ÆÄÀϹøÈ£°¡ 5113398 ÀÎ 2012 ¶ó´Â Æú´õ¸¦ Åëä·Î º¹±¸ÇÒ°ÅÀÓ.


2) imap ¸í·ÉÀ¸·Î BG ±¸Çϱâ (block group; ÆÄÀÏ 5113398ÀÇ ºí·Ï±×·ì)
debugfs: imap 5113398
Inode 5113398 is part of block group 156
located at block 8323112, offset 0¡¿0280
*ÆÄÀϹøÈ£ 5113398ÀÇ ºí·Ï±×·ìÀº 156


3) stats ¸í·ÉÀ¸·Î BPG ±¸Çϱâ (Blocks per group; ±×·ì´ç ÇØ´çÇÏ´Â ºí·Ï³Ñ¹ö)
debugfs: stats
Filesystem volume name: /
Last mounted on:
Filesystem UUID: 9789df92-6ede-47f3-8a81-38dad297edc5
Filesystem magic number: 0xEF53
Filesystem revision #: 1 (dynamic)
Filesystem features: has_journal ext_attr resize_inode dir_index filetype needs_recovery sparse_
Blocks per group: 32768
Fragments per group: 32768
Inodes per group: 32768
Inode blocks per group: 1024
Filesystem created: Mon May 7 20:56:22 2012
Last mount time: Tue Jul 3 09:25:01 2012
Last write time: Tue Jul 3 09:25:01 2012
–More–
*±×·ì´ç ºí·Ï³Ñ¹ö´Â 32768



4) Áö¿öÁø ÆÄÀÏÀÇ ºí·Ï¹üÀ§ °è»êÇϱâ(¹üÀǸ¦ °è»êÇØ¾ß ÇÏ´Â ÀÌÀ¯´Â ¾Æ·¡ÀÇ Âü°íÀÚ·á ¼³¸í)
BG = 156
BPG = 32768

°ø½Ä
(BG °öÇϱâ BPG) ~ ( (BG + 1) °öÇϱâ BPG -1)
´ëÀÔÇÏ¿© ¾Æ·¡Ã³·³ °è»ê
156 x 32768 ~ 157 x 32767

°è»êµÈ ºí·Ï¹üÀ§ °á°ú
5111808 ~ 5144419


5) °è»êµÈ ºí·Ï¹üÀ§¸¦ sleuthkit À¸·Î ¡®block.dat¡¯ À̸§À¸·Î ´ýÇÁ¶ß±â
root# blkls /dev/sda2 5111808-5144419 block.dat


6) foremost Åø·Î º¹±¸½Ãµµ
root# foremost -dv -t png -o ./ -i ../block.dat (¹Ýµå½Ã ºó µð·ºÅ丮¿¡¼­ ´ýÇÁÆÄÀÏ °æ·ÎÈ®ÀÎ)
*ÁÖÀÇ! foremost ºÎÁÖÀÇÇÑ »ç¿ë½Ã ÆÄÀϽýºÅÛÀÌ ¼Õ»óµÉ¼ö ÀÖ½À´Ï´Ù.
root# foremost -dv -t png -o ./ -i ../block.dat
foremost: /usr/local/etc/foremost.conf: No such file or directory
Foremost version 1.5.7 by Jesse Kornblum, Kris Kendall, and Nick Mikus
Audit File
Foremost started at Fri Aug 17 18:03:03 2012
Invocation: foremost -dv -t png -o ./ -i ../block.dat
Output directory: /root/re/test
Configuration file: /usr/local/etc/foremost.conf
Processing: ../block.dat
|——————————————————————
File: ../block.dat
Start: Fri Aug 17 18:03:03 2012
Length: 13 MB (14573568 bytes)
Num Name (bs=512) Size File Offset Comment
0: 00000096.png 1 KB 49152 (983 x 11)
1: 00002064.png 169 B 1056768 (626 x 24)
2: 00002072.png 170 B 1060864 (625 x 24)
3: 00002080.png 13 KB 1064960 (210 x 59)
4: 00002112.png 53 KB 1081344 (IND BLK bs:=4096) (472 x 225)
5: 00002232.png 136 B 1142784 (192 x 39)
6: 00002240.png 81 KB 1146880 (IND BLK bs:=4096) (406 x 240)
7: 00002416.png 134 B 1236992 (123 x 46)
8: 00002424.png 401 B 1241088 (106 x 44)
9: 00002432.png 131 B 1245184 (156 x 18)
10: 00002440.png 151 B 1249280 (700 x 23)
¡¦.»ý·«
Finish: Fri Aug 17 18:03:04 2012
81 FILES EXTRACTED
png:= 81
——————————————————————
Foremost finished at Fri Aug 17 18:03:04 2012
* rm -rf ·Î Áö¿î 2012¶ó´Â Æú´õ¾ÈÀÇ 81°³ÀÇ .png À̹ÌÁö ÆÄÀÏ º¹±¸µÊ.

root# ls
audit.txt (º¹±¸µÈ ÆÄÀϸñ·Ï ·Î±×) png(µð·ºÅ丮 »ý±è)

root# cd png
root# ls
00000096.png 00002456.png 00004704.png 00005040.png 00007216.png 00008592.png 00008688.png
00002064.png 00002960.png 00004760.png 00005048.png 00007224.png 00008600.png 00009488.png
00002072.png 00002968.png 00004768.png 00005056.png 00007232.png 00008608.png 00009568.png
00002080.png 00002976.png 00004776.png 00005064.png 00007240.png 00008616.png 00009648.png
00002112.png 00003848.png 00004784.png 00005688.png 00007248.png 00008624.png 00009728.png
00002232.png 00004080.png 00004960.png 00006192.png 00007256.png 00008632.png 00025328.png
00002240.png 00004280.png 00004968.png 00006552.png 00007264.png 00008640.png 00027288.png
00002416.png 00004288.png 00005000.png 00006968.png 00007272.png 00008648.png 00028336.png
00002424.png 00004296.png 00005008.png 00006976.png 00007888.png 00008656.png 00028376.png
00002432.png 00004304.png 00005016.png 00006984.png 00007896.png 00008664.png
00002440.png 00004464.png 00005024.png 00006992.png 00008256.png 00008672.png
00002448.png 00004584.png 00005032.png 00007000.png 00008584.png 00008680.png
ÆÄÀÏÀ̸§ÀÌ ¹Ù²î¾úÁö¸¸ ´ëºÎºÐÀÇ ÆÄÀϺ¹±¸ È®ÀÎ!

*¿©·¯ ÆÄÀϵé ÇѲ¨¹ø¿¡ º¹±¸ÇÒ¶§ (ÆÄÀÏÁ¾·ù;È®ÀåÀÚ ¸¶´Ù offsetÀÌ ´Ù¸§.)
root# foremost -dv -t png, jpg, gif, pdf, doc -o ./ -i ../block.dat

       
¡â ÀÌÀü±Û: ÀÎÅÚ CPU Ãë¾àÁ¡(Meltdown & Spectre) »ó¼¼ºÐ¼®
¡ä ´ÙÀ½±Û: Linux Kernel ¹öÀü È®ÀÎ
Copyright 1999-2025 Zeroboard / skin by enFree