¸¶½ºÅÍÆ÷À¯(Master4U)
Monday, 17 of January
 

Á¦¸ñ: »èÁ¦µÈ ÆÄÀÏ º¹±¸
ºÐ·ù: ¸®´ª½º
À̸§: °ü¸®ÀÚ * http://www.master4u.net


µî·ÏÀÏ: 2011-08-08 23:20
Á¶È¸¼ö: 12158
 
»èÁ¦µÈ ÆÄÀÏÀ» º¹±¸Çϱâ À§ÇÑ ÀüÁ¦ Á¶°ÇÀº »èÁ¦ÇÏ¿´´ø ÆÄÀÏÀÌ ÀÖ¾ú´ø Çϵåµð½ºÅ©ÀÇ ¼½ÅÍ ºÎºÐÀÌ ´Ù¸¥ ÆÄÀÏ·Î µ¤¾î ¾º¿öÁö±â Àü¿¡ º¹±¸ÇØ¾ß ÇÑ´Ù´Â °ÍÀÔ´Ï´Ù.


1. ÆÄÀÏ º¹±¸ ÇÁ·Î±×·¥ ¼³Ä¡

1) tct ´Ù¿î·Îµå
http://www.porcupine.org/forensics/tct.html

2) ¼³Ä¡

# tar zxvf tct-1.16.tar.gz
# cd tct-1.16
# vi src/fstools/mylseek.c ÆÄÀÏÀ» ¿­¾î #include Ãß°¡
# make



2. ÆÄÀÏ º¹±¸ Å×½ºÆ®

¿¹½Ã:

grub.conf ÆÄÀÏÀ» /tmp/grub ·Î º¹»çÈÄ »èÁ¦ÇÑ ´ÙÀ½ º¹±¸°¡ µÇ´ÂÁö Å×½ºÆ®ÇØ º¸¾Ò½À´Ï´Ù.


1) »èÁ¦ÈÄ º¹±¸ÇÒ Å×½ºÆ® ÆÄÀÏ(grub.conf)À» /tmp µð·ºÅ丮·Î º¹»çÈÄ »èÁ¦

# cp -a /boot/grub /tmp

# rm /tmp/grub -rf

# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/hda8 289M 8.1M 266M 3% /tmp


2) /tmp ÆÄƼ¼ÇÀ» unrm ¸í·ÉÀ¸·Î ´ýÇÁ¸¦ ¶å´Ï´Ù.
unrm - disk data recovery

# ./bin/unrm /dev/hda8 > tmp_dump

# ll -h tmp_dump
-rw-r--r-- 1 root root 281M 1¿ù 16 19:13 tmp_dump


3) lazarus ¸í·ÉÀ¸·Î ´ýÇÁ¸¦ ¶á ÆÄƼ¼ÇÀÇ ÆÄÀÏÀ» º¹±¸ÇÕ´Ï´Ù.
lazarus =create structure from unstructured data

# ./bin/lazarus -h tmp_dump --> ¾Æ·¡¿Í °°Àº ÆÄÀϰú µð·ºÅ丮 »ý¼º

# ll -h
drwx------ 2 root root 106496 1¿ù 16 19:48 blocks
-rw-r--r-- 1 root root 294216704 1¿ù 16 19:13 tmp_dump
-rw-r--r-- 1 root root 203 1¿ù 16 19:14 tmp_dump.frame.html
-rw-r--r-- 1 root root 730609 1¿ù 16 19:48 tmp_dump.html
-rw-r--r-- 1 root root 1472 1¿ù 16 19:14 tmp_dump.menu.html
drwx------ 2 root root 270336 1¿ù 16 19:48 www


4) blocks µð·ºÅ丮¿¡¼­ /boot/grub/grub.conf ÆÄÀÏÀÇ ³»¿ë°ú µ¿ÀÏÇÑ ÆÄÀÏÀ» °Ë»öÇÕ´Ï´Ù. ¿©±â¿¡¼­´Â LABELÀ̶ó´Â ´Ü¾î·Î °Ë»öÇÏ¿´½À´Ï´Ù.

# grep LABEL ./blocks/*.txt
Binary file ./blocks/7631.t.txt matches

7631.t.txt ¶ó´Â ÆÄÀÏÀ» ¿­¾îº¸´Ï /boot/grub/grub.conf ÆÄÀÏ ³»¿ë°ú ÀÏÄ¡ÇÔÀ» º¸¿´½À´Ï´Ù. º¹±¸¿¡ ¼º°ø!!


# cat ./blocks/7631.t.txt

# grub.conf generated by anaconda
#
# Note that you do not have to rerun grub after making changes to this file
# NOTICE: You have a /boot partition. This means that
# all kernel and initrd paths are relative to /boot/, eg.
# root (hd0,0)
# kernel /vmlinuz-version ro root=/dev/hda7
# initrd /initrd-version.img
#boot=/dev/hda
default=1
timeout=10
splashimage=(hd0,0)/grub/splash.xpm.gz
title Red Hat Linux (2.4.20-46.9.legacy)
root (hd0,0)
kernel /vmlinuz-2.4.20-46.9.legacy ro root=LABEL=/ hdc=ide-scsi
initrd /initrd-2.4.20-46.9.legacy.img
title Red Hat Linux (2.4.29)
root (hd0,0)
kernel /vmlinuz-2.4.29 ro root=/dev/hda7 hdc=ide-scsi
initrd /initrd-2.4.29.img
title Red Hat Linux (2.4.20-37.9.legacy)
root (hd0,0)
kernel /vmlinuz-2.4.20-37.9.legacy ro root=LABEL=/ hdc=ide-scsi
initrd /initrd-2.4.20-37.9.legacy.img
title Red Hat Linux (2.4.20-8)
root (hd0,0)
kernel /vmlinuz-2.4.20-8 ro root=LABEL=/ hdc=ide-scsi
initrd /initrd-2.4.20-8.img



3. Âü°í ¹®¼­
http://kltp.kldp.org/stories.php?story=01/11/01/7561951

ÃÖÁ¾¼öÁ¤ÀÏ: 2009-11-11

<ÀÚ·áÃâó : ÈÄÀÌÁî http://cs.whois.co.kr/faq/?p=list&page=13 >


       
¡â ÀÌÀü±Û: ½Ã½ºÅÛ º´¸ñÇö»ó üũÇϱâ
¡ä ´ÙÀ½±Û: ¸®´ª½º ½Ã½ºÅÛ¿¡¼­ ·Î±×ÆÄÀÏÀÇ ÀÌÇØ ¹× ¼³¸í
Copyright 1999-2025 Zeroboard / skin by enFree