Multiple Partitions on a drive

To most users the hard disk has a single partition, or just the C: drive. When it comes to recovery, it is very common to see three partitions. A typical pattern is

• FAT16 (hidden)
• NTFS
• FAT32 (hidden)

The FAT partitions are actually hidden and are configured for system recovery purposes. ie, they will often keep a copy of the operating system and so allow a complete reload of the drive in the event of failure. This saves the manufacturer about 50 cents on not providing a boot DVD with the system and assumes that a disk will fail, but these partitions will remain. Users are actually asked to make their own recovery DVDs.

As far as recovering user data, the only partition to be concerned about is the big NTFS partition. This is where holiday photos, wedding photos and MP3 music will be found.

Forensically though, it is possible to store data in these hidden partitions. Suspicions would be raised if the partitions are bigger than expected. On standard example I have looked at the FAT16 partition is about 60MB, and the FAT32 is about 3GB. The disk was a 250GB. A significantly larger FAT32, or a hidden NTFS must raise questions, and so these partitions would need careful investigation for possible hidden files.

On NAS (Network attached storage) systems, there are often multiple partitions (sometimes more than 4). They are normally all Linux and most of the partitions are Ext2/3. The final partition is the location that data is stored in. This final partition could be XFS, ReiserFS or Ext2/3. In this type of configuration one would expect the final partition to be large, and the rest fairly small. The warning sign would be a second large partition.

Slack space in NTFS

Slack space on a file system is data that is within allocated clusters, but not actually used. When a file is allocated space on NTFS is normally allocates a number of clusters, and a cluster is often 16 sectors in length. Thus, if a file is say 5K long, then there will be 3K of the cluster which is allocated, but does not contain file information. Also, no user will ever see the contents of this 3K of slack space.

Forensically, slack can be useful as it may contain data from previously deleted files. The data will not be complete but it could conatin between 1 and 8191 bytes of useful (for an 8K cluster). CnW actually has an option to collect these fragments and storfe then in a big file with a header for each length of slack data from each incomplete cluster. It should be noted that slack space will only be found in the final cluster of a file. Thus for a 31K file, there will be 3 complete clusters, and the final cluster will have 1K of slack.

For NTFS, slack space does not stop here. To optimise disk usage, small files are stored after the MFT entry in the 1024 MFT block. The maximum size of file maybe about in the region of 5-600 bytes. Thus when analysing a disk for data in the slack area it is essential to examine each MFT for possible data after the MFT, maybe from previous uses of the block. Again, CnW Recovery has a feature so that all MFTs can store the slack in a specific file, again separating each entry with a header. For more details www.cnwrecovery.com/html/ntfs_forensic.html

MFTs and NTFS

Probably the most import element of the NTFS file system is the Master File Table (MFT) structure. This is the block of data that stores information on every file. It contains the file name, dates, size and location on the disk. An MFT entry is normally 1024 bytes long, which means that at times, the file data for a short file (maybe less than 500 bytes) can be stored in this dirctory element, so avoiding having to allocate a 4K area of disk for a small file.

The MFT is made up of several elements, and the most important for receovery purpose are the file allocation locations, file name and the date metadata. On an NTFS disk, the file allocation informtion gives a starting location, and then the number of clusters in the data run. For fragmented files, there are extra staring locations (actually relative locations to the previous start). Occasionally, all the file information can not be fitted into a single 1024 block, so there is a system for chaining multiple MFT blocks.

Analysing the MFT by hand is not easy, so CnW Recovery have added a feature into the software so that an MFT sector is viewed, then moving the mouse over the data will display the decoded information. For more details, click here www.cnwrecovery.com/html/mft_parse.html.

Lost file or directory on NTFS

Occasionally a file, or complete subdirectory may go missing on an NTFS disk. The most common reason actually is operator error, maybe by accidently dragging adirectory into another directory. The way to recover from this situation is to search the disk for a known file, and then work out what has been moved where.

The same problem can also occur when a critical sector fails or is corrupted. This can leave the directory tree with a logical break, and so leave files with no correct location. CnW recovery software has a good solution to this problem. as part of the recovery options, it allows for recovery from file entries. It will either scan the known $MFT (NTFS directory file) for individual MFT entries, or it can scan the complete disk. When an MFT is found it is tested to see if the Master File Table entry is for a file or a directory. If for a file it is recovered, and the directory path then reconstructed as much s possible. For the files that have been lost, a dummy direvctory entry will be created, eg lostdir123, and all files related to the lost directory will be placed together. To find your lost file, either the recovered filoes can be searched, or the log examined to determine the new location

Recovery from a formatted disk

I occasionally receive disks that are perfectly valid, with intact files and file system. However, the history of them is that they have been reformatted,and the original files lost. To make things slightly worse, the file system may have been changed. Thus an original FAT32 disk couldnow be a NTFS or the other way around.

To help detect this, CnW Recovery software has a function on the partition scan that will count the number of MFTs (for NTFS) or directory clusters for FAT disks. It will often be clear at the end of the scan if there was a different file system on the disk at a previous time. It is then possible, using the partition manager to force the disk to act as a certain format, eg FAT32 or NTFS before recovering the files.

Often in instances where the file system has been changed, most of the critical file information will have been overwritten, but fortunately all file systems tend to use different areas of the disk so it possible that a complete MFT (NTFS directory sectors) may still be intact as may be many FAT32 directories. By analysing this remaining fragmenst, it is possible to determine the critical parameters before attempting a recovery.

Often a very complete recovery will be possible, as long as the disk has not been used too much after reformatting.

Undelete software

We all make mistakes, and deleted files, or directories is a common one. There are lots of software packages that claim to help, but some can actually make things worse, and all, if not used carefully can add to misery by permanately overwriting file that could have been recovered.

When a file is deleted the process is that either the directory entry is marked as deleted, or in the case of Macintosh systems, and some Unix file systems, the file name and details are also deleted. On most common systems (unless special scrubbing software is included) the data remains unchanged on the disk, but the area the data occupies is redesignated as unallocated. This means that any new file can use the space that was previously assigned to the deleted files. Unless you have the budget of the CIA and FBI combined, it is safe to say that an overwritten sector is just that, an previous data is lost for ever. The danger of downloading a data recovery, or undelete program onto the computer where files have been deleted, is very significant. There is no way to stop the program being copied to areas where the deleted files were, and so data will be lost for ever.

Any use of the computer, or even just leaving it one can cause files in unallocated space to be overwritten. For instance, virus checkers ar always having updates, and does Microsoft. Any web browsing generates many temporary files. Shut down must be as soon as possible. The only safe solution is to turn the computer off and remove the drive entirely. Any other approach, or delay increases the chance of permanant loss. Even shutting down the computer writes files. For many forensic investigations it is often suggested the best way is to literally pull the plug, and not try an organised shut down.

The safe solution is to remove the drive and set it up as a slave drive on a different computer running the undelete, or data recovery software. For critical application, or forensic investigation a write blocker should be used to ensure that no data is written to the slave drive.

When it comes to undelete software, gain it is very dangerous to atually try and undelete rather than recover the deleted files to a different drive. With a FAT device, the locations that the original file are stored in is delted when the file is marked as deleted. Undeleting will therefore just assume that the file is sequential - a good starting point, but not always true. Also, for FAT32 files, the starting point of the file is only partitally known, and very few recovery programs actually determine the correct location. Fortunately CnW Recovery does work out the correct location for files of a known type. See www.cnwrecovery.com/html/fat32.html for more details.