Analisando Espaço de Slack e Artefatos do Sistema de Arquivos

Quando Usar

• Ao procurar por dados ocultos ou residuais no espaço de slack do sistema de arquivos
• Para analisar entradas da Tabela Mestra de Arquivos (MFT) do NTFS em busca de metadados de arquivos excluídos
• Ao reconstruir operações de arquivos a partir do USN Change Journal
• Para detectar Fluxos de Dados Alternativos (ADS) usados para ocultar dados ou malware
• Durante análises forenses profundas que exigem exame além da recuperação padrão de arquivos

Pré-requisitos

• Imagem forense de disco com sistema de arquivos NTFS
• Ferramentas do The Sleuth Kit (TSK): istat, icat, fls, blkls, blkstat
• MFTECmd (Eric Zimmerman) para análise de MFT
• MFTExplorer para análise interativa de MFT
• Compreensão das estruturas NTFS (MFT, $UsnJrnl, $LogFile, ADS)
• Python com a biblioteca analyzeMFT ou mft para análise automatizada

Fluxo de Trabalho

Passo 1: Identificar e Extrair Artefatos do Sistema de Arquivos NTFS

# Determine partition layout
mmls /cases/case-2024-001/images/evidence.dd

# Extract key NTFS system files
# $MFT - Master File Table
icat -o 2048 /cases/case-2024-001/images/evidence.dd 0 > /cases/case-2024-001/ntfs/MFT

# $UsnJrnl:$J - USN Change Journal
icat -o 2048 /cases/case-2024-001/images/evidence.dd 62-128 > /cases/case-2024-001/ntfs/UsnJrnl_J

# $LogFile - Transaction log
icat -o 2048 /cases/case-2024-001/images/evidence.dd 2 > /cases/case-2024-001/ntfs/LogFile

# Extract all slack space from the volume
blkls -s -o 2048 /cases/case-2024-001/images/evidence.dd > /cases/case-2024-001/ntfs/slack_space.raw

# Get file system information
fsstat -o 2048 /cases/case-2024-001/images/evidence.dd | tee /cases/case-2024-001/ntfs/fs_info.txt

Passo 2: Analisar a Tabela Mestra de Arquivos (MFT)

# Parse MFT with MFTECmd (Eric Zimmerman)
MFTECmd.exe -f "C:\cases\ntfs\MFT" --csv "C:\cases\analysis\" --csvf mft_analysis.csv

# Parse with analyzeMFT (Python)
pip install analyzeMFT

analyzeMFT.py -f /cases/case-2024-001/ntfs/MFT \
   -o /cases/case-2024-001/analysis/mft_analysis.csv \
   -c

# Custom MFT analysis with Python
python3 << 'PYEOF'
from mft import PyMft
import csv

mft = PyMft(open('/cases/case-2024-001/ntfs/MFT', 'rb').read())

deleted_files = []
suspicious_files = []

for entry in mft.entries():
    if entry is None:
        continue

    filename = entry.get_filename()
    if filename is None:
        continue

    is_deleted = not entry.is_active()
    is_directory = entry.is_directory()
    created = entry.get_created_timestamp()
    modified = entry.get_modified_timestamp()
    mft_modified = entry.get_mft_modified_timestamp()
    size = entry.get_file_size()

    # Flag deleted files for recovery
    if is_deleted and not is_directory and size > 0:
        deleted_files.append({
            'filename': filename,
            'size': size,
            'created': str(created),
            'modified': str(modified),
            'entry_number': entry.entry_number
        })

    # Detect timestomping (MFT modified time != $SI modified time)
    si_modified = entry.get_si_modified_timestamp()
    fn_modified = entry.get_fn_modified_timestamp()
    if si_modified and fn_modified:
        if abs((si_modified - fn_modified).total_seconds()) > 86400:  # >1 day difference
            suspicious_files.append({
                'filename': filename,
                'si_modified': str(si_modified),
                'fn_modified': str(fn_modified),
                'delta': str(si_modified - fn_modified)
            })

print(f"=== DELETED FILES (recoverable metadata) ===")
print(f"Total: {len(deleted_files)}")
for f in deleted_files[:20]:
    print(f"  [{f['modified']}] {f['filename']} ({f['size']} bytes)")

print(f"\n=== POTENTIAL TIMESTOMPING ===")
print(f"Total suspicious: {len(suspicious_files)}")
for f in suspicious_files[:10]:
    print(f"  {f['filename']}: $SI={f['si_modified']}, $FN={f['fn_modified']} (delta: {f['delta']})")
PYEOF

Passo 3: Analisar o Espaço de Slack em Busca de Dados Ocultos

# Procurar strings no espaço de slack
strings -a /cases/case-2024-001/ntfs/slack_space.raw > /cases/case-2024-001/analysis/slack_strings.txt

# Procurar padrões específicos no espaço de slack
grep -iab "password\|secret\|confidential\|credit.card\|ssn" \
   /cases/case-2024-001/ntfs/slack_space.raw > /cases/case-2024-001/analysis/slack_keywords.txt

# Analisar o slack de arquivos individuais
python3 << 'PYEOF'
import struct

# O slack de arquivo consiste em:
# 1. Slack de RAM: bytes entre o final do arquivo e o próximo limite de setor (preenchido com conteúdo de RAM ou zeros)

…