The Sleuth Kit
Let's considers the stages of the creation of a timeline for a filesystem.
The first step for creation of the timeline is building of body file.
There are three types of data to collect:
- Existing on filesystem files, which we could list with the
dir
orls
command. - Deleted files, which are deleted but structures of them still exist. This allows for recovering the full path and other attributes of the file. However, this depends on the filesystem, as not all filesystems allow this.
- Unallocated inodes
($Orphan
files), which are file structures which do not exist anymore.
To build a bodyfile, we will use the fls
tool from TSK. The fls
tool allows interacting with a forensics image as with the filesystem and extracting timeline data from the ...
Get Practical Windows Forensics now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.