Scan of the Month
Forensic Analysis of A Recovered Diskette

Jungle's Wizardry





It looks like Jimmy Jungle formatted his disk with a high level format reinitializing the boot sector and more importantly the two file allocation tables, FAT 1 and FAT 2 and the root directory. The original cluster chaining associated with each FAT was destroyed (zero'd out).

On a Windows system sectors are grouped together in a concept known as a cluster so that many sectors can be assigned to a file with a cluster reference. This is important for systems with large disks, because the FATs would grow huge if all the sectors were individually referenced for each file. A file's clusters are chained together. This information helps the Operating system find all disk sectors where data for each individual file is stored. Keep in mind that this is a FAT 12 floppy with one sector to a cluster.

Using the WinHex disk editor one can examine both FAT -- FAT 1 begining at offset 0x200 and FAT 2 beginning at offset 0x1400. They both appeared as they would in a new unused diskette. (For disk layout offsets and sectors see the "File Offsets" link to the left).

The root directory at base offset 0x2600 shows the 00 code indicating that the FAT directory entry has never been used. There is no partial file name and the rest of the fields appear as they would on a newly purchased pre-formatted diskette. That means Jimmy did much more than delete the files. Examining several more records yielded the same information.

At sector 33 where the first data sector should begin one finds all zeros on a newly purchased diskette (e.g. 00 00 00 00 00). However on the dfrws.org diskette the police recovered, there are many different hex values starting at sector 33 and extending two or three hundred sectors into the data area indicating the data is still resident on the disk.

Based on this information, I believe Jimmy Jungle did a high level disk format either hoping to destroy the information or hide it.

Finding the data was encouraging. There is only one sector per cluster on a floppy. I reasoned that on a diskette where only a few files were created and stored those files were probably layed down in a continguous fashion. Fragmentation occurs on a very active disk where files are created and deleted. Under those conditions chunks of files could be anywhere.

The "Find File by Type" WinHex feature allows the operator to find continguous files by the header codes and fixed filesizes. Applications used to view the files can find the footer or EOF marker, so knowing the exact file size is not necessary in most cases.