Scan of the Month
Forensic Analysis of A Recovered Diskette

Forensic Process





This section details the methods I used to obtain the data and to complete the analyis described in this report. Using a SunOS 2.7 I verified the md5 hashes for both scan26 and the scan26.zip download. No differences were found. The two files were write protected. A formatted diskette was placed in drive and the dd utility was used to copy the image onto the disk for later analysis:

dd if=scan26 of=/vol/dev/rdiskette0/unnamed_floppy
dd reported: 2880+0 records in 2880+0 records out

The diskette was ejected from the Sun, write protected and used with Virtual PC 4.0.2 running under MacOS 9.1. Virtual PC was running Windows 98 SE. The tool used for the analysis was WinHex 10.54 with a Usage level: Specialist. Before I used WinHex I inserted the floppy in Drive A. Drive A opened without error messages reporting 0 object(s) and 0 bytes. Under casual observation it would appear as if it were an unused, but formatted diskette.

Using WinHex I opened the physical floppy disk successfully showing it was a FAT 12 disk. I then used the file recovery by type disk tool that can retrieve files by headers and fixed file sizes directly from the data sectors of the disk. I began looking for doc or xls files: 0 headers were found 0 files were successfully retrieved indicating possibly that no Word documents or Excel spread sheets were present. I then used the file recovery by type disk tool looking for JPEG,JFIF files: Result: 1 header was found. 1 file was successfully retrieved using a fixed file size of 500,000 bytes. The file, file0000.jpg, in Internet Explorer showed a map with a green box with an X in it at Danny's Pier 12 Boat Lunch on Shore Line Drive. To see this map click on the "JPEG Image" link to the left under "Recovered Files" in "Contents."

I continued to look for files using the same tool and successfully found a BMP file with a similar map using a fixed file size of 1,400,000 bytes. The success came after two failed attempts with smaller file sizes(500 Kbytes and 1MB). The failed attempts retrieved a file that displayed in paint, showing only blank white pages. The 1.4 MB file allowed paint to display a coherent map. These are not the actual file sizes. It is advisable when recovering files by header without knowing much about the file to specify a file size that includes a footer or all the information needed to display the file. Applications will actually determine the end and display the information. As a first pass these techniques allow me to begin to answer the questions, but do not give me the locations on the disk the files occupy.

The BMP file showed a map including another green box marked with an X and labled with the letters "Hideout22 Jones" Near the corner of Jones Ave and Smith Street. To see this map click on the link to the left, "BMP as JPEG," prepared for convenience or click on the link, "Original BMP Image." I marked all the files I recovered as read only. I attempted file recovery for all file types the tool is designed to find which are numerous. I closed the physical drive and opened the floppy as a logical drive "Removable media(A:)" I wanted to examine the file system to see what Jimmy Jungle had done to it. I needed this insight to determine what else could be done to recover any additional information.

I noticed that both file allocation tables contained "00 00 00 00" through out all FAT sectors except for an initial code: F0 FF FF. This was true for both FAT 1 and FAT 2.

Browsing through root directory records did not show they had been deleted. Deleted files show an E5 in the first byte of the file name. In fact the code was "00" indicating the file system had never been used. At this point I began to suspect Jimmy Jungle had formatted his disk. For more details of this part of the analysis see "Jungle's Wizardry" under the "Scan 26 Report" to the left. The bonus question answer in the "Answers" link to the left introduces this subject matter.

Using the specialist tool, "Gather text" at a desired filesize of 1000000 bytes I collected 246 bytes of actual text and saved it as TextDriveA.txt and write protected it. At this point I got John Smith's mailing address. See "Text" under "Recovered Files" to the left.

I was not sure that all files were laid out in a contiguous fashion. The tools I had used so far only really work if there is no fragmentation. File parts could be orphaned within random non-contiguous sectors. File size, sector and offset information was used in mapping the image data for the files I had recovered. These would be the contiguous files (See "File Offsets" at the left). I manually searched for header codes,file sizes and footer codes in the disk editor. My mapping results, technical details and calculations can be viewed at the "File Offsets" link to the left. I provide in that page a diagram of the offset and sector mappings for where each file begins and ends for easy viewing.

The disk was examined from begining to end for additional text using the text search feature. No other text was found with that feature except boot sector text and John Smith's mailing address in sector 2739 at this stage of the analysis.

Once the disk map was created I could then look manually byte by byte within offsets "between" files. Those details are included in "File Offsets."