In FAT16 and FAT32, the table used to store cluster/file information is the file allocation table (FAT), thus the name of the file system. The file allocation table is really a list of entries that map to each cluster on the disk partition. Each entry records one of five things:

1. The cluster number of the next cluster for this file is recorded.

2. If this cluster is the end of a chain, then it has a special end of cluster chain (EOC) entry.

3. Bad clusters have a special entry in the file allocation table.

4. Reserved clusters have a special entry in the file allocation table.

5. Open, or available, clusters are also marked in the file allocation table.

When a file is deleted, the data is not actually removed from the drive. Rather, the FAT is updated to reflect that those clusters are no longer in use. If new information is saved to the drive, it may be saved to those clusters, overwriting the old information. What this means from a forensic point of view is that the more recently a file was deleted, the more likely you will be able to recover the file. Over time, it becomes more likely that those clusters have had other information saved in them. In fact, the cluster may have been deleted and saved over several times. Because of this, recovering a deleted file is not always an all-or-nothing procedure. It is possible to recover just a portion of a file.

Starting with Windows 2000, NTFS has been the preferred file system for Windows operating systems. NTFS is an acronym for New Technology File System. From a forensic point of view, there are two fundamental files that are part of NTFS that are of most interest. These are the Master File Table (MFT), which some sources call the Meta File Table, and the cluster bitmap. The MFT describes all files on the volume, including filenames, timestamps, security identifiers, and file attributes, such as read-only, compressed, encrypted, and so on. This file contains one base file record for each file and directory on an NTFS volume. It serves the same purpose as the file allocation table does in FAT and FAT32. The cluster bitmap file is a map of all the clusters on the hard drive. This is an array of bit entries where each bit indicates whether its corresponding cluster is allocated/used or free/unused.

When files are deleted from an NTFS system, the process is similar to what occurs in FAT. The main difference is that clusters are first marked as deleted, thus “moved” to the Recycle Bin. In NTFS prior to Vista, the Recycle Bin resides in a hidden directory called RECYCLER. In Vista, Windows 7, Windows 8, and Windows 10, the name of the directory was changed to $recycle.bin. Only when you empty the Recycle Bin is the cluster marked as fully available. More specifically, when a file is deleted, the filename in the MFT is marked with a special character that signifies to the computer that the file has been deleted. Even at this point, not a single bit is actually deleted. The MFT is simply updated to note that the clusters in that file are deleted. This means that at this point, one can completely recover the entire file. There are any number of file recovery utilities available for this purpose. Just as with FAT systems, clusters in an NTFS system are more likely to be overwritten as more time elapses after deletion.

When files are deleted from an NTFS system, the process is similar to what occurs in FAT. However, there is one difference. Before the cluster is marked as available it is first marked as ‘deleted,’ which effectively moves it to the recycle bin. Note that not a single bit is actually deleted. The clusters are simply noted as being in the recycle bin. Before Windows Vista, the Recycle Bin resided in a hidden directory called RECYCLER. In Vista and beyond, the name of the directory was changed to $Recycle.bin. When a user empties the recycle bin is the cluster marked as fully available. However,

In digital forensics, it is often the case that you will analyze older systems as well as newer systems. So, when discussing how Windows handles deleted files, let’s first examine Windows XP. With Windows XP, the Recycle Bin keeps an associated file named INFO2. This file is used to keep track of the deleted files’ or folders’ original location, as well as file size and deletion time. This way it is possible to restore a file from the Recycle Bin. When you delete a file, the INFO2 list looks like this:

• D%DriveLetter%_%IndexNumber%_%FileExtension%.

• The “D” stands for Drive.

• %DriveLetter% is the drive that the file was on before it was deleted.

• %IndexNumber% is a number assigned to each file or directory that is sent to the Recycle

• Bin, and indicates the order of deletion.

• %FileExtension% is the original file extension. If it is a folder, there will be no extension.

In Windows 7 and Vista, Microsoft did away with the INFO2 file. Starting with Vista, the Recycle Bin is located in a hidden directory named $Recycle.Bin\%SID%, where %SID% is the SID (Security Identifier) of the user that performed the deletion. When files are moved into the Recycle Bin, the original file is renamed starting with $R, followed by a set of random characters, but maintaining the original file extension. Also, a new file is created beginning with $I followed by the same set of random characters given to the $R file and the same extension; this file contains the original filename/path, original file size, and date and time the file was moved to the Recycle Bin. Note that all of the $I files are exactly 544 bytes long.

In Windows 7 and Vista, The $I structure is as follows:

• Bytes 0–7—$I file header—always set to 01 followed by seven sets of 00.

• Bytes 8–15—Original file size stored in hex, in little-endian.

• Bytes 16–23—Deleted date/time stamp represented in number of seconds since midnight, January 1, 1601. Use a program such as Decode to assist with figuring out the exact date/time, if you don’t want to do the math.

• Bytes 24–543—Original file path/name.

File systems view a cluster as entirely utilized if even 1 bit is used. To illustrate this, assume that a system has a sector size of 4096 bytes. Then further assume that it is using a cluster size of 10 sectors. This means each cluster has a total of 40,960 bytes of storage. If the user saves a file that is 42,000 bytes in size, the file system will need to utilize two clusters. All 10 sectors of the first cluster are used, but only one sector of the second cluster is used. From the file system’s point of view, and thus the operating system’s point of view, both clusters are completely used. The space between where a file actually ends and the end of the cluster (if the file does not take up 100% of the cluster) is called slack space. This is illustrated in FIGURE 6-2

FIGURE 6-2
Cluster usage.

There are a number of mechanisms for recovering deleted files. Most major forensics tools such as Encase, Forensic Toolkit (FTK), and OSForensics will recover deleted files.

A number of tools are available specifically to recover deleted files from Windows computers. This section introduces a few of these tools. You should definitely take the time to explore the various tools available and select the one you prefer. Simply using your favorite search engine to look for “how to recover deleted Windows files” will result in a number of tools you can try. Many are free, and those that are not usually have a trial version with which you can experiment.

DiskDigger

DiskDigger (http://diskdigger.org) is an easy-to-use tool. It can be downloaded free of charge and is fully functional. But when recovering files in the free version, you have to recover them one at a time. If you pay for the commercial version, you can recover as many files at one time as you want. The interface is very easy to use. When you launch the program, you see a screen like the one shown in FIGURE 6-3. Then you select the drive you want to examine, and choose Dig Deep or Dig Deeper, as shown in FIGURE 6-4. The difference is the level of recovery.

Once recovery is done, you will see a screen like the one shown in FIGURE 6-5. You can select any file and recover it. On your screen the files will be in color. For files in green, you should get the entire file back. Gray indicates a partial file, and red indicates very little of the file is left. You can view and recover individual files from this screen.

WinUndelete (http://www.winundelete.com/download.asp) is another tool that is relatively easy to use. When launched, it starts a wizard that first asks you to select which drive to recover. This is shown in FIGURE 6-6. Step 2 allows you to select the file types you want to recover. This is shown in FIGURE 6-7. The third step is to select a folder in which to place recovered files. You can see this in FIGURE 6-8.

When WinUndelete has completed running the recovery process, you can go to that folder to see the files.

FreeUndelete (http://www.officerecovery.com/freeundelete/) is free for personal use; however, there is a fee for commercial use. When you launch this program, the first screen requires you to select the drive from which you want to recover files. This is shown in FIGURE 6-9. Then you simply click the Scan button, and any files that can be fully or partially recovered will be listed.

OSForensics is a robust forensics tool that also provides for undeletion. You can undelete from an image you have mounted, or from the live system. You can find the Deleted Files search on the menu on the left side of the main OSForensics screen, as shown in FIGURE 6-10. The search result will be color-coded, indicating how likely it is that you can recover a given file. Obviously, some files will be so fragmented that recovery is unlikely. You can see this in FIGURE 6-11.

This method depends on manually recovering deleted files using Linux commands. It does not require external tools. Unfortunately, there are variations among the Linux distributions, so there is no guarantee that this process will work on your specific Linux installation.

The first step is to move the system to single-user mode. If this is a network system, you should probably notify network users first. This can be done with the wall command, which sends messages to all logged-in users.

Then, you can move to single-user mode, using the init command:

init 1

The Linux/UNIX command grep can be used to search for files, contents of files, and just about anything you may want to search for. The grep command is very flexible and quite popular with Linux users. For example,

grep -b 'search-text' /dev/partition > file.txt

will search for ‘search-text’ in a given partition and output the results to file.txt. You can also use this syntax:

grep -a -B[size before] -A[size after] 'text'
/dev/[your_partition] > file.txt

To recover a text file starting with the word forensics on /dev/sda2, you can try the following command:

# grep -i -a -B10 -A100 'forensics' /dev/sda2 > file.txt

In this case, grep is searching for this phrase, ignoring case, looking through binary files, and essentially looking to find the text, even if the file has a reference count of zero (i.e., has been deleted). Of course, if the file blocks have been overwritten enough times, then it will be irrecoverable.

extundelete /dev/sda4 --restore-all

This tool works with both Linux and Mac OS, and it is even possible to compile the source code to work in Windows. However, it is easiest to install and work with in Linux. For example, if you are using Ubuntu Linux, this is all it takes to install:

sudo apt-get install scalpel

Next is some text editing—the configuration file is /etc/scalpel/scalpel.conf. You will find that everything has been commented out—uncomment the specific file format that you want to recover. For example, if you want to recover deleted Zip files, then you need to uncomment the .zip file section in scalpel.conf.

Next, in a terminal, run the following command:

sudo scalpel [device/directory/file name] -o [output directory]

The output directory, in which you want to store recovered files, should be empty before running Scalpel; otherwise, you will get an error.

MacKeeper (http://www.data-retrieval.net/osx/mackeeper-files-recovery.html) is a useful tool for recovering deleted files on a Macintosh computer. There is a free, fully functional trial version. Once you download and install this tool, you can recover files in just a few easy steps:

1. Open the Files Recovery tool. Select the volume where your lost files were and start the scan. This is shown in FIGURE 6-12.

2. Then select Undelete, shown in FIGURE 6-13.

That is it. This tool is remarkably simple to use.

There are certainly other tools that can recover Macintosh deleted files. You should experiment with various tools and find the one(s) that are most useful for you. As always, you should be comfortable with a given operating system before attempting forensic analysis of that operating system.