Shadow Warriors - SANS Computer Forensics

More documents

Recommendations

Info

6B 87 08 38 76 C1 48 4E B7 AE 04 04 6E 6C C7 52 01 00 00 00 04 00 00 00 8 bytes giving the index block's own file offset 8 bytes giving the index block's logical volume offset 8 bytes giving the logical volume offset for the next index block
Offset 128 of an index block 32 byte records referencing a data block Made up of 4x 8 byte values
Page 1 and 2: Shadow Warriors Lee Whitfield & Mar
Page 3 and 4: • 19+ years in IT Mark McKinnon
Page 5 and 6: What are Volume Shadow Copies?
Page 7 and 8: What Does This Mean?
Page 9 and 10: Shadow File Creation
Page 11 and 12: 16KB Block 16KB Block = Occupied 4K
Page 13 and 14: File Carve
Page 16 and 17: Anatomy of Volume Shadow Copies
Page 18 and 19: Index Blocks
Page 22 and 23: Bytes 0-7 contain the volume logica
Page 24 and 25: Bytes 28-31 All zeroes unless prece
Page 27 and 28: 4520914944 % 16384 = 12288
Page 29: 00 00 00 C0 15 00 00 00 00 80 77 0D
Page 32 and 33: Deleted, unallocated, and corrupt V
Page 34 and 35: Current Files
Page 37 and 38: • View the contents of the hard d
Page 39 and 40: Will run on XP upwards, OS X, and L
Page 41: Thank you twitter.com/shadowanalyze

Shadow Warriors - SANS Computer Forensics

Create successful ePaper yourself

Delete template?

Save as template?