HASHING FILE WITH MD5 HASH AND HOW TO USE IT?

MD5 HASH This program is used to compute and check message digest MD5 (Message Digest Algorithm 5). md5sum hash function is often used in cryptography and computer forensics to check the integrity of the file. MD5 is an Internet standard (RFC 1321). In addition to using the md5sum hashing can also use the sha1sum, sha224sum, sha256sum, sha384sum, sha512sum. While for the sum and cksum can only be used to view the file size in bytes. 

At this session I will try to check the two files in one folder, and then one file editing is done by removing the space between two words. First step will create two file.

Create different file and save with the name testfile1 and testfile2:

testfile1

testfile2

Next, lets use md5sum to hashing this file.

Hashing md5sum

In the picture above there are two types use the md5sum :

• The first md5sum check on all files located in folder hashing.

• The second with the md5sum check on each files

The results of the two files above hashing is an md5 hash of the first column of size 32 character hexadecimal.  To prove that the md5sum to check the validity and integrity of a file then I will do the editing in one file (testfile2) by deleting the existing space between two words. In th

Editing testfile2

Further to check the validity of all existing files in the folder hashing.

md5sum validity

The result is testfile1 OK its means this file valid (the file unedited), and the second file with the name testfile2 is Failed its means this file is already modification or edited by someone so the checksums of testfile2 after and before editing did not match. Check with each files.

md5 hash testfile2 after edited

md5 hash testfile2 before edited

Look this hexadecimals before file edited and after file edited did not match !.

3GP FILE STRUCTURE FOR DIGITAL FORENSIC BASICS

3GP its one of many kinds digitall video format becoming a more common from digital evidence with increasing prevalence of video in th computers, mobile devices and cameras. Thye basic of 3GP file stucture is 3GP have "Boxes" . Generally 3GP file contains the file type box ((ftyp), the Movie Box (moov), and the Media Data Box (mdat). Boxes start with a header, which indicates both size and type (these fields are called, namely, "size" and "type").The movie box (moov) contains track boxes (trak) include information abaut track. A track box contains the track header boc (tkhd), media header box (mdhd) and media information box (minf).

It is example of file carving limitations known file header in order to salvage deleted data. 

Hex View 3gp Header in Motorola flash Memory DUmp

3GP in this example, a file carving that searched in the Motorola V3 Memory dump for several 3GP header signatures found two files in as shown in the audit log :

 source :
forensic analisys 
basic structure 

MAGIC NUMBER FOR DIGITAL FORENSIC BASICS

Magic Number is a number embedded at or near the beginning of a file that indicates its file formats. It is also sometimes referred to as a file signature. It is a special data located at the begining of a binary data file to indicate ia type to a utility. Magic numbers are generally not visible to users. However, they can easily be seen with the use of a hex editor, which is a specialized program that shows and allows modification of every byte in a file. 

Magic numbers is important to purpose significance of additional knowledge.  

UNALLOCATED SPACE FOR COMPUTER FORENSIC BASICS

First time when you format the hard drive first term there is "unallocated space", or when you are going to partition your hard disk to the file system will see unallocated space. Is it? UNALLOCATED SPACE is cluster of a media  partition not in use for storing any active files. They may contain pieces of files that were deleted from the file partition but not removed from the physical disk (Free Space). Free space it used to allocated to file system. Learn more

SLACK SPACE FOR FORENSIC BASICS

To start the computer forensic session there are some things you need to understand one of them is the understanding about file system. Why? Because computer forensics is not separated from the file system and the file system. The file system located on the hardrive (storage device). In the hard drive (storage devvice) we often hear the term slack space. What is the meaning of "SLACK SPACE"?.

SLACK SPACE is the unused space between the end of the actual file and the end of the the defined data unit (cluster) or a remnant of data that exists within a sector of data that has been overwritten. Specifically, slack space is the area of the sector that was not fully overwritten by a recent write to disk. Or each file always starts at the beginning of a cluster because this simplifies organization and makes it easier to grow files. Any space left over between the last byte of the file and the first byte of the next cluster is a form of internal fragmentation called file slack, slack space, or cluster overhang. for example, if you wrote 3K of data to a 64K sector, the remaining 61K of data would not be reused. Instead, this unused sector space would still contain whatever data was written to it previously.

So "Slack space is a very important source of evidence in computer forensic investigation" 

FILE SYSTEM

filesystem is a method to manage of storing and organizing files or computer storage media in regulating the location of the file. filesystem provides procedures for storing, retrieving and updating data, and manage the available space on the devices that contain it.

File system on :

• Linux (ext2, ext3, ext4, XFS, JFS, ReiserFS, btrfs.
• Mocrosoft Windows (FAT, NTFS, ExFAT, ref.

File System Function is used to add a name of file and put it on the storage media. The other function is as a file name convention and the laying of the file to the directory structure.

FAT (File Allocation Table) 
Is a File System that uses to allocation file into table structure as a way to operate.

FAT16

FAT16 is one of many kinds file system format which has a limit of up to 16-bit. FAT16 is a fixed amount of capacity in the cluster partition, so the bigger the hard drive, then the cluster size is increased. FAT16 does not support the lack of compression, encryption dankontrol access the partition 

FAT32

FAT32 is a file system that uses the allocation unit that has a limit of up to 32-bit.  FAT32 advantage is the ability to accommodate a larger number of clusters in the partition. However, the disadvantage of using File System This is a limitation of the Operating System that can recognize FAT32.

Structure

NTFS

As in other file systems, NTFS also share all the places on the disk in the form of clusters. Cluster data blocks are used at the time. NTFS support for all cluster sizes, from 512 bytes to 64 Kilo Bytes. However, the standard cluster size is 4 Kilo Bytes. Here is the default size for the cluster in NTFS:

When formatting using the NTFS file, made ​​some file system and Master File Table (MFT) which contains information about all files and directories on that partition. The first information contained on that partition using the NTFS is Partition Boot Sector, which starts at sector 0 and sector length can reach 16. The first file contained on the partition using the NTFS Master File Table (MFT).

Ext2 – Second Extended File System 2

The Ext2 File system purpose to create a powerful file system, which can implement those files from UNIX semantics, and has advanced features of service.

 abilities:

• Ext2 file system capable of supporting multiple file types from UNIX standard, such as regular files, directories, device special files and symbolic links.

• Ext2 able to manage system files are created in a large partition.

• Ext2 file system capable of generating file names are long. Maximum of 255 characters.

• Ext2 require several blocks to super user (root).

EXT3

Ext3 is a filesystem that was developed for use on the Linux operating system. Ext3 is the result of improvement of Ext2 Ext2 into better shape by adding a variety of advantages.
 

Abilities: 

• Ext3 does not support the process of checking the file system, even when the system is not cleaned experiencing "shutdown", except in some very rare hardware errors.
• Things like this happen because the data is written or stored into a disk in a way so that the file system is always consistent.
• The time required to recover EXT3 file system after the system is not cleaned off
• Is independent of the size of the file system or file number, but depends on the size of the "journal" used to maintain consistency. Journal of the size of the initial (default)
• Requires about 1 second to recover (depending on the speed of hardware).

 

MBR (MASTER BOOT RECORD)

Master Boot Record (MBR) 

Master Boot Sector is known as one of the most important sector in a PC hard drive that stores information for the boot process and loading the operating system.

MBR is a special place which leads to a hard drive, the MBR will be automatically made ​​when you first partition the hard drive. You could say MBR is the sector of the filesystem. because there is a MBR partition table that lists the partitions

MBR is a place where information about the number of partitions, partition type, the allocation of the BIOS can load the initial boot to the process of loading the operating system.

The master boot record contains the following structures: 

Master Partition Table: This small bit of code that is referred to as a table contains a complete description of the partitions that are contained on the hard disk.

Master Boot Code: The master boot record is the small bit of computer code that the BIOS loads and executes to start the boot process.

When the PC (turn on) -> processors begin processing -> here MBR task is:
- Look for the active partition to the partition table is intended for the boot process) in the partition table
- Find the first sector of the partition being active to get the boot sector of partition
- Contains a copy of boot sector of the active partition into memory
- Giving further control to the executable code in the boot sector