disk-forensics

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Disk Forensics — Digital Evidence Analysis

Disk Forensics — 数字证据分析

Analyze disk images and file systems to recover evidence, reconstruct timelines, and identify artifacts.

Cross-references:

incident-triage

for the upstream containment phase that captures the image this skill analyzes — that skill makes the bit-for-bit copy; this skill analyzes it.

breach-patterns

for translating the forensic findings into preemptive controls so the same root cause doesn't recur.

分析磁盘镜像与文件系统，以恢复证据、重建时间线并识别artifact。

交叉参考：

incident-triage

用于捕获本技能所分析镜像的上游遏制阶段——该技能负责生成逐位副本；本技能负责分析。

breach-patterns

用于将取证发现转化为预防性控制措施，避免相同根源问题再次发生。

Authorization Check

授权检查

Before analyzing any image, confirm:

Lawful basis — the user has authorization for this analysis (internal investigation with documented scope, court-ordered work, signed IR engagement, your own system, CTF / lab environment)
Chain of custody is preserved — the image and its hashes were captured in a way that survives evidentiary scrutiny, OR the scope is explicitly non-evidentiary (CTF, internal triage where chain-of-custody is not the goal)
Privacy scope — the analysis stays within what was authorized; personal data outside the scope is not pulled, analyzed, or reported

If lawful basis is unclear, ask before proceeding. Never analyze an image you cannot confirm the user is authorized to possess.

在分析任何镜像之前，请确认：

合法依据 — 用户拥有进行此分析的授权（有文档记录范围的内部调查、法院委托工作、签署的事件响应协议、用户自有系统、CTF/实验室环境）
Chain of custody（监管链）得以保留 — 镜像及其哈希值的捕获方式可经受证据审查，或者明确范围为非取证用途（CTF、不要求监管链的内部排查）
隐私范围 — 分析严格遵循授权范围；不得提取、分析或报告超出范围的个人数据

若合法依据不明确，请在开展前询问。切勿分析无法确认用户有权拥有的镜像。

Evidence Handling Principles

证据处理原则

Always work on copies, never originals
Verify image integrity with hash comparison before analysis
Mount everything read-only
Document every command and finding
Preserve timestamps — never modify source evidence

始终使用副本进行操作，切勿触碰原始证据
分析前通过哈希对比验证镜像完整性
所有挂载均设为只读模式
记录每一条命令与发现
保留时间戳——切勿修改原始证据

Methodology

分析方法

Step 1: Image Identification and Integrity

步骤1：镜像识别与完整性验证

Identify the image format and verify integrity:

bash

file <image>                    # Identify format (E01, dd/raw, VMDK, VHD)
sha256sum <image>               # Compare to provided hash

For E01 images, use

ewfinfo

to extract metadata.

识别镜像格式并验证完整性：

bash

file <image>                    # 识别格式（E01, dd/raw, VMDK, VHD）
sha256sum <image>               # 与提供的哈希值对比

对于E01格式镜像，使用

ewfinfo

提取元数据。

Step 2: Partition Layout

步骤2：分区布局分析

Examine the partition structure:

bash

fdisk -l <image>                # Partition table
mmls <image>                    # Sleuth Kit partition layout

Calculate mount offsets:

sector_start × sector_size

检查分区结构：

bash

fdisk -l <image>                # 分区表
mmls <image>                    # Sleuth Kit分区布局

计算挂载偏移量：

sector_start × sector_size

Step 3: Mount and Explore

步骤3：挂载与探索

Mount read-only and survey the file system:

bash

mount -o ro,loop,offset=<bytes> <image> /mnt/evidence
ls -laR /mnt/evidence

For encrypted volumes, identify the encryption type and request the key/passphrase.

以只读模式挂载并检查文件系统：

bash

mount -o ro,loop,offset=<bytes> <image> /mnt/evidence
ls -laR /mnt/evidence

对于加密卷，识别加密类型并请求密钥/密码短语。

Step 4: File System Analysis (Sleuth Kit)

步骤4：文件系统分析（Sleuth Kit）

bash

fsstat -o <offset> <image>              # File system details
fls -r -o <offset> <image>             # Full file listing (deleted files marked with *)
icat -o <offset> <image> <inode>       # Extract specific file by inode

bash

fsstat -o <offset> <image>              # 文件系统详情
fls -r -o <offset> <image>             # 完整文件列表（已删除文件标记为*）
icat -o <offset> <image> <inode>       # 通过inode提取特定文件

Step 5: Artifact Recovery

步骤5：Artifact恢复

Deleted files: Use

fls

to find (marked with

icat

to extract by inode.

File carving: Run

foremost

scalpel

on unallocated space to recover files by header signatures.

Hidden data:

NTFS alternate data streams
HFS+ resource forks
Check image files for steganography:
```
exiftool
```
,
```
binwalk
```
,
```
steghide
```

System artifacts:

Browser history:

~/.mozilla

~/Library/Safari

AppData\Local\Google

System logs:
```
/var/log/*
```
, Windows Event Logs
Registry hives (Windows): SAM, SYSTEM, SOFTWARE, NTUSER.DAT
Recently accessed files, USB device history, prefetch files

已删除文件： 使用

fls

查找（标记为

），通过

icat

根据inode提取。

文件雕刻（File carving）： 在未分配空间上运行

foremost

或

scalpel

，通过文件头签名恢复文件。

隐藏数据：

NTFS替代数据流
HFS+资源分支
检查镜像文件中的隐写术：
```
exiftool
```
,
```
binwalk
```
,
```
steghide
```

系统Artifact：

浏览器历史记录：

~/.mozilla

~/Library/Safari

AppData\Local\Google

系统日志：
```
/var/log/*
```
, Windows事件日志
Windows注册表配置单元：SAM, SYSTEM, SOFTWARE, NTUSER.DAT
最近访问的文件、USB设备历史记录、预取文件

Step 6: Metadata and Timestamps

步骤6：元数据与时间戳

bash

exiftool <file>                 # EXIF, XMP, IPTC metadata
stat <file>                     # MAC times (Modified, Accessed, Changed)

For NTFS: examine

$MFT

timestamps and

$UsnJrnl

for change journal entries.

Use

mactime

(Sleuth Kit) to generate a unified timeline from body files.

bash

exiftool <file>                 # EXIF、XMP、IPTC元数据
stat <file>                     # MAC时间（修改时间、访问时间、变更时间）

对于NTFS文件系统：检查

$MFT

时间戳与

$UsnJrnl

变更日志条目。

使用

mactime

（Sleuth Kit）从body文件生成统一时间线。

Step 7: Keyword Search

步骤7：关键词搜索

bash

strings <image> | grep -i <keyword>    # Raw string search across image

Use

bulk_extractor

for automated extraction of emails, URLs, credit card numbers, and other structured data.

bash

strings <image> | grep -i <keyword>    # 跨镜像的原始字符串搜索

使用

bulk_extractor

自动提取电子邮件、URL、信用卡号及其他结构化数据。

Step 8: Timeline Construction

步骤8：时间线构建

Collect all timestamps into a unified timeline. Cross-reference file events with log entries. Flag anomalies:

Timestamps before the OS install date
Future-dated files
Gaps in otherwise continuous log sequences
Timestamps inconsistent with timezone settings

将所有时间点整合为统一时间线。将文件事件与日志条目交叉比对。标记异常情况：

早于操作系统安装日期的时间戳
未来日期的文件
连续日志序列中的间隙
与时区设置不一致的时间戳

Output Format

输出格式

markdown

undefined

markdown

undefined

Forensic Analysis Report

取证分析报告

Case: [identifier]

案件：[标识符]

Image: [filename] — SHA256: [hash]

镜像：[文件名] — SHA256: [哈希值]

Date of Analysis: [date]

分析日期：[日期]

Image Integrity

镜像完整性

Hash verified: [yes/no]
Algorithm: [SHA256]

哈希验证：[是/否]
算法：[SHA256]

Partition Layout

分区布局

#	Type	Start	Size	File System

#	类型	起始位置	大小	文件系统

Key Findings

关键发现

Finding 1: [Title]

发现1：[标题]

Evidence: [file path or artifact]
Content: [description]
Timestamp: [UTC]
Significance: [why this matters]

证据： [文件路径或Artifact]
内容： [描述]
时间戳： [UTC]
重要性： [此发现的意义]

Recovered Files

恢复的文件

File	Source	Recovery Method	SHA256	Significance

文件	来源	恢复方法	SHA256	重要性

Timeline

时间线

Timestamp (UTC)	Event	Source	Notes

时间戳（UTC）	事件	来源	备注

Conclusions

结论

[Summary of findings and their implications]

undefined

[发现总结及其影响]

undefined

Boundaries

边界限制

Work only on provided images and files
Maintain read-only access at all times
Document chain of custody for real investigations
For CTF challenges, focus on finding flags and solving the challenge
Never modify evidence or suggest evidence tampering
Refuse requests involving unauthorized device access

仅处理提供的镜像与文件
始终保持只读访问
为真实调查记录Chain of custody（监管链）
针对CTF挑战，专注于寻找flag并解决挑战
切勿修改证据或建议篡改证据
拒绝涉及未授权设备访问的请求

References

参考资料

NIST SP 800-86: Guide to Integrating Forensic Techniques
The Sleuth Kit documentation
SANS Digital Forensics cheat sheets

NIST SP 800-86：取证技术整合指南
The Sleuth Kit 文档
SANS 数字取证速查表