Disk Forensics and Anti-Disk Forensics
Dual Perspective: Blue team recovers evidence from disk → Red team ensures evidence is unrecoverable
⛔ In-Depth Reference
Part A: Blue Team Perspective — Disk Forensics
Phase 1: Evidence Acquisition
# 使用 dcfldd 完整镜像（含哈希校验）
dcfldd if=/dev/sdb of=/evidence/disk.dd \
hash=sha256 hashlog=/evidence/disk.sha256 \
bs=4096 conv=noerror,sync
# 使用 E01 格式（压缩+分片）
ewfacquire /dev/sdb -t /evidence/disk \
-c deflate -S 2G -e "Case INC-2025"
# 验证完整性
sha256sum /evidence/disk.dd
Phase 2: File System Analysis Decision Tree
文件系统类型？
├─ NTFS (Windows) → MFT分析 / USN Journal / $LogFile
├─ ext4 (Linux) → inode / journal / superblock
├─ APFS (macOS) → diskutil / apfs_parser
└─ FAT32 (USB) → 简单文件表 / 簇分析
Phase 3: Key Windows NTFS Artifacts
| Artifact |
Location |
Content |
| $MFT |
Volume root |
Metadata for each file (timestamps, size, path) |
| $UsnJrnl |
$Extend\ |
File change log (create/delete/rename) |
| $LogFile |
Volume root |
NTFS transaction log |
| Prefetch |
C:\Windows\Prefetch\ |
Program execution records (last 8 execution times) |
| Amcache |
C:\Windows\AppCompat\ |
First program execution + SHA1 |
| Shimcache |
Registry |
Program compatibility cache |
| LNK files |
Recent\ |
Recently accessed file records |
| Jump Lists |
CustomDestinations\ |
Taskbar program history |
| $Recycle.Bin |
Volume root |
Recycle Bin ($I=metadata $R=content) |
| VSS |
System Volume Information |
Volume Shadow Copy (historical snapshots) |
# Sleuth Kit 分析
fls -r -p /evidence/disk.dd # 递归列出文件（含已删除）
icat /evidence/disk.dd <inode> # 按 inode 提取文件内容
tsk_recover -r /evidence/disk.dd /output/ # 恢复已删除文件
# MFT 解析
python3 analyzeMFT.py -f \$MFT -o mft_output.csv
# 时间线生成
log2timeline.py /evidence/timeline.plaso /evidence/disk.dd
psort.py -o l2tcsv /evidence/timeline.plaso > timeline.csv
Phase 4: Key Linux ext4 Artifacts
| Artifact |
Content |
| /var/log/ |
System logs (auth.log, syslog, wtmp, btmp) |
| .bash_history |
Command history |
| /tmp/ |
Temporary files (commonly used directories by attackers) |
| crontab |
Persistence scheduled tasks |
| /etc/passwd + shadow |
Newly added accounts |
| journal (ext4) |
File system operation logs |
| inode timestamps |
atime/mtime/ctime/crtime |
Part B: Red Team Perspective — Anti-Disk Forensics
Strategy 1: Secure Deletion (Unrecoverable)
# ⛔ 普通 rm 只删除 MFT 条目，数据仍在磁盘！
# Linux 安全删除
shred -vfz -n 3 target_file # 多次覆写+零填充
srm -sz target_file # 安全删除
# Windows 安全删除
cipher /w:C:\path\ # 覆写可用空间
sdelete -p 3 target_file # Sysinternals 安全删除
# 内存文件系统操作（不触盘）
# Linux: 在 /dev/shm 或 tmpfs 操作
mkdir /dev/shm/.work && cd /dev/shm/.work
# Windows: 使用 Named Pipe / 内存 mapped file
Strategy 2: Timestamp Tampering (Timestomping / T1070.006)
# Linux: touch 修改 atime/mtime
touch -t 202301011200.00 malware.elf # 伪装成旧文件
touch -r /bin/ls malware.elf # 匹配合法文件时间
# Windows: PowerShell
$(Get-Item file.exe).CreationTime = "01/01/2023 12:00:00"
$(Get-Item file.exe).LastWriteTime = "01/01/2023 12:00:00"
$(Get-Item file.exe).LastAccessTime = "01/01/2023 12:00:00"
# ⛔ 注意：NTFS 有 4 组时间戳！
# $STANDARD_INFORMATION 的时间 → 上面的方法可改
# $FILE_NAME 的时间 → 只能通过 NTFS 底层操作修改
# 蓝队对比两组时间差异 → 发现 timestomping
Strategy 3: Artifact Removal Checklist
Windows 操作后清除：
├─ Prefetch → 删除 C:\Windows\Prefetch\TOOLNAME-*.pf
├─ Amcache → 删除注册表条目（需要 SYSTEM 权限）
├─ Shimcache → 内存中缓存，重启前修改注册表
├─ USN Journal → fsutil usn deletejournal /d C:
├─ Event Log → wevtutil cl Security/System/Application
├─ Recent/LNK → 删除 %APPDATA%\Microsoft\Windows\Recent\*
├─ Jump Lists → 删除 CustomDestinations\*
├─ $Recycle.Bin → 已手动删除就不进回收站
└─ Thumbcache → 删除 %LocalAppData%\Microsoft\Windows\Explorer\thumbcache*
Linux 操作后清除：
├─ .bash_history → unset HISTFILE 或 export HISTSIZE=0
├─ /var/log/ → 精准修改（不要清空，会被发现）
├─ wtmp/btmp → utmpdump → 编辑 → utmpdump -r
├─ auth.log → sed -i 删除特定行
├─ journal → journalctl --vacuum-time=1h
└─ /tmp/ 文件 → shred 后删除
Strategy 4: Best Practices — Reduce Traces from the Start
OPSEC 最优方案（预防 > 清除）：
├─ 工具不落盘 → 内存执行（反射加载/fileless）
├─ 使用 RAM 磁盘 → /dev/shm 或 tmpfs
├─ 操作前 unset HISTFILE → 不记录命令
├─ 使用 LOLBins → 不引入新文件
├─ 通过管道传输 → curl | python 不落盘
├─ 加密落盘文件 → 即使被发现也无法分析
└─ 最短驻留时间 → 用完即删
Comparison Table: Forensic Techniques vs Red Team Countermeasures
| Blue Team Methods |
Red Team Exposure |
Red Team Countermeasures |
| File recovery (icat/tsk_recover) |
Data still remains after rm |
shred/sdelete overwrite |
| Timeline analysis (plaso) |
Abnormal operation times |
timestomping |
| MFT analysis |
$FN timestamps unchanged |
Low-level NTFS operations or no disk writes |
| USN Journal |
File operation records |
Delete USN Journal |
| Prefetch analysis |
Tool execution records |
Delete .pf or do not use standalone EXE |
| Volume Shadow Copy |
Historical file snapshots |
vssadmin delete shadows |
| Log analysis |
Login/operation records |
Precise log line deletion (not clearing) |
