Carving and Live RAM analysis
The product allows you to perform a highly sophisticated analysis called "carving".
What is carving
Carving is a bit-precise sequential search of the drive for various artifacts. While carving, the product does not rely on the file system, and does not make use of “files” as they may have been deleted. Instead, it looks for particular sequences of bytes, or characteristic signatures specific to certain types of evidence. For example, Skype version 3 inserts the "l33l" signature before every chat message, so if this sequence is encountered on the disk, there is a high probability that a Skype chat message follows.
l33l signature precedes an actual Skype 3 chat message showт by HexViewer window
Carving is an indispensable technique while searching for deleted data and looking for destroyed evidence.
Please note that, unlike parsing existing files, carving is not a "precise" technique. Carving may return incomplete results (for example, data will not be found for a chat message) or "false-positive" hits. False positive results are possible when a signature is discovered that does not actually precede the data of interest. This may happen, for example, if you save a file with "l33l" text inside; the file will be incorrectly identified as a Skype message.
The product goes through the entire device (hard drive or drive image), and not just unallocated space, so some results may duplicate those you have already obtained by using regular file analysis.
How to start carving
To start carving, you can do either of the following:
- Run profile search for a physical or logical drive, drive or mobile device image, virtual machine, UFED dump or Live RAM image. If you select anything on the Select what to carve page, the product will carve selected data source along with regular (existing) file analysis.
- Click Carve Device toolbar button:
- Select Carve Device menu item of Edit main menu or Case Explorer context menu of case or evidence type node:
Once you did so, the Search profiles window will be open. The first page you can choose a data source to carve. This screen is similar to the first screen of Search Profiles wizard with the only difference that Selected folder option is disabled, because it does not have sense to carve a folder:
The following options are available:
- Logical drive. These are your logical hard drives with the names like "C:\". Each hard drive may have one or multiple logical drives presented in the combo box.
- Physical drive. These are your physical hard drives with the names like "\\.\PHYSICALDRIVE1". Each hard drive is presented by a single item in the combo box.
- Drive image file, virtual machine, UFED image, JTAG or chip-off mobile device dump. You can carve any image of the following types:
- Atola image (.img)
- Chip-off or JTAG dump in any format
- DD image
- DMG image
- EnCase image (.e01 and ex01)
- FTK image (.aff, .afd, .afm)
- SMART (.s01)
- Virtual machine file (.vmdk, .vdi, .vhd, .xva)
- UFED physical image of Android devices
- X-Ways container (.ctr)
- Live RAM image file. You can carve a raw image of a computer's live memory (.mem). There are a number of programs you can use to capture live memory from a computer, for example, free Belkasoft Live RAM Capturer tool. Our product also accepts the output of any of other RAM dumping tools on the market.
- Besides RAM image file, you can also specify a path to hibernation or page files
(hiberfil.sys and pagefile.sys). These two
kind of files may contain Live RAM data written on a hard drive as a part of
Windows functioning, thus they are important source of RAM artifacts, because
the RAM contents may survive switching computer off.
The file systems inside an image can be any Windows, Mac OS X, Android and
*nix ones: all FAT versions, NTFS, HFS/HFS+, ext2/ext3/ext4, YAFFS/YAFFS2.
There are also options what kinds of clusters to search within. You can decrease the time required to do analysis by searching only unallocated clusters (e.g. if you are looking for intentionally hidden data). However, sometimes carving for allocated clusters also gives good results, for example, if trails of data are kept in existing but corrupted file. It may not be possible to extract data from such file using regular history extraction because of corruption but carving may solve this problem. This is why the product allows you to choose where to carve: Unallocated only, Allocated only or both using options under What clusters to analyze?
Note: carving network drives/shares is not supported
yet. This applies to VMWare shared folders as well.
The check box called Start extraction for found profiles will
start carving, if checked, right after you close the wizard by clicking on
Finish button. If you have this check box unchecked, the selected
data source (a drive or an image) will be added to Carved data
node of Case Explorer, but the information will not be extracted.
You can extract the information from this source later by clicking Extract
data for all profiles context menu item of the corresponding node or
Extract data... menu item of Edit main menu.
On the second page of this wizard, you can select evidence types to look for:
Click Finish button to start carving. The results of the carving are presented
in the process of carving, so you can navigate to already retrieved results and
examine their properties using Item List and Item Properties.
Belkasoft Live RAM Capturer