Carving and Live RAM analysis
The product allows you to perform a kind of analysis called "carving".
What is carving
Carving is a byte-by-byte sequential search of a drive for various artifacts. While carving, you do not rely on files as they may be deleted. You look for particular signatures or patterns which may indicate that some interesting data is kept here, for example, a chat message. For example, Skype version 3 has a sequence of bytes 'l33l' before each chat message, so if you found this sequence, there is a high probability that a Skype chat message follows:
l33l signature precedes an actual Skype 3 chat message showт by HexViewer window of Belkasoft Evidence Center
Carving is an indispensable technique, while searching for deleted data.
Please, note, that carving is not a 'precise' technique, unlike parsing regular history files. Carving may give you incomplete results (for example, date will not be found for a chat message) or so-called 'false-positive' (when you found a signature which is actually does not precede history of interest, for example, if you save a file with ' l33l' text inside, it will be determined as a Skype message).
The product goes through an entire device (a hard drive or a drive image), not only through unallocated space, so it can give you some results which you have already obtained by using regular history file analysis.
How to start carving
To start carving, you can do one of the following:
- Click Carve Device toolbar button
- Select Carve Device menu item of Edit main menu or Case Explorer context menu of case or history type node
Once you did so, the Carve Device wizard will be open:
The first page you can choose a source to carve. This screen is similar to Search Profiles first wizard screen with the only difference that Selected folder option is disabled, because it does not have sense to carve a folder:
The following options are available:
- Logical drive. These are your logical hard drives with the names like "C:\". Each hard drive may have one or multiple logical drives presented in the combo box.
- Physical drive. These are your physical hard drives with the names like "\\.\PHYSICALDRIVE1". Each hard drive is presented by a single item in the combo box.
- Drive image file. You can carve any image of the following types:
- Encase (E01 and Ex01)
- SMART (S01)
Live RAM image file. You can carve a raw image of a computer's
live memory (.mem). There are a number of programs you can use to capture live
memory from a computer, for example, win32dd/win64dd, EnCase, FTK Imager and
so on. Our product accepts the output of any of these programs.
Besides RAM image file, you can also specify a path to hibernation or page files (hiberfil.sys and pagefile.sys). These two kind of files may contain Live RAM data written on a hard drive as a part of Windows functioning, thus they are important source of RAM artifacts, because the RAM contents may survive switching computer off.
The file systems inside an image can be any Windows, Mac OS X and *nix ones: all FAT
versions, NTFS, HFS and HFS+, ext2 and ext3.
There are also options what kinds of clusters to search within. You can decrease the time required to do analysis by searching only unallocated clusters (e.g. if you are looking for intentionally deleted data). However, sometimes carving for allocated clusters also gives good results, for example, if trails of data is kept in existing but corrupted file. It may not be possible to extract data from such file using regular history extraction because of corruption but carving may solve this problem. This is why the product allows you to choose where to carve: Unallocated only, Allocated only or both using options under What clusters to analyze?
Please note, that carving network drives/shares is not supported
yet. This applies to VMWare shared folders as well.
The check box called Start carving after wizard finishes will
start carving, if checked, right after you close the wizard by clicking on
Finish button. If you have this check box unchecked, the selected
data source (a drive or an image) will be added to Carved data
node of Case Explorer, but the information will not be extracted.
You can extract the information from this source later by clicking Extract
history context menu item of the corresponding node or Extract
history menu item of Edit main menu.
On the second page of this wizard, you can select history types to look for:
Unlike history extraction for instant messengers and browsers, the results of the carving will be presented in the process of carving, so you can navigate to already retrieved results and examine their properties using Item List and Item Properties.
Please see Setting Yahoo name if you are carving for Yahoo! Messenger artifacts.