2

I am currently investigating a disk image with a FAT12 file system for data recovery purpose/researching for image file carving. For this investigation, I have the actual files (JPEG images) that need to be carved/recovered from the disk image so that I can validate my results obtained from the carving process/recovery.

During the comparison and analysis from the recovered files, I noticed that exactly between two consecutive clusters (each of size 16384 bytes/32 sectors) of file data, 4 extra/embedded bytes are being encountered. These repetitive and distinct 4 bytes that are being encountered between clusters are not found in the corresponding actual files. I think that these bytes are used somehow by the file system and hence they should be removed, is this right? If yes, what is their purposes and how can be identified during the recovery process?

In fact, when I analyzed the same disk image using Autopsy the embedded 4 bytes between consecutive clusters were discarded.

Hex dump:

Actual File that needs to be recovered from disk (hex between 2 clusters):

Offset      0  1  2  3  4  5  6  7   8  9 10 11 12 13 14 15

00016336   BC 55 B4 F8 A5 E1 69 82  2A DD 4A 5D DC 46 B9 80   ¼U´ø¥ái‚*ÝJ]ÜF¹€
00016352   E1 33 D3 F9 76 AE 8A 79  2E 22 0F 58 EE 67 FD AD   á3Óùv®Šy." Xîgý­
00016368   49 E9 7B 76 45 99 3E 25  69 36 F2 00 8B 71 70 C0   Ié{vE™>%i6ò ‹qpÀ
00016384   FC BB 6D 65 E9 DC F2 30  7E BD 6A B4 BF 17 52 0B   ü»meéÜò0~½j´¿ R 
00016400   64 9A 2D 13 58 B8 0E FB  13 65 9B 1E 87 93 F9 00   dš- X¸ û e› ‡“ù 
00016416   7F 11 55 4F 21 AD A7 3A  51 D7 B9 CF 3C DE 35 25    UO!­§:Q×¹Ï<Þ5%

Disk Image:

Offset      0  1  2  3  4  5  6  7   8  9 10 11 12 13 14 15

00132880   BC 55 B4 F8 A5 E1 69 82  2A DD 4A 5D DC 46 B9 80   ¼U´ø¥ái‚*ÝJ]ÜF¹€
00132896   E1 33 D3 F9 76 AE 8A 79  2E 22 0F 58 EE 67 FD AD   á3Óùv®Šy." Xîgý­
00132912   49 E9 7B 76 45 99 3E 25  69 36 F2 00 8B 71 70 C0   Ié{vE™>%i6ò ‹qpÀ
00132928   08 B5 A9 88 FC BB 6D 65  E9 DC F2 30 7E BD 6A B4    µ©ˆü»meéÜò0~½j´
00132944   BF 17 52 0B 64 9A 2D 13  58 B8 0E FB 13 65 9B 1E   ¿ R dš- X¸ û e› 
00132960   87 93 F9 00 7F 11 55 4F  21 AD A7 3A 51 D7 B9 CF   ‡“ù  UO!­§:Q×¹Ï
00132976   3C DE 35 25                                        <Þ5%

From the above hex dump it can be visualized that 08 B5 A9 88 is exactly between the two clusters, however in the actual file those 4 bytes were eliminated.

This case was encountered while recovering JPEG images from nps-2009-canon2-gen6 disk image

2

Your files aren't plain disk images, they are using the Encase File Format. Your repetitive bytes seem to be artifacts of that file format.

There's a newer specification of the file format as well, but it requires registration.

Autopsy probably recognizes the file format, so it removes the parts of the file that belong to the file format, not the sector dump data.

  • As it was mentioned, the repetitive bytes are embedded by the Encase File Format. Basically, the embedded bytes are stored every 32KB (in my case every 2 clusters) and serve as CRCs checks for each data block - refer to Encase Image file format – Bran Mar 13 '15 at 20:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.