[sleuthkit-users] What's the difference between foremost and manual extraction using dd and sleuthk

SourceForge Headquarters 1320 Columbia Street Suite 310 San Diego, CA 92101 +1 (858) 422-6466

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
  <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<div class="moz-text-flowed"
 style="font-family: -moz-fixed; font-size: 15px;" lang="x-western">Hi
list,
<br>
<br>
I'm running some tests on an image with foremost and dd and I bumped
upon this which I can't really explain:
<br>
<br>
#istat floppy1.001 22
<br>
<br>
Directory Entry: 22
<br>
Allocated
<br>
File Attributes: File, Archive
<br>
Size: 51712
<br>
Name: REPORT~1.DOC
<br>
<br>
Directory Entry Times:
<br>
Written:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Thu Apr 27 17:56:34 2006
<br>
Accessed:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Wed May 24 00:00:00 2006
<br>
Created:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Wed May 24 09:21:08 2006
<br>
<br>
Sectors:
<br>
33 34 35 36 37 38 39 40
<br>
41 42 43 44 45 46 47 48
<br>
49 50 51 52 53 54 55 56
<br>
57 58 59 60 61 62 63 64
<br>
65 66 67 68 69 70 71 72
<br>
73 74 75 76 77 78 79 80
<br>
81 82 83 84 85 86 87 88
<br>
89 90 91 92 93 94 95 96
<br>
97 98 99 100 101 102 103 104
<br>
105 106 107 108 109 110 111 112
<br>
113 114 115 116 117 118 119 120
<br>
121 122 123 124 125 126 127 128
<br>
129 130 131 132 133
<br>
<br>
<br>
Given this information we do 133-33+1= 101 and use this for the count
parameter.
<br>
<br>
#dd if=../../floppy1.001 of=./test_recovery-1.doc skip=33 count=101
<br>
#md5sum test_recovery-1.doc
<br>
9a1715b9b66de7839d8010496d027c05&nbsp; test_recovery-1.doc
<br>
<br>
<br>
When using foremost to carve through this image a .doc file is found.
<br>
The foremost audit.txt file contains this information:
<br>
<br>
&nbsp;&nbsp; Foremost version 1.2 by Jesse Kornblum, Kris Kendall, and Nick Mikus
<br>
&nbsp;&nbsp; Audit File
<br>
<br>
&nbsp;&nbsp; Foremost started at Thu Jun&nbsp; 1 20:07:09 2006
<br>
&nbsp;&nbsp; Invocation: /usr/local/bin/foremost -t all -i floppy1.001
<br>
&nbsp;&nbsp; Output directory: /home/jelle/forensics/output
<br>
&nbsp;&nbsp; Configuration file: /usr/local/etc/foremost.conf
<br>
&nbsp;&nbsp; ------------------------------------------------------------------
<br>
&nbsp;&nbsp; File: floppy1.001
<br>
&nbsp;&nbsp; Start: Thu Jun&nbsp; 1 20:07:09 2006
<br>
&nbsp;&nbsp; Length: 1 MB (1474560 bytes)
<br>
<br>
&nbsp;&nbsp; Num&nbsp;&nbsp;&nbsp;&nbsp; Name (bs=512)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Size&nbsp;&nbsp;&nbsp;&nbsp; File Offset&nbsp;&nbsp;&nbsp;&nbsp; Comment
<br>
<br>
&nbsp;&nbsp; 0:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 33.doc&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 51 KB&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 16896&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp; <br>
&nbsp;&nbsp; 1:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 190.doc&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 80 KB&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 97280&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp; <br>
&nbsp;&nbsp; 2:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 253.png&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 15 KB&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 129607&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; (800 x
600)
<br>
&nbsp;&nbsp; 3:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 285.png&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 13 KB&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 146153&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; (800 x
600)
<br>
&nbsp;&nbsp; Finish: Thu Jun&nbsp; 1 20:07:09 2006
<br>
<br>
&nbsp;&nbsp; 4 FILES EXTRACTED
<br>
&nbsp;&nbsp; ole:= 2
<br>
&nbsp;&nbsp; png:= 2
<br>
&nbsp;&nbsp; ------------------------------------------------------------------
<br>
<br>
&nbsp;&nbsp; Foremost finished at Thu Jun&nbsp; 1 20:07:09 2006
<br>
<br>
when I check the MD5 sum of file 33.doc I get:
<br>
aa7f9b9be2ca9be17a668eb00e2ea209&nbsp; 00000033.doc
<br>
<br>
<br>
This means the 2 files we're talking about arent the same.
<br>
While I'm pretty shure they should be the same!
<br>
Even better:
<br>
<br>
dd if=../../floppy1.001 of=./test_recovery-2.doc skip=33 count=103
<br>
When I check the MD5 sum of the file test_recovery-2.doc I get:
<br>
aa7f9b9be2ca9be17a668eb00e2ea209 est_recovery-2.doc
<br>
<br>
<br>
Which Is the same hash as the file foremost has recovered!
<br>
<br>
<br>
Now my question is:
<br>
<br>
why do I need to count 103 sectors? Shouldn't I based upon the output
of the istat command only count 101 sectors?
<br>
quid?
<br>
<br>
Thanks in advance,
<br>
<br>
Jelle S.
<br>
<br>
<br>
<br>
</div>
</body>
</html>

[sleuthkit-users] What's the difference between foremost and manual extraction using dd and sleuthk

[sleuthkit-users] What's the difference between foremost and manual extraction using dd and sleuthkit?