Disk/Image Analysis

When an attack happens on a computer in a company for exemple , we need the DFIR team (Digital Forensics and Incident Response) to analyze the incident.

Updated February 7, 20264 min readSource on GitHub (opens in a new tab)

LinkedIn: [Anas Magane] YouTube: Anas Education (opens in a new tab)
Instagram: @anas.education (opens in a new tab)
GitHub: Anas-Magane (opens in a new tab)

📚 Introduction#

When an attack happens on a computer in a company for exemple , we need the DFIR team (Digital Forensics and Incident Response) to analyze the incident.

One of the most important parts of this analysis is disk/image analysis.

We use specific techniques and tools to investigate what happened. and these tools, we have:

The Sleuth Kit (TSK)
Autopsy
FTK Imager
Volatility (for memory analysis)
Wireshark (for network analysis)
Steganography tools
And many others...

🛠️ The Sleuth Kit Tools#

The Sleuth Kit is a collection of powerful command-line tools used to analyze disk images and file systems.

Let's explore the most important ones:

1️⃣ `file` - Identify File Types#

We use file to determine the type and format of a file.

Why is this useful?

Because attackers often hide malicious files by changing their extensions (e.g., renaming malware.exe to document.txt).

The file command reads the file's magic bytes (file signature) to identify its true type.

Example#

bash

file disk.img

Result:

text

disk.img: Linux rev 1.0 ext4 filesystem data, UUID=a1b2c3d4-e5f6-7890-1234-567890abcdef

This tells us:

It's a Linux disk image
Using ext4 filesystem
Contains a unique identifier (UUID)

2️⃣ `strings` - Extract Readable Text#

We use strings to extract all human-readable text from a binary file or in this case from a disk image.

Why is this useful?

Attackers might hide passwords, URLs, IP addresses,flags or commands inside files. The strings command helps us to find them.

Example#

bash

strings disk.img | grep -i "password"

Result:

text

admin_password=anas123
backup_password=21anassana21

You can also save all strings to a file for later analysis:

bash

strings disk.img > extracted_strings.txt

3️⃣ `mmls` - Display Partition Table#

We use mmls to view the partition layout of a disk image.

Think of a disk like a book:

The book has a table of contents (partition table)
Each chapter is a partition

Example#

bash

mmls disk.img

Result:

text

DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors
 
      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
001:  -------   0000000000   0000002047   0000002048   Unallocated
002:  000:000   0000002048   0000616447   0000614400   Linux (0x83)
003:  000:001   0000616448   0001140735   0000524288   Linux Swap / Solaris x86 (0x82)
004:  000:002   0001140736   0002097151   0000956416   Linux (0x83)

What does this mean?

Slot	Start	End	Length	Description
001	0	2047	2048	Unallocated (empty space)
002	2048	616447	614400	Linux partition (main system)
003	616448	1140735	524288	Swap partition (virtual memory)
004	1140736	2097151	956416	Linux partition (data storage)

4️⃣ `dd` - Copy Disk Partitions#

The dd tool is used to copy data from one place to another.

Book Analogy#

For example, we have a book named disk.img:

Cover page and introduction → Unallocated space
Part 1 (300 pages) → Sector 2048 to 616447
Part 2 (256 pages) → Sector 616448 to 1140735
Part 3 (467 pages) → Sector 1140736 to 2097151

Using dd is like taking a photocopy of specific pages!

Example#

When you type mmls disk.img, you get:

bash

mmls disk.img 
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors
 
      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
001:  -------   0000000000   0000002047   0000002048   Unallocated
002:  000:000   0000002048   0000616447   0000614400   Linux (0x83)
003:  000:001   0000616448   0001140735   0000524288   Linux Swap / Solaris x86 (0x82)
004:  000:002   0001140736   0002097151   0000956416   Linux (0x83)

let's use dd to get a copy from the part

bash

	dd if=disk.img of=linuxPart.img bs=512 skip=2048 count=614400

Explanation:

if= Input File → The source (disk.img)
of= Output File → The destination (linuxPart.img)
bs= Byte Size → Size of each block (512 bytes = 1 sector)
skip= Start → Skip to sector 2048
count= Length → Copy 614400 sectors

5️⃣ `mount` - Read Disk Content#

The mount tool allows you to open and read a disk image.

It's like opening a book and reading from a specific page.

Example#

bash

## Open the book from page 2048 and read
mount -o loop,offset=1048576 disk.img /mnt/analysis

⚠️ Why `offset=1048576` and not `2048`?#

Because:

offset in mount uses bytes, not sectors
Sector 2048 × 512 bytes = 1,048,576 bytes

Formula:

text

offset = sector × 512

Full Example#

bash

## Create a mount point
mkdir /mnt/disk_analysis
 
## Mount the partition
mount -o loop,offset=1048576 disk.img /mnt/disk_analysis
 
## Now you can browse the files
ls -la /mnt/disk_analysis
 
## When done, unmount
umount /mnt/disk_analysis

6️⃣ `fls` - List Files in a Partition#

We use fls to list files and directories from a disk image partition.

Example#

bash

fls -r -p disk.img

Flags:

-r → Recursive (show all subdirectories)
-p → Print full path

Output:

text

r/r 1234:       /home/anas/flag.txt
r/r 1235:       /home/anas/image.png
r/r 1236:       /home/anas/Documents/report.pdf
d/d 1237:       /var/log
r/r 1238:       /var/log/syslog
r/r * 1239:     /home/anas/.deleted_file.txt

Key Information:

r/r = Regular file
d/d = Directory
* = Deleted file
Number (1234, 1235, etc.) = Inode number (file identifier)

7️⃣ `icat` - Extract File Content#

We use icat to extract and read file contents using their inode number.

How It Works#

When you run fls -r -p, you see:

text

r/r 1234:       /home/anas/flag.txt
r/r 1235:       /home/anas/image.png

To extract these files:

bash

## Extract flag.txt (inode 1234)
icat disk.img 1234 > flag.txt
 
## Extract image.png (inode 1235)
icat disk.img 1235 > image.png

Real-World Example#

bash

## List all files
fls -r -p disk.img | grep "flag"
 
## Output:
## r/r 5678:       /home/victim/secret_flag.txt
 
## Extract the flag
icat disk.img 5678
 
## Output:
## FLAG{f0r3ns1c5_1s_e4sy_By_An4s_2Duc4t10n}

8️⃣ `istat` - Display Inode Information#

We use istat to get detailed metadata about a file.

Example#

bash

istat disk.img 1234

Output:

text

inode: 1234
Allocated
File Type: Regular File
Mode: -rw-r--r--
Size: 1024
Owner: anas (1000)
Group: users (1000)
Created: 2024-03-15 14:30:22
Modified: 2024-03-15 16:45:10
Accessed: 2024-03-16 09:12:33

This shows:

File type (regular file, directory, etc.)
Permissions (-rw-r--r--)
Size (1024 bytes)
Timestamps (created, modified, accessed)

9️⃣ `blkcat` - Extract Data Blocks#

We use blkcat to extract raw data from specific disk blocks.

Example#

bash

blkcat disk.img 2048 > block_data.bin

This extracts the data from block 2048 and saves it to block_data.bin.

🔟 `tsk_recover` - Recover Deleted Files#

We use tsk_recover to recover all deleted files from a disk image.

Example#

bash

tsk_recover disk.img /output/recovered_files/

This command:

Scans disk.img for deleted files
Recovers them to /output/recovered_files/ directory

Complete Forensic Workflow Example#

Scenario#

You have a disk image evidence.dd from a compromised server. Let's analyze it step by step:

bash

## Step 1: Identify the file type
file evidence.dd
 
## Step 2: View partition layout
mmls evidence.dd
 
## Step 3: Extract main partition (starts at sector 2048)
dd if=evidence.dd of=main_partition.img bs=512 skip=2048 count=614400
 
## Step 4: List all files (including deleted ones)
fls -r -p main_partition.img > file_list.txt
 
## Step 5: Find suspicious files
cat file_list.txt | grep -i "backdoor\|malware\|hack"
 
## Step 6: Extract suspicious file (inode 6789)
icat main_partition.img 6789 > suspicious_file.bin
 
## Step 7: Analyze the extracted file
file suspicious_file.bin
strings suspicious_file.bin
 
## Step 8: Get detailed file metadata
istat main_partition.img 6789
 
## Step 9: Recover deleted files
tsk_recover main_partition.img /evidence/recovered/
 
## Step 10: Mount for manual inspection
mkdir /mnt/evidence
mount -o loop,ro,offset=1048576 evidence.dd /mnt/evidence
ls -la /mnt/evidence

Key Takeaways#

Tool	Purpose
`file`	Identify file type
`strings`	Extract readable text
`mmls`	View partition table
`dd`	Copy disk partitions
`mount`	Read disk content
`fls`	List files and directories
`icat`	Extract file content by inode
`istat`	Display file metadata
`blkcat`	Extract raw data blocks
`tsk_recover`	Recover deleted files

Happy Investigating! 🕵️

Follow Anas Education (opens in a new tab) for more cybersecurity tutorials!

Disk/Image Analysis

When an attack happens on a computer in a company for exemple , we need the DFIR team (Digital Forensics and Incident Response) to analyze the incident.

Updated February 7, 20264 min readSource on GitHub (opens in a new tab)

LinkedIn: [Anas Magane] YouTube: Anas Education (opens in a new tab)
Instagram: @anas.education (opens in a new tab)
GitHub: Anas-Magane (opens in a new tab)

📚 Introduction#

When an attack happens on a computer in a company for exemple , we need the DFIR team (Digital Forensics and Incident Response) to analyze the incident.

One of the most important parts of this analysis is disk/image analysis.

We use specific techniques and tools to investigate what happened. and these tools, we have:

The Sleuth Kit (TSK)
Autopsy
FTK Imager
Volatility (for memory analysis)
Wireshark (for network analysis)
Steganography tools
And many others...

🛠️ The Sleuth Kit Tools#

The Sleuth Kit is a collection of powerful command-line tools used to analyze disk images and file systems.

Let's explore the most important ones:

1️⃣ `file` - Identify File Types#

We use file to determine the type and format of a file.

Why is this useful?

Because attackers often hide malicious files by changing their extensions (e.g., renaming malware.exe to document.txt).

The file command reads the file's magic bytes (file signature) to identify its true type.

Example#

bash

file disk.img

Result:

text

disk.img: Linux rev 1.0 ext4 filesystem data, UUID=a1b2c3d4-e5f6-7890-1234-567890abcdef

This tells us:

It's a Linux disk image
Using ext4 filesystem
Contains a unique identifier (UUID)

2️⃣ `strings` - Extract Readable Text#

We use strings to extract all human-readable text from a binary file or in this case from a disk image.

Why is this useful?

Attackers might hide passwords, URLs, IP addresses,flags or commands inside files. The strings command helps us to find them.

Example#

bash

strings disk.img | grep -i "password"

Result:

text

admin_password=anas123
backup_password=21anassana21

You can also save all strings to a file for later analysis:

bash

strings disk.img > extracted_strings.txt

3️⃣ `mmls` - Display Partition Table#

We use mmls to view the partition layout of a disk image.

Think of a disk like a book:

The book has a table of contents (partition table)
Each chapter is a partition

Example#

bash

mmls disk.img

Result:

text

DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors
 
      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
001:  -------   0000000000   0000002047   0000002048   Unallocated
002:  000:000   0000002048   0000616447   0000614400   Linux (0x83)
003:  000:001   0000616448   0001140735   0000524288   Linux Swap / Solaris x86 (0x82)
004:  000:002   0001140736   0002097151   0000956416   Linux (0x83)

What does this mean?

Slot	Start	End	Length	Description
001	0	2047	2048	Unallocated (empty space)
002	2048	616447	614400	Linux partition (main system)
003	616448	1140735	524288	Swap partition (virtual memory)
004	1140736	2097151	956416	Linux partition (data storage)

4️⃣ `dd` - Copy Disk Partitions#

The dd tool is used to copy data from one place to another.

Book Analogy#

For example, we have a book named disk.img:

Cover page and introduction → Unallocated space
Part 1 (300 pages) → Sector 2048 to 616447
Part 2 (256 pages) → Sector 616448 to 1140735
Part 3 (467 pages) → Sector 1140736 to 2097151

Using dd is like taking a photocopy of specific pages!

Example#

When you type mmls disk.img, you get:

bash

mmls disk.img 
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors
 
      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
001:  -------   0000000000   0000002047   0000002048   Unallocated
002:  000:000   0000002048   0000616447   0000614400   Linux (0x83)
003:  000:001   0000616448   0001140735   0000524288   Linux Swap / Solaris x86 (0x82)
004:  000:002   0001140736   0002097151   0000956416   Linux (0x83)

let's use dd to get a copy from the part

bash

	dd if=disk.img of=linuxPart.img bs=512 skip=2048 count=614400

Explanation:

if= Input File → The source (disk.img)
of= Output File → The destination (linuxPart.img)
bs= Byte Size → Size of each block (512 bytes = 1 sector)
skip= Start → Skip to sector 2048
count= Length → Copy 614400 sectors

5️⃣ `mount` - Read Disk Content#

The mount tool allows you to open and read a disk image.

It's like opening a book and reading from a specific page.

Example#

bash

## Open the book from page 2048 and read
mount -o loop,offset=1048576 disk.img /mnt/analysis

⚠️ Why `offset=1048576` and not `2048`?#

Because:

offset in mount uses bytes, not sectors
Sector 2048 × 512 bytes = 1,048,576 bytes

Formula:

text

offset = sector × 512

Full Example#

bash

## Create a mount point
mkdir /mnt/disk_analysis
 
## Mount the partition
mount -o loop,offset=1048576 disk.img /mnt/disk_analysis
 
## Now you can browse the files
ls -la /mnt/disk_analysis
 
## When done, unmount
umount /mnt/disk_analysis

6️⃣ `fls` - List Files in a Partition#

We use fls to list files and directories from a disk image partition.

Example#

bash

fls -r -p disk.img

Flags:

-r → Recursive (show all subdirectories)
-p → Print full path

Output:

text

r/r 1234:       /home/anas/flag.txt
r/r 1235:       /home/anas/image.png
r/r 1236:       /home/anas/Documents/report.pdf
d/d 1237:       /var/log
r/r 1238:       /var/log/syslog
r/r * 1239:     /home/anas/.deleted_file.txt

Key Information:

r/r = Regular file
d/d = Directory
* = Deleted file
Number (1234, 1235, etc.) = Inode number (file identifier)

7️⃣ `icat` - Extract File Content#

We use icat to extract and read file contents using their inode number.

How It Works#

When you run fls -r -p, you see:

text

r/r 1234:       /home/anas/flag.txt
r/r 1235:       /home/anas/image.png

To extract these files:

bash

## Extract flag.txt (inode 1234)
icat disk.img 1234 > flag.txt
 
## Extract image.png (inode 1235)
icat disk.img 1235 > image.png

Real-World Example#

bash

## List all files
fls -r -p disk.img | grep "flag"
 
## Output:
## r/r 5678:       /home/victim/secret_flag.txt
 
## Extract the flag
icat disk.img 5678
 
## Output:
## FLAG{f0r3ns1c5_1s_e4sy_By_An4s_2Duc4t10n}

8️⃣ `istat` - Display Inode Information#

We use istat to get detailed metadata about a file.

Example#

bash

istat disk.img 1234

Output:

text

inode: 1234
Allocated
File Type: Regular File
Mode: -rw-r--r--
Size: 1024
Owner: anas (1000)
Group: users (1000)
Created: 2024-03-15 14:30:22
Modified: 2024-03-15 16:45:10
Accessed: 2024-03-16 09:12:33

This shows:

File type (regular file, directory, etc.)
Permissions (-rw-r--r--)
Size (1024 bytes)
Timestamps (created, modified, accessed)

9️⃣ `blkcat` - Extract Data Blocks#

We use blkcat to extract raw data from specific disk blocks.

Example#

bash

blkcat disk.img 2048 > block_data.bin

This extracts the data from block 2048 and saves it to block_data.bin.

🔟 `tsk_recover` - Recover Deleted Files#

We use tsk_recover to recover all deleted files from a disk image.

Example#

bash

tsk_recover disk.img /output/recovered_files/

This command:

Scans disk.img for deleted files
Recovers them to /output/recovered_files/ directory

Complete Forensic Workflow Example#

Scenario#

You have a disk image evidence.dd from a compromised server. Let's analyze it step by step:

bash

## Step 1: Identify the file type
file evidence.dd
 
## Step 2: View partition layout
mmls evidence.dd
 
## Step 3: Extract main partition (starts at sector 2048)
dd if=evidence.dd of=main_partition.img bs=512 skip=2048 count=614400
 
## Step 4: List all files (including deleted ones)
fls -r -p main_partition.img > file_list.txt
 
## Step 5: Find suspicious files
cat file_list.txt | grep -i "backdoor\|malware\|hack"
 
## Step 6: Extract suspicious file (inode 6789)
icat main_partition.img 6789 > suspicious_file.bin
 
## Step 7: Analyze the extracted file
file suspicious_file.bin
strings suspicious_file.bin
 
## Step 8: Get detailed file metadata
istat main_partition.img 6789
 
## Step 9: Recover deleted files
tsk_recover main_partition.img /evidence/recovered/
 
## Step 10: Mount for manual inspection
mkdir /mnt/evidence
mount -o loop,ro,offset=1048576 evidence.dd /mnt/evidence
ls -la /mnt/evidence

Key Takeaways#

Tool	Purpose
`file`	Identify file type
`strings`	Extract readable text
`mmls`	View partition table
`dd`	Copy disk partitions
`mount`	Read disk content
`fls`	List files and directories
`icat`	Extract file content by inode
`istat`	Display file metadata
`blkcat`	Extract raw data blocks
`tsk_recover`	Recover deleted files

Happy Investigating! 🕵️

Follow Anas Education (opens in a new tab) for more cybersecurity tutorials!

📚 Introduction#

🛠️ The Sleuth Kit Tools#

1️⃣ file - Identify File Types#

Example#

2️⃣ strings - Extract Readable Text#

Example#

3️⃣ mmls - Display Partition Table#

Example#

4️⃣ dd - Copy Disk Partitions#

Book Analogy#

Example#

5️⃣ mount - Read Disk Content#

Example#

⚠️ Why offset=1048576 and not 2048?#

Full Example#

6️⃣ fls - List Files in a Partition#

Example#

7️⃣ icat - Extract File Content#

How It Works#

Real-World Example#

8️⃣ istat - Display Inode Information#

Example#

9️⃣ blkcat - Extract Data Blocks#

Example#

🔟 tsk_recover - Recover Deleted Files#

Example#

Complete Forensic Workflow Example#

Scenario#

Key Takeaways#

Related notes

📚 Introduction#

🛠️ The Sleuth Kit Tools#

1️⃣ file - Identify File Types#

Example#

2️⃣ strings - Extract Readable Text#

Example#

3️⃣ mmls - Display Partition Table#

Example#

4️⃣ dd - Copy Disk Partitions#

Book Analogy#

Example#

5️⃣ mount - Read Disk Content#

Example#

⚠️ Why offset=1048576 and not 2048?#

Full Example#

6️⃣ fls - List Files in a Partition#

Example#

7️⃣ icat - Extract File Content#

How It Works#

Real-World Example#

8️⃣ istat - Display Inode Information#

Example#

9️⃣ blkcat - Extract Data Blocks#

Example#

🔟 tsk_recover - Recover Deleted Files#

Example#

Complete Forensic Workflow Example#

Scenario#

Key Takeaways#

Related notes

1️⃣ `file` - Identify File Types#

2️⃣ `strings` - Extract Readable Text#

3️⃣ `mmls` - Display Partition Table#

4️⃣ `dd` - Copy Disk Partitions#

5️⃣ `mount` - Read Disk Content#

⚠️ Why `offset=1048576` and not `2048`?#

6️⃣ `fls` - List Files in a Partition#

7️⃣ `icat` - Extract File Content#

8️⃣ `istat` - Display Inode Information#

9️⃣ `blkcat` - Extract Data Blocks#

🔟 `tsk_recover` - Recover Deleted Files#

1️⃣ `file` - Identify File Types#

2️⃣ `strings` - Extract Readable Text#

3️⃣ `mmls` - Display Partition Table#

4️⃣ `dd` - Copy Disk Partitions#

5️⃣ `mount` - Read Disk Content#

⚠️ Why `offset=1048576` and not `2048`?#

6️⃣ `fls` - List Files in a Partition#

7️⃣ `icat` - Extract File Content#

8️⃣ `istat` - Display Inode Information#

9️⃣ `blkcat` - Extract Data Blocks#

🔟 `tsk_recover` - Recover Deleted Files#