disk-forensics

磁盘取证

用于分析存储介质、文件系统和持久化痕迹的全面磁盘取证技能。支持恢复已删除文件、分析文件系统元数据、检测隐藏数据，以及从磁盘映像中提取取证痕迹。

功能

• 磁盘映像采集：创建符合取证要求的磁盘映像，并验证完整性
• 文件系统分析：解析和分析 NTFS、FAT、EXT、HFS+、APFS 文件系统
• 已删除文件恢复：使用文件雕刻和文件系统分析恢复已删除文件
• MFT 分析：解析 NTFS 主文件表，获取文件元数据和时间戳
• 簇尾空间分析：检查簇尾空间中的隐藏数据或残留数据
• 备用数据流：检测并提取 NTFS 备用数据流
• 文件签名分析：验证文件签名并检测扩展名不匹配的情况
• 哈希分析：计算并验证文件哈希值，以确保完整性并识别已知文件
• 卷影副本分析：提取并分析 Windows 卷影副本
• 分区分析：检测隐藏分区并分析分区表

快速开始

from disk_forensics import DiskAnalyzer, FileRecovery, MFTParser

# Initialize analyzer with disk image
analyzer = DiskAnalyzer("/evidence/disk_image.E01")

# Get volume information
volumes = analyzer.list_volumes()
for vol in volumes:
    print(f"Volume: {vol.description} - {vol.size_gb}GB")

# Recover deleted files
recovery = FileRecovery(analyzer)
deleted = recovery.find_deleted_files()

# Parse MFT
mft_parser = MFTParser(analyzer)
entries = mft_parser.parse_all()

用法

任务 1：磁盘映像采集

输入：要采集的物理磁盘或逻辑卷

流程：

1. 记录源介质详情
2. 在采集前计算源数据哈希值
3. 创建取证映像（E01/Ex01/raw）
4. 通过哈希值比对验证映像完整性
5. 生成采集报告

输出：符合取证要求且附有文档记录的磁盘映像

示例：

from disk_forensics import DiskAcquisition

# Initialize acquisition
acquisition = DiskAcquisition()

# Document source
source_info = acquisition.document_source(
    device_path="/dev/sdb",
    make="Samsung",
    model="SSD 870 EVO",
    serial_number="S5XXXXXXXXXXXX",
    capacity_gb=500
)

# Create forensic image
result = acquisition.create_image(
    source="/dev/sdb",
    destination="/evidence/suspect_disk.E01",
    format="ewf",  # Expert Witness Format
    compression="best",
    segment_size_gb=2,
    hash_algorithms=["md5", "sha256"]
)

print(f"Acquisition complete")
print(f"Source Hash: {result.source_hash}")
print(f"Image Hash: {result.image_hash}")
print(f"Verified: {result.verified}")

# Generate acquisition report
acquisition.generate_report(
    output_path="/evidence/acquisition_report.pdf",
    case_id="CASE-2024-001",
    examiner="Jane Smith"
)

任务 2：文件系统分析

输入：磁盘映像文件路径

流程：

1. 以只读方式挂载磁盘映像
2. 识别文件系统类型
3. 解析文件系统结构
4. 提取文件元数据
5. 构建文件系统时间线

输出：包含元数据的文件系统分析结果

示例：

from disk_forensics import DiskAnalyzer, FileSystemParser

analyzer = DiskAnalyzer("/evidence/disk_image.E01")

# List all volumes
volumes = analyzer.list_volumes()
for vol in volumes:
    print(f"Volume {vol.index}: {vol.file_system}")
    print(f"  Start: {vol.start_offset}")
    print(f"  Size: {vol.size_bytes} bytes")

# Parse specific volume
parser = FileSystemParser(analyzer, volume_index=2)

# Get volume statistics
stats = parser.get_statistics()
print(f"Total files: {stats.total_files}")
print(f"Total directories: {stats.total_directories}")
print(f"Deleted entries: {stats.deleted_entries}")

# List directory contents
files = parser.list_directory("/Users/suspect/Documents")
for f in files:
    print(f"{f.name} - {f.size} bytes - {f.modified_time}")

# Find files by extension
docs = parser.find_files_by_extension([".docx", ".xlsx", ".pdf"])

# Find files by date range
recent = parser.find_files_by_date(
    start_date="2024-01-01",
    end_date="2024-01-31",
    date_type="modified"
)

任务 3：已删除文件恢复

输入：可能包含已删除文件的磁盘映像

流程：

1. 扫描文件系统中的已删除条目
2. 分析未分配空间
3. 按签名执行文件雕刻
4. 验证恢复文件的完整性
5. 记录恢复结果

输出：已恢复的文件及其恢复元数据

示例：

from disk_forensics import DiskAnalyzer, FileRecovery

analyzer = DiskAnalyzer("/evidence/disk_image.E01")
recovery = FileRecovery(analyzer)

# Find deleted files via file system
deleted = recovery.find_deleted_files()
for f in deleted:
    print(f"Deleted: {f.name}")
    print(f"  Original path: {f.original_path}")
    print(f"  Size: {f.size}")
    print(f"  Recoverable: {f.recoverable_percent}%")

# Recover specific file
recovery.recover_file(
    file_entry=deleted[0],
    output_path="/evidence/recovered/"
)

# File carving from unallocated space
carved = recovery.carve_files(
    file_types=["jpg", "png", "pdf", "docx"],
    output_dir="/evidence/carved/"
)

for f in carved:
    print(f"Carved: {f.filename}")
    print(f"  Type: {f.file_type}")
    print(f"  Size: {f.size}")
    print(f"  Offset: {f.disk_offset}")

# Recovery statistics
stats = recovery.get_statistics()
print(f"Files recovered: {stats.files_recovered}")
print(f"Data recovered: {stats.bytes_recovered} bytes")

任务 4：MFT 分析（NTFS）

输入：NTFS 磁盘映像或提取出的 MFT 文件

流程：

1. 定位并提取 MFT
2. 解析 MFT 条目
3. 提取标准信息属性
4. 分析文件名和时间戳
5. 检测时间戳篡改

输出：包含时间线异常的 MFT 分析结果

示例：

from disk_forensics import DiskAnalyzer, MFTParser

analyzer = DiskAnalyzer("/evidence/disk_image.E01")
mft_parser = MFTParser(analyzer, volume_index=2)

# Parse entire MFT
entries = mft_parser.parse_all()
print(f"Total MFT entries: {len(entries)}")

# Get specific file entry
entry = mft_parser.get_entry_by_path("/Users/suspect/malware.exe")
if entry:
    print(f"File: {entry.filename}")
    print(f"Created: {entry.created_time}")
    print(f"Modified: {entry.modified_time}")
    print(f"Accessed: {entry.accessed_time}")
    print(f"MFT Modified: {entry.mft_modified_time}")

# Detect timestamp anomalies (timestomping)
anomalies = mft_parser.detect_timestamp_anomalies()
for a in anomalies:
    print(f"ANOMALY: {a.filename}")
    print(f"  Type: {a.anomaly_type}")
    print(f"  Details: {a.description}")

# Find files by MFT entry number
entry = mft_parser.get_entry_by_number(12345)

# Extract MFT to file
mft_parser.extract_mft("/evidence/extracted_mft.bin")

# Generate MFT timeline
mft_parser.export_timeline("/evidence/mft_timeline.csv")

任务 5：备用数据流分析

输入：NTFS 磁盘映像

流程：

1. 扫描包含备用数据流的文件
2. 提取 ADS 内容
3. 分析 ADS 中是否包含恶意内容
4. 检查 Zone.Identifier 流
5. 记录 ADS 分析结果

输出：ADS 清单及提取的内容

示例：

from disk_forensics import DiskAnalyzer, ADSScanner

analyzer = DiskAnalyzer("/evidence/disk_image.E01")
ads_scanner = ADSScanner(analyzer, volume_index=2)

# Find all alternate data streams
streams = ads_scanner.find_all_streams()

for stream in streams:
    print(f"File: {stream.parent_file}")
    print(f"  Stream: {stream.stream_name}")
    print(f"  Size: {stream.size} bytes")

# Extract specific stream
ads_scanner.extract_stream(
    file_path="/Users/suspect/document.docx",
    stream_name="Zone.Identifier",
    output_path="/evidence/zone_id.txt"
)

# Analyze Zone.Identifier streams (download origins)
zone_info = ads_scanner.analyze_zone_identifiers()
for zi in zone_info:
    print(f"File: {zi.filename}")
    print(f"  Download URL: {zi.referrer_url}")
    print(f"  Host URL: {zi.host_url}")
    print(f"  Zone: {zi.security_zone}")

# Find executable content in ADS
suspicious = ads_scanner.find_executable_ads()
for s in suspicious:
    print(f"SUSPICIOUS: {s.parent_file}:{s.stream_name}")

任务 6：卷影副本分析

输入：包含 VSS 的 Windows 磁盘映像

流程：

1. 枚举卷影副本
2. 挂载卷影副本进行分析
3. 比较不同卷影副本中的文件
4. 提取文件的先前版本
5. 整理卷影副本变更时间线

输出：包含文件版本历史的 VSS 分析结果

示例：

from disk_forensics import DiskAnalyzer, VSSAnalyzer

analyzer = DiskAnalyzer("/evidence/disk_image.E01")
vss_analyzer = VSSAnalyzer(analyzer, volume_index=2)

# List all shadow copies
shadows = vss_analyzer.list_shadow_copies()
for sc in shadows:
    print(f"Shadow Copy: {sc.id}")
    print(f"  Created: {sc.creation_time}")
    print(f"  Volume: {sc.volume_path}")

# Get file from specific shadow copy
file_content = vss_analyzer.extract_file(
    shadow_id=shadows[0].id,
    file_path="/Users/suspect/deleted_evidence.xlsx",
    output_path="/evidence/recovered_from_vss.xlsx"
)

# Compare file across shadow copies
diff = vss_analyzer.compare_file_versions(
    file_path="/Users/suspect/important.docx"
)
for version in diff:
    print(f"Version from {version.shadow_date}:")
    print(f"  Size: {version.size}")
    print(f"  Hash: {version.hash}")

# Find deleted files recoverable from VSS
recoverable = vss_analyzer.find_deleted_in_shadows()

# Export VSS timeline
vss_analyzer.export_timeline("/evidence/vss_timeline.csv")

任务 7：文件签名分析

输入：磁盘映像或文件目录

流程：

1. 提取文件头／签名
2. 与已知文件签名进行比较
3. 识别扩展名不匹配的情况
4. 检测嵌入文件
5. 报告签名异常

输出：包含签名不匹配情况的文件签名分析结果

示例：

from disk_forensics import DiskAnalyzer, SignatureAnalyzer

analyzer = DiskAnalyzer("/evidence/disk_image.E01")
sig_analyzer = SignatureAnalyzer(analyzer, volume_index=2)

# Analyze all files
results = sig_analyzer.analyze_all()

# Find extension mismatches
mismatches = sig_analyzer.find_mismatches()
for m in mismatches:
    print(f"MISMATCH: {m.file_path}")
    print(f"  Extension: {m.extension}")
    print(f"  Actual Type: {m.detected_type}")
    print(f"  Signature: {m.signature_hex}")

# Analyze specific file
file_info = sig_analyzer.analyze_file("/Users/suspect/image.jpg")
print(f"File: {file_info.path}")
print(f"Detected Type: {file_info.detected_type}")
print(f"MIME Type: {file_info.mime_type}")
print(f"Extension Valid: {file_info.extension_valid}")

# Find renamed executables
renamed_exe = sig_analyzer.find_renamed_executables()
for exe in renamed_exe:
    print(f"Hidden EXE: {exe.path} (disguised as {exe.extension})")

# Detect polyglot files (multiple valid signatures)
polyglots = sig_analyzer.find_polyglots()

# Export analysis report
sig_analyzer.export_report("/evidence/signature_analysis.csv")

任务 8：簇尾空间分析

输入：磁盘映像文件

流程：

1. 定位文件簇尾空间
2. 提取簇尾空间内容
3. 搜索可读数据
4. 识别潜在证据
5. 记录分析结果

输出：包含提取数据的簇尾空间分析结果

示例：

from disk_forensics import DiskAnalyzer, SlackSpaceAnalyzer

analyzer = DiskAnalyzer("/evidence/disk_image.E01")
slack_analyzer = SlackSpaceAnalyzer(analyzer, volume_index=2)

# Analyze all slack space
results = slack_analyzer.analyze_all()
print(f"Total slack space: {results.total_bytes} bytes")
print(f"Slack with data: {results.data_bytes} bytes")

# Extract slack space from specific file
slack_data = slack_analyzer.get_file_slack("/Users/suspect/document.docx")
print(f"Slack content: {slack_data.content[:100]}")

# Search slack space for patterns
matches = slack_analyzer.search_slack(
    patterns=["password", "secret", "confidential"],
    case_sensitive=False
)
for m in matches:
    print(f"Found '{m.pattern}' in slack of {m.file_path}")
    print(f"  Context: {m.context}")

# Extract all readable strings from slack
strings = slack_analyzer.extract_strings(min_length=4)

# Export slack space content
slack_analyzer.export_slack_data("/evidence/slack_space/")

任务 9：分区分析

输入：原始磁盘映像或物理设备

流程：

1. 读取分区表（MBR/GPT）
2. 识别所有分区
3. 检测隐藏分区
4. 分析未分配空间
5. 记录分区布局

输出：完整的分区分析

示例：

from disk_forensics import DiskAnalyzer, PartitionAnalyzer

analyzer = DiskAnalyzer("/evidence/full_disk.dd")
partition_analyzer = PartitionAnalyzer(analyzer)

# Get partition table type
pt_type = partition_analyzer.get_partition_table_type()
print(f"Partition Table: {pt_type}")

# List all partitions
partitions = partition_analyzer.list_partitions()
for p in partitions:
    print(f"Partition {p.index}:")
    print(f"  Type: {p.type_name}")
    print(f"  Start: {p.start_sector}")
    print(f"  Size: {p.size_bytes} bytes")
    print(f"  File System: {p.file_system}")
    print(f"  Bootable: {p.bootable}")

# Detect hidden partitions
hidden = partition_analyzer.find_hidden_partitions()
for h in hidden:
    print(f"HIDDEN: Found at sector {h.start_sector}")

# Analyze gaps between partitions
gaps = partition_analyzer.find_unallocated_space()
for gap in gaps:
    print(f"Unallocated: {gap.start_sector} - {gap.end_sector}")
    print(f"  Size: {gap.size_bytes} bytes")

# Analyze deleted partitions
deleted = partition_analyzer.find_deleted_partitions()

# Export partition map
partition_analyzer.export_map("/evidence/partition_map.json")

任务 10：哈希分析与已知文件检测

输入：磁盘映像或文件集合

流程：

1. 计算所有文件的哈希值
2. 与已知文件数据库进行比对
3. 识别已知的正常文件（NSRL）
4. 标记已知恶意文件
5. 生成哈希报告

输出：分类后的哈希分析

示例：

from disk_forensics import DiskAnalyzer, HashAnalyzer

analyzer = DiskAnalyzer("/evidence/disk_image.E01")
hash_analyzer = HashAnalyzer(analyzer, volume_index=2)

# Calculate hashes for all files
hashes = hash_analyzer.hash_all_files(
    algorithms=["md5", "sha1", "sha256"]
)

# Compare against NSRL (known good files)
nsrl_results = hash_analyzer.check_nsrl(
    nsrl_path="/hashsets/NSRLFile.txt"
)
print(f"Known good files: {nsrl_results.known_count}")
print(f"Unknown files: {nsrl_results.unknown_count}")

# Check against malware hash database
malware_check = hash_analyzer.check_malware_hashes(
    hash_db="/hashsets/malware_hashes.txt"
)
for match in malware_check.matches:
    print(f"MALWARE: {match.file_path}")
    print(f"  Hash: {match.hash}")
    print(f"  Malware Name: {match.malware_name}")

# Find duplicate files
duplicates = hash_analyzer.find_duplicates()
for dup_group in duplicates:
    print(f"Duplicate files (hash: {dup_group.hash}):")
    for f in dup_group.files:
        print(f"  - {f}")

# Export hash report
hash_analyzer.export_report(
    output_path="/evidence/hash_report.csv",
    format="csv"
)

配置

环境变量

变量	描述	必需	默认值
SLEUTHKIT_PATH	The Sleuth Kit 二进制文件的路径	否	系统 PATH
NSRL_PATH	NSRL 哈希数据库的路径	否	无
YARA_RULES	用于文件分析的 YARA 规则路径	否	无
CARVING_SIGNATURES	自定义文件雕刻特征	否	内置

选项

选项	类型	描述
verify_image	boolean	加载时验证映像完整性
cache_metadata	boolean	缓存已解析的元数据
parallel_hash	boolean	并行计算哈希值
carving_depth	integer	最大雕刻深度（字节）
timezone	string	时间戳显示所用的时区

示例

示例 1：数据窃取调查

场景：调查可能的知识产权窃取行为

from disk_forensics import DiskAnalyzer, FileSystemParser, MFTParser

# Load suspect's disk image
analyzer = DiskAnalyzer("/evidence/suspect_laptop.E01")
parser = FileSystemParser(analyzer, volume_index=2)

# Find recently accessed sensitive documents
recent_docs = parser.find_files_by_date(
    start_date="2024-01-01",
    end_date="2024-01-31",
    date_type="accessed",
    extensions=[".docx", ".xlsx", ".pdf", ".pptx"]
)

# Check USB device history
usb_artifacts = analyzer.get_usb_history()
for device in usb_artifacts:
    print(f"USB: {device.device_name}")
    print(f"  First connected: {device.first_connected}")
    print(f"  Last connected: {device.last_connected}")

# Analyze MFT for deleted documents
mft = MFTParser(analyzer, volume_index=2)
deleted = mft.find_deleted_entries(extensions=[".docx", ".xlsx"])

# Check cloud sync folders
cloud_folders = [
    "/Users/suspect/Dropbox",
    "/Users/suspect/OneDrive",
    "/Users/suspect/Google Drive"
]
for folder in cloud_folders:
    files = parser.list_directory(folder, recursive=True)
    print(f"Found {len(files)} files in {folder}")

示例 2：恶意软件持久化分析

场景：查找磁盘上的恶意软件持久化机制

from disk_forensics import DiskAnalyzer, FileSystemParser, SignatureAnalyzer

analyzer = DiskAnalyzer("/evidence/infected_system.E01")
parser = FileSystemParser(analyzer, volume_index=2)
sig_analyzer = SignatureAnalyzer(analyzer, volume_index=2)

# Check common persistence locations
persistence_paths = [
    "/Windows/System32/Tasks",
    "/Users/*/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup",
    "/ProgramData/Microsoft/Windows/Start Menu/Programs/Startup"
]

for path in persistence_paths:
    files = parser.list_directory(path)
    for f in files:
        print(f"Persistence: {f.name} - Created: {f.created_time}")

# Find hidden executables
hidden_exe = sig_analyzer.find_renamed_executables()

# Analyze Windows prefetch
prefetch_files = parser.find_files_by_extension([".pf"],
    path="/Windows/Prefetch")

# Check for suspicious services
services = parser.get_file("/Windows/System32/config/SYSTEM")

示例 3：已删除文件恢复操作

场景：恢复已删除的证据

from disk_forensics import DiskAnalyzer, FileRecovery, VSSAnalyzer

analyzer = DiskAnalyzer("/evidence/suspect_disk.E01")

# Method 1: File system recovery
recovery = FileRecovery(analyzer)
fs_deleted = recovery.find_deleted_files()
print(f"Found {len(fs_deleted)} deleted files in file system")

# Method 2: File carving
carved = recovery.carve_files(
    file_types=["jpg", "png", "pdf", "docx", "xlsx"],
    output_dir="/evidence/carved_files/"
)
print(f"Carved {len(carved)} files from unallocated space")

# Method 3: Volume Shadow Copy recovery
vss = VSSAnalyzer(analyzer, volume_index=2)
shadows = vss.list_shadow_copies()

for shadow in shadows:
    vss_files = vss.list_deleted_in_shadow(shadow.id)
    for f in vss_files:
        vss.extract_file(shadow.id, f.path,
            f"/evidence/vss_recovery/{shadow.id}/{f.name}")

限制

• 支持的最大磁盘映像大小取决于系统资源
• 对大型映像进行分析时，EWF 压缩可能会降低速度
• 文件雕刻无法完整恢复碎片化文件
• 加密卷需要解密密钥
• 对某些文件系统的支持可能有限
• 分析 VSS 需要 Windows 映像
• 哈希数据库比对需要外部数据库

故障排除

常见问题 1：映像挂载失败

问题：无法挂载或读取磁盘映像 解决方案：

• 使用哈希验证检查映像完整性
• 检查映像格式是否受支持（raw、E01、AFF）
• 确保缓存有足够的磁盘空间

常见问题 2：无法识别文件系统

问题：文件系统类型未知 解决方案：

• 检查分区偏移是否对齐
• 尝试手动指定文件系统
• 确认映像未加密

常见问题 3：雕刻生成的文件已损坏

问题：雕刻出的文件已损坏或不完整 解决方案：

• 文件可能已碎片化
• 提高雕刻验证设置
• 使用多个雕刻工具进行验证

常见问题 4：哈希计算缓慢

问题：哈希计算耗时过长 解决方案：

• 启用并行处理
• 使用更快的哈希算法（MD5 与 SHA-256 相比）
• 排除已知的正常文件

相关技能

• memory-forensics：易失性内存分析
• timeline-forensics：创建超级时间线
• artifact-collection：证据收集流程
• registry-forensics：Windows 注册表分析
• malware-forensics：恶意软件样本分析

参考资料

• 磁盘取证参考
• 文件系统分析指南
• 文件雕刻特征