Carving and Live RAM analysis
The product allows you to perform a highly sophisticated analysis called "carving".
What is carving
Carving is a bit-precise sequential search of the drive for various artifacts.
While carving, the product does not rely on the file system, and does not make use
of “files” as they may have been deleted. Instead, it looks for particular sequences
of bytes, or characteristic signatures specific to certain types of evidence. For
example, Skype version 3 inserts the "l33l" signature before every chat message,
so if this sequence is encountered on the disk, there is a high probability that
a Skype chat message follows.
l33l signature precedes an actual Skype 3 chat message showт by HexViewer window
Carving is an indispensable technique while searching for deleted data and looking
for destroyed evidence.
Please note that, unlike parsing existing files, carving is not a "precise" technique.
Carving may return incomplete results (for example, data will not be found for a
chat message) or "false-positive" hits. False positive results are possible when
a signature is discovered that does not actually precede the data of interest. This
may happen, for example, if you save a file with "l33l" text inside; the file will
be incorrectly identified as a Skype message.
The product goes through the entire device (hard drive or drive image), and not
just unallocated space, so some results may duplicate those you have already obtained
by using regular file analysis.
How to start carving
To start carving, you can do either of the following:
- Run profile search for a physical or logical drive, drive or mobile device
image, virtual machine, UFED dump or Live RAM image. If you select anything
on the Select what to carve page, the product will carve selected data
source along with regular (existing) file analysis.
- Click Carve Device toolbar button:
- Select Carve Device menu item of Edit
main menu or Case Explorer context menu of case or evidence
Once you did so, the Search profiles window will be open. The
first page you can choose a data source to carve. This screen is similar to the
first screen of Search Profiles wizard with the only difference
that Selected folder option is disabled, because it does not have
sense to carve a folder:
The following options are available:
- Logical drive.
These are your logical hard drives with the names like "C:\". Each hard drive
may have one or multiple logical drives presented in the combo box.
- Physical drive. These are your physical hard drives with
the names like "\\.\PHYSICALDRIVE1". Each hard drive is presented by a single
item in the combo box.
- Drive image file, virtual machine, UFED image, JTAG or chip-off mobile device dump. You can
carve any image of the following types:
- Atola image (.img)
- Chip-off or JTAG dump in any format
- DD image
- DMG image
- EnCase image (.e01 and ex01)
- FTK image (.aff, .afd, .afm)
- SMART (.s01)
- Virtual machine file (.vmdk, .vdi, .vhd, .xva)
- UFED physical image of Android devices
- X-Ways container (.ctr)
The file systems inside an image can be any Windows, Mac OS X, Android and
*nix ones: all FAT versions, NTFS, HFS/HFS+, ext2/ext3/ext4, YAFFS/YAFFS2.
- Live RAM image file. You can carve a raw image of a computer's
live memory (.mem). There are a number of programs you can use to capture live
memory from a computer, for example, free
Belkasoft Live RAM Capturer
tool. Our product also accepts the output of any of other RAM dumping tools
on the market.
- Besides RAM image file, you can also specify a path to hibernation or page files
(hiberfil.sys and pagefile.sys). These two
kind of files may contain Live RAM data written on a hard drive as a part of
Windows functioning, thus they are important source of RAM artifacts, because
the RAM contents may survive switching computer off.
There are also options what kinds of clusters to search within. You can decrease
the time required to do analysis by searching only unallocated clusters (e.g. if
you are looking for intentionally hidden data). However, sometimes carving for allocated
clusters also gives good results, for example, if trails of data are kept in existing
but corrupted file. It may not be possible to extract data from such file using
regular history extraction because of corruption but carving may solve this problem.
This is why the product allows you to choose where to carve: Unallocated
only, Allocated only or both using options under What clusters
Note: carving network drives/shares is not supported
yet. This applies to VMWare shared folders as well.
The check box called Start extraction for found profiles will
start carving, if checked, right after you close the wizard by clicking on
Finish button. If you have this check box unchecked, the selected
data source (a drive or an image) will be added to Carved data
node of Case Explorer, but the information will not be extracted.
You can extract the information from this source later by clicking Extract
data for all profiles context menu item of the corresponding node or
Extract data... menu item of Edit main menu.
On the second page of this wizard, you can select evidence types to look for:
Click Finish button to start carving. The results of the carving are presented
in the process of carving, so you can navigate to already retrieved results and
examine their properties using Item List and Item Properties.
Belkasoft Live RAM Capturer