Transcript
Page 1: (120513) #fitalk   a dig into the $log file

FORENSIC INSIGHT SEMINAR

A Dig into the $LogFile

blueangel

[email protected]

http://blueangel-forensic-note.tistory.com

Page 2: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 2 / 51

๋ชฉ์ฐจ

1. ์„œ๋ก 

2. $LogFile ๊ตฌ์กฐ

3. $LogFile ์ด๋ฒคํŠธ ๋ถ„์„

4. $LogFile Parser ๊ตฌํ˜„

5. ๊ฒฐ๋ก 

Page 3: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 3 / 51

์„œ๋ก 

- $LogFile ์ด๋ž€?

- $LogFile ํฌ๊ธฐ ์กฐ์ ˆ

Page 4: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 4 / 51

์„œ๋ก 

NTFS ํŠธ๋žœ์ ์…˜ ๋กœ๊ทธ ํŒŒ์ผ

โ€ข ์‹œ์Šคํ…œ ์˜ค๋ฅ˜๋‚˜ ๊ฐ‘์ž‘์Šค๋Ÿฐ ์ „์› ์ฐจ๋‹จ ๋ฐœ์ƒ์‹œ, ์ž‘์—… ์ค‘์ด๋˜ ํŒŒ์ผ ๋ณต๊ตฌ๋ฅผ ์œ„ํ•ด ์‚ฌ์šฉ

โ€ข ๋ชจ๋“  ํŠธ๋žœ์ ์…˜ ์ž‘์—…์„ ๋ ˆ์ฝ”๋“œ ๋‹จ์œ„๋กœ ๊ธฐ๋ก

์ƒˆ๋กœ์šด ํŒŒ์ผ/๋””๋ ‰ํ† ๋ฆฌ ์ƒ์„ฑ

ํŒŒ์ผ/๋””๋ ‰ํ† ๋ฆฌ ์‚ญ์ œ

ํŒŒ์ผ/๋””๋ ‰ํ† ๋ฆฌ ๋‚ด์šฉ ๋ณ€๊ฒฝ

MFT ์—”ํŠธ๋ฆฌ ๋‚ด์šฉ ๋ณ€๊ฒฝ

โ€ข ๊ฐ ์ž‘์—… ๋ ˆ์ฝ”๋“œ๋Š” ๊ณ ์œ ์˜ LSN($LogFile Sequence Number)์„ ๊ฐ€์ง

์ˆœ์ฐจ์ ์œผ๋กœ ์ฆ๊ฐ€

โ€ข ๋ณต๊ตฌ๋ฅผ ์œ„ํ•ด ๊ฐ ๋ ˆ์ฝ”๋“œ๋Š” ์ž‘์—… ๋ฐ์ดํ„ฐ์™€ ์ž‘์—… ์ „ ๋ฐ์ดํ„ฐ๋ฅผ ๊ฐ€์ง

Redo : ์ž‘์—…ํ•œ ๋ฐ์ดํ„ฐ

Undo : ์ž‘์—… ์ „ ๋ฐ์ดํ„ฐ

โ€ข ๊ฐ ๋ณผ๋ฅจ๋งˆ๋‹ค ํ•˜๋‚˜์”ฉ ์กด์žฌ

โ€ข MFT ์—”ํŠธ๋ฆฌ ๋ฒˆํ˜ธ 2์— ์œ„์น˜

$LogFile ์ด๋ž€?

Page 5: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 5 / 51

์„œ๋ก  - $LogFile ์ด๋ž€?

- $LogFile ํฌ๊ธฐ ์กฐ์ ˆ

Page 6: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 6 / 51

์„œ๋ก 

$LogFile ํฌ๊ธฐ

โ€ข ์ผ๋ฐ˜์ ์ธ ํ•˜๋“œ๋””์Šคํฌ ๋ณผ๋ฅจ์—์„œ๋Š” 64M ํฌ๊ธฐ

โ€ข ๋ณผ๋ฅจ ์šฉ๋Ÿ‰์— ๋”ฐ๋ผ ํฌ๊ธฐ๊ฐ€ ๋‹ฌ๋ผ์งˆ ์ˆ˜ ์žˆ์ง€๋งŒ ๊ธฐ๋ณธ์ ์œผ๋กœ๋Š” ์ตœ๋Œ€ 64M ์ดํ•˜์ž„

ํฌ๊ธฐ ์กฐ์ ˆ

โ€ข chkdsk ๋ช…๋ น์˜ /L ์˜ต์…˜์— ๋”ฐ๋ผ ํฌ๊ธฐ ์กฐ์ ˆ ๊ฐ€๋Šฅ

โ€ข โ€œ/L : ํŒŒ์ผํฌ๊ธฐ(KB ๋‹จ์œ„)โ€ ํ˜•์‹์œผ๋กœ ์ง€์ •

โ€ข ํฌ๊ธฐ๊ฐ€ ์ง€์ • ๋˜์ง€ ์•Š์œผ๋ฉด ํ˜„์žฌ ํฌ๊ธฐ ํ‘œ์‹œ

$LogFile ํฌ๊ธฐ ์กฐ์ ˆ

Page 7: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 7 / 51

$LogFile ๊ตฌ์กฐ

- ์ „์ฒด ๊ตฌ์กฐ

- ์žฌ์‹œ์ž‘ ์˜์—ญ ๊ตฌ์กฐ

- ๋กœ๊น… ์˜์—ญ ๊ตฌ์กฐ

- ํŽ˜์ด์ง€ ๊ตฌ์กฐ

- ๋ ˆ์ฝ”๋“œ ๊ตฌ์กฐ

Page 8: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 8 / 51

$LogFile ๊ตฌ์กฐ

์žฌ์‹œ์ž‘ ์˜์—ญ(Restart Area)์™€ ๋กœ๊น… ์˜์—ญ(Logging Area)๋กœ ๋‚˜๋ˆ„์–ด์ง

โ€ข ๊ฐ ์˜์—ญ์˜ ๊ตฌ์„ฑ๋‹จ์œ„๋Š” ํŽ˜์ด์ง€(ํฌ๊ธฐ : 0x1000)

โ€ข ์žฌ์‹œ์ž‘ ์˜์—ญ

๊ฐ€์žฅ ๋งˆ์ง€๋ง‰(ํ˜„์žฌ ์ž‘์—… ์ค‘์ธ) ์ž‘์—… ๋ ˆ์ฝ”๋“œ๋ฅผ ๊ฐ€๋ฆฌํ‚ด

ํŒŒ์ผ์˜ ์ฒซ ๋‘ ํŽ˜์ด์ง€ ์˜์—ญ(0x0000~0x2000)

โ€ข ๋กœ๊น… ์˜์—ญ

์‹ค์ œ ์ž‘์—… ๋ ˆ์ฝ”๋“œ๋“ค์ด ๊ธฐ๋ก๋จ

์žฌ์‹œ์ž‘ ์˜์—ญ ๋ฐ”๋กœ ๋‹ค์Œ๋ถ€ํ„ฐ ์‹œ์ž‘(0x2000~)

๋ฒ„ํผ ํŽ˜์ด์ง€ ์˜์—ญ๊ณผ ์ผ๋ฐ˜ ํŽ˜์ด์ง€ ์˜์—ญ์œผ๋กœ ๋‚˜๋ˆ„์–ด์ง

์ „์ฒด ๊ตฌ์กฐ

Page 9: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 9 / 51

$LogFile ๊ตฌ์กฐ - ์ „์ฒด ๊ตฌ์กฐ

- ์žฌ์‹œ์ž‘ ์˜์—ญ ๊ตฌ์กฐ

- ๋กœ๊น… ์˜์—ญ ๊ตฌ์กฐ

- ํŽ˜์ด์ง€ ๊ตฌ์กฐ

- ๋ ˆ์ฝ”๋“œ ๊ตฌ์กฐ

Page 10: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 10 / 51

$LogFile ๊ตฌ์กฐ

๊ฐ€์žฅ ๋งˆ์ง€๋ง‰(ํ˜„์žฌ ์ž‘์—… ์ค‘์ธ) ์ž‘์—… ๋ ˆ์ฝ”๋“œ๋ฅผ ๊ฐ€๋ฆฌํ‚ด

โ€ข Current LSN ์ •๋ณด๋ฅผ ํ†ตํ•ด ๊ฐ€์žฅ ๋งˆ์ง€๋ง‰ ์ž‘์—… ๋ ˆ์ฝ”๋“œ์˜ LSN ๋ฒˆํ˜ธ๋ฅผ ์•Œ ์ˆ˜ ์žˆ์Œ

์—ฐ์†๋œ ๋‘ ํŽ˜์ด์ง€๋กœ ๊ตฌ์„ฑ, ๋‘ ๋ฒˆ์งธ ํŽ˜์ด์ง€๋Š” ๋ฐฑ์—…์šฉ

โ€ข ๊ฐ ํŽ˜์ด์ง€๋Š” ๋งค์ง๋„˜๋ฒ„(RSTR)๋กœ ์‹œ์ž‘๋จ

์žฌ์‹œ์ž‘ ์˜์—ญ ํ—ค๋” ํฌ๋ฉง

์žฌ์‹œ์ž‘ ์˜์—ญ ๊ตฌ์กฐ

โ€œRSTRโ€ (Magic Number)

Update Sequence Offset

Update Sequence Count

Check Disk LSN

System Page Size Log Page Size Restart Offset

Minor Version

Major Version

Update Sequence Array

Current LSN Log Client Client List Flags

0 1 2 3 4 5 6 7 8 9 A B C D E F

Page 11: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 11 / 51

$LogFile ๊ตฌ์กฐ - ์ „์ฒด ๊ตฌ์กฐ

- ์žฌ์‹œ์ž‘ ์˜์—ญ ๊ตฌ์กฐ

- ๋กœ๊น… ์˜์—ญ ๊ตฌ์กฐ

- ํŽ˜์ด์ง€ ๊ตฌ์กฐ

- ๋ ˆ์ฝ”๋“œ ๊ตฌ์กฐ

Page 12: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 12 / 51

$LogFile ๊ตฌ์กฐ

์‹ค์ œ ์ž‘์—… ๋ ˆ์ฝ”๋“œ๋“ค์ด ๊ธฐ๋ก๋จ

๋ฒ„ํผ ํŽ˜์ด์ง€ ์˜์—ญ๊ณผ ์ผ๋ฐ˜ ํŽ˜์ด์ง€ ์˜์—ญ์œผ๋กœ ๋‚˜๋ˆ„์–ด์ง

โ€ข ๋ฒ„ํผ ํŽ˜์ด์ง€ ์˜์—ญ ์ฒซ ๋‘ ํŽ˜์ด์ง€(0x2000~0x4000)

์ˆœ์ฐจ์ ์œผ๋กœ ๋ ˆ์ฝ”๋“œ๊ฐ€ ๊ธฐ๋ก๋จ

ํŽ˜์ด์ง€๊ฐ€ ๋ ˆ์ฝ”๋“œ๋กœ ๊ฝ‰ ์ฐจ๋ฉด ํŽ˜์ด์ง€ ๋‚ด์šฉ์„ ์ผ๋ฐ˜ ํŽ˜์ด์ง€ ์˜์—ญ์— ๊ธฐ๋ก

์ตœ๊ทผ ์ž‘์—… ๋ ˆ์ฝ”๋“œ๋“ค์€ ๋ฒ„ํผ ํŽ˜์ด์ง€ ์˜์—ญ์— ์กด์žฌ

โ€ข ์ผ๋ฐ˜ ํŽ˜์ด์ง€ ์˜์—ญ ๋ฒ„ํผ ํŽ˜์ด์ง€ ์˜์—ญ์„ ์ œ์™ธํ•œ ๋‚˜๋จธ์ง€ ์˜์—ญ(0x4000~)

์ˆœ์ฐจ์ ์œผ๋กœ ๋ ˆ์ฝ”๋“œ๊ฐ€ ๊ธฐ๋ก๋จ

ํŒŒ์ผ ๋๊นŒ์ง€ ๊ธฐ๋ก๋˜๋ฉด ๋‹ค์‹œ ์˜์—ญ ์•ž์—์„œ๋ถ€ํ„ฐ ๋ฎ์–ด์”€

๋กœ๊น… ์˜์—ญ ๊ตฌ์กฐ

Page 13: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 13 / 51

$LogFile ๊ตฌ์กฐ - ์ „์ฒด ๊ตฌ์กฐ

- ์žฌ์‹œ์ž‘ ์˜์—ญ ๊ตฌ์กฐ

- ๋กœ๊น… ์˜์—ญ ๊ตฌ์กฐ

- ํŽ˜์ด์ง€ ๊ตฌ์กฐ

- ์ž‘์—… ๋ ˆ์ฝ”๋“œ ๊ตฌ์กฐ

Page 14: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 14 / 51

$LogFile ๊ตฌ์กฐ

ํŽ˜์ด์ง€ ๊ตฌ์„ฑ

โ€ข ํ•˜๋‚˜์˜ ํ—ค๋”์™€ ๋‹ค์ˆ˜์˜ ์ž‘์—… ๋ ˆ์ฝ”๋“œ๋“ค๋กœ ๊ตฌ์„ฑ๋จ

โ€ข ๋งˆ์ง€๋ง‰ ๋ ˆ์ฝ”๋“œ๊ฐ€ ํŽ˜์ด์ง€๋ฅผ ๋„˜์–ด๊ฐ€๋ฉด ๋‹ค์Œ ํŽ˜์ด์ง€์— ์ด์–ด์„œ ๊ธฐ๋ก๋จ

ํŽ˜์ด์ง€ ํ—ค๋” : ํŽ˜์ด์ง€์˜ ๋ฉ”ํƒ€ ๋ฐ์ดํ„ฐ๊ฐ€ ์ €์žฅ๋จ

โ€ข Magic Number : โ€œRCRDโ€

โ€ข Last LSN : ํŽ˜์ด์ง€๋ฅผ ๋„˜์–ด๊ฐ€๋Š” ๋ ˆ์ฝ”๋“œ๋ฅผ ํฌํ•จํ•ด์„œ ๊ฐ€์žฅ ํฐ LSN

โ€ข Next Record Offset : Last LSN์— ํ•ด๋‹นํ•˜๋Š” ๋ ˆ์ฝ”๋“œ์˜ ํŽ˜์ด์ง€ ๋‚ด Offset

โ€ข Last End LSN : ํŽ˜์ด์ง€๋ฅผ ๋„˜์–ด๊ฐ€์ง€ ์•Š๋Š” ๋ ˆ์ฝ”๋“œ๋“ค ์ค‘์— ๊ฐ€์žฅ ํฐ LSN

ํŽ˜์ด์ง€ ๊ตฌ์กฐ

โ€œRCRDโ€ (Magic Number)

Update Sequence Offset

Update Sequence Count

Last LSN or File Offset

Flags Page Count

Page Position

Next Record Offset

Word Align

DWord Align

Last End LSN

Update Sequence Array

0 1 2 3 4 5 6 7 8 9 A B C D E F

Page 15: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 15 / 51

$LogFile ๊ตฌ์กฐ - ์ „์ฒด ๊ตฌ์กฐ

- ์žฌ์‹œ์ž‘ ์˜์—ญ ๊ตฌ์กฐ

- ๋กœ๊น… ์˜์—ญ ๊ตฌ์กฐ

- ํŽ˜์ด์ง€ ๊ตฌ์กฐ

- ์ž‘์—… ๋ ˆ์ฝ”๋“œ ๊ตฌ์กฐ

Page 16: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 16 / 51

$LogFile ๊ตฌ์กฐ

์ž‘์—… ๋ ˆ์ฝ”๋“œ

โ€ข ์‹ค์ œ ํŠธ๋žœ์ ์…˜ ์ž‘์—…์˜ ๋‚ด์šฉ์ด ๊ธฐ๋ก๋จ

โ€ข ์—ฌ๋Ÿฌ ์ž‘์—… ๋ ˆ์ฝ”๋“œ๊ฐ€ ์ˆœ์ฐจ์ ์œผ๋กœ ๋ชจ์—ฌ์„œ ํ•˜๋‚˜์˜ ํŠธ๋žœ์ ์…˜ ์ž‘์—…์„ ์ด๋ฃธ

Check Point Record : ํŠธ๋žœ์ ์…˜ ์‹œ์ž‘ ๋ ˆ์ฝ”๋“œ

Update Record : ์ค‘๊ฐ„ ์ž‘์—… ๋ ˆ์ฝ”๋“œ

Commit Record : ํŠธ๋žœ์ ์…˜ ๋งˆ์ง€๋ง‰ ๋ ˆ์ฝ”๋“œ

โ€ข Check Point Record ์™ธ ๋ ˆ์ฝ”๋“œ๋“ค์€ ์ž์‹ ์˜ ์ด์ „ ์ž‘์—… ๋ ˆ์ฝ”๋“œ์˜ LSN์„ ๊ฐ€์ง€๊ณ  ์žˆ์Œ

์ž‘์—… ๋ ˆ์ฝ”๋“œ ๊ตฌ์กฐ

Page 17: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 17 / 51

$LogFile ๊ตฌ์กฐ

์ž‘์—… ๋ ˆ์ฝ”๋“œ(๊ณ„์†)

โ€ข ์ž‘์—… ๋ ˆ์ฝ”๋“œ ๊ตฌ์„ฑ : ๋ ˆ์ฝ”๋“œ ํ—ค๋”์™€ ๋ฐ์ดํ„ฐ๋กœ ๊ตฌ์„ฑ ๋จ

๋ ˆ์ฝ”๋“œ ํ—ค๋” : ๋ ˆ์ฝ”๋“œ ๋ฉ”ํƒ€ ๋ฐ์ดํ„ฐ ์ €์žฅ, ๊ณ ์ • ํฌ๊ธฐ(0x58)

๋ ˆ์ฝ”๋“œ ๋ฐ์ดํ„ฐ

โ€ข Redo : ์ž‘์—… ํ›„ ๋‚ด์šฉ(์˜ˆ : ์“ฐ๊ธฐ ์ž‘์—…์ด๋ฉด ์“ฐ์—ฌ์ง„ ๋ฐ์ดํ„ฐ)

โ€ข Undo : ์ž‘์—… ์ „ ๋‚ด์šฉ(์˜ˆ : ์“ฐ๊ธฐ ์ž‘์—…์ด๋ฉด ์“ฐ์—ฌ์ง€๊ธฐ ์ „ ๋ฐ์ดํ„ฐ)

โ€ข ์—๋Ÿฌ ๋ณต๊ตฌ์‹œ์˜ ์ž‘์—… ๋‚ด์šฉ

Commit Record ๋ถ€ํ„ฐ ์ด์ „ LSN ์ •๋ณด๋ฅผ ์ด์šฉ, ์—ญ์œผ๋กœ ์ถ”์ ํ•˜๋ฉด์„œ Undo ๋ฐ์ดํ„ฐ ์ ์šฉ

์ž‘์—… ๋ ˆ์ฝ”๋“œ ๊ตฌ์กฐ

Page 18: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 18 / 51

$LogFile ๊ตฌ์กฐ

์ž‘์—… ๋ ˆ์ฝ”๋“œ ํ—ค๋” ํฌ๋ฉง

โ€ข This LSN : ํ˜„์žฌ ์ž‘์—… ๋ ˆ์ฝ”๋“œ์˜ LSN

โ€ข Previous LSN : ์ด์ „ ์ž‘์—… ๋ ˆ์ฝ”๋“œ์˜ LSN

โ€ข Client Undo LSN : ๋ณต๊ตฌ ์‹œ, ๋‹ค์Œ Undo ์ž‘์—…์„ ๊ฐ€์ง€๊ณ  ์žˆ๋Š” ๋ ˆ์ฝ”๋“œ์˜ LSN, ๋ณดํ†ต Previous LSN๊ณผ ๋™์ผ

โ€ข Client Data Length : ๋ ˆ์ฝ”๋“œ์˜ ํฌ๊ธฐ, Redo Op ์‹œ์ž‘ ์œ„์น˜๋ถ€ํ„ฐ ์ด ๊ฐ’์„ ๋”ํ•˜๋ฉด ๋ ˆ์ฝ”๋“œ ๋์„ ๊ตฌํ•  ์ˆ˜ ์žˆ์Œ

โ€ข Record Type : 0x02 (Check Point Record), 0x01(๊ทธ ์™ธ Record)

โ€ข Flags : 0x01(ํ˜„์žฌ ๋ ˆ์ฝ”๋“œ๊ฐ€ ํŽ˜์ด์ง€๋ฅผ ๋„˜์–ด๊ฐ), 0x00(ํ˜„์žฌ ๋ ˆ์ฝ”๋“œ๊ฐ€ ํŽ˜์ด์ง€๋ฅผ ๋„˜์–ด๊ฐ€์ง€ ์•Š์Œ)

์ž‘์—… ๋ ˆ์ฝ”๋“œ ๊ตฌ์กฐ

This LSN Previous LSN

Client Undo LSN Client Data Length Client ID

Record Type Transaction ID Flags Alignment or Reserved

Redo OP Undo OP Redo Offset Redo Length

Undo Offset Undo Length

Target Attribute

LCNs to follows

Record Offset

Attr Offset MFT Cluster Index

Alignment or Reserved

Target VCN Alignment or Reserved

Target LCN Alignment or Reserved

0 1 2 3 4 5 6 7 8 9 A B C D E F

Page 19: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 19 / 51

$LogFile ๊ตฌ์กฐ

์ž‘์—… ๋ ˆ์ฝ”๋“œ ํ—ค๋” ํฌ๋ฉง(๊ณ„์†)

โ€ข Redo Op : Redo ์—ฐ์‚ฐ ์ฝ”๋“œ

โ€ข Undo Op : Undo ์—ฐ์‚ฐ ์ฝ”๋“œ

โ€ข Redo Offset : Redo ๋ฐ์ดํ„ฐ ์‹œ์ž‘ Offset(Redo Op ์œ„์น˜๋ถ€ํ„ฐ)

โ€ข Redo Length : Redo ๋ฐ์ดํ„ฐ ๊ธธ์ด

โ€ข Undo Offset : Undo ๋ฐ์ดํ„ฐ ์‹œ์ž‘ Offset(Redo Op ์œ„์น˜๋ถ€ํ„ฐ)

โ€ข Undo Length : Undo ๋ฐ์ดํ„ฐ ๊ธธ์ด

์ž‘์—… ๋ ˆ์ฝ”๋“œ ๊ตฌ์กฐ

This LSN Previous LSN

Client Undo LSN Client Data Length Client ID

Record Type Transaction ID Flags Alignment or Reserved

Redo OP Undo OP Redo Offset Redo Length

Undo Offset Undo Length

Target Attribute

LCNs to follows

Record Offset

Attr Offset MFT Cluster Index

Alignment or Reserved

Target VCN Alignment or Reserved

Target LCN Alignment or Reserved

0 1 2 3 4 5 6 7 8 9 A B C D E F

Page 20: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 20 / 51

$LogFile ๊ตฌ์กฐ

์ž‘์—… ๋ ˆ์ฝ”๋“œ ํ—ค๋” ํฌ๋ฉง(๊ณ„์†)

โ€ข LCNs to Follows : 0x01(์ด์–ด์ง€๋Š” ๋ ˆ์ฝ”๋“œ๊ฐ€ ์žˆ์Œ), 0x00(์ด์–ด์ง€๋Š” ๋ ˆ์ฝ”๋“œ๊ฐ€ ์—†์Œ)

โ€ข Record Offset

MFT ๋ ˆ์ฝ”๋“œ์— ๋Œ€ํ•œ ์ž‘์—…์ผ ๊ฒฝ์šฐ, Redo/Undo ๋ฐ์ดํ„ฐ๊ฐ€ ์ ์šฉ๋˜๋Š” ์†์„ฑ์˜ MFT ๋ ˆ์ฝ”๋“œ ๋‚ด Offset

MFT ๋ ˆ์ฝ”๋“œ์— ๋Œ€ํ•œ ์ž‘์—…์ด ์•„๋‹Œ ๊ฒฝ์šฐ, ๊ฐ’์€ 0x00

โ€ข Attr Offset

MFT ๋ ˆ์ฝ”๋“œ์— ๋Œ€ํ•œ ์ž‘์—…์ผ ๊ฒฝ์šฐ, Redo/Undo ๋ฐ์ดํ„ฐ๊ฐ€ ์ ์šฉ๋˜๋Š” ์†์„ฑ ๋‚ด Offset

MFT ๋ ˆ์ฝ”๋“œ์— ๋Œ€ํ•œ ์ž‘์—…์ด ์•„๋‹Œ ๊ฒฝ์šฐ, Redo/Undo ๋ฐ์ดํ„ฐ๊ฐ€ ์ ์šฉ๋˜๋Š” ํด๋Ÿฌ์Šคํ„ฐ ๋‚ด Offset

โ€ข Taret LCN : Redo/Undo ๋ฐ์ดํ„ฐ๊ฐ€ ์ ์šฉ๋˜๋Š” ๋””์Šคํฌ ์ƒ์˜ LCN(Logical Cluster Number)

โ€ข MFT Cluster Index : MFT ์—”ํŠธ๋ฆฌ๊ฐ€ ์žˆ๋Š” ํ•˜๋‚˜์˜ ํด๋Ÿฌ์Šคํ„ฐ ๋‚ด์—์„œ ๋ช‡ ๋ฒˆ์งธ ์—”ํŠธ๋ฆฌ์— ํ•ด๋‹นํ•˜๋Š”์ง€์— ๋Œ€ํ•œ ๊ฐ’

1๋ฒˆ์งธ(0x0000), 2๋ฒˆ์งธ(0x0002), 3๋ฒˆ์งธ(0x0003), 4๋ฒˆ์งธ(0x0006)

์ž‘์—… ๋ ˆ์ฝ”๋“œ ๊ตฌ์กฐ

This LSN Previous LSN

Client Undo LSN Client Data Length Client ID

Record Type Transaction ID Flags Alignment or Reserved

Redo OP Undo OP Redo Offset Redo Length

Undo Offset Undo Length

Target Attribute

LCNs to follows

Record Offset

Attr Offset MFT Cluster Index

Alignment or Reserved

Target VCN Alignment or Reserved

Target LCN Alignment or Reserved

0 1 2 3 4 5 6 7 8 9 A B C D E F

Page 21: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 21 / 51

$LogFile ๊ตฌ์กฐ

Redo/Undo ์—ฐ์‚ฐ ์ฝ”๋“œ

์ž‘์—… ๋ ˆ์ฝ”๋“œ ๊ตฌ์กฐ

NTFS ๋กœ๊ทธ ๋™์ž‘ Hex Value

Noop 0x00

CompensationlogRecord 0x01

InitializeFileRecordSegment 0x02

DeallocateFileRecordSegment 0x03

WriteEndofFileRecordSegement 0x04

CreateAttribute 0x05

DeleteAttribute 0x06

UpdateResidentValue 0x07

UpdataeNonResidentValue 0x08

UpdateMappingPairs 0x09

DeleteDirtyClusters 0x0A

SetNewAttributeSizes 0x0B

Page 22: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 22 / 51

$LogFile ๊ตฌ์กฐ

Redo/Undo ์—ฐ์‚ฐ ์ฝ”๋“œ(๊ณ„์†)

์ž‘์—… ๋ ˆ์ฝ”๋“œ ๊ตฌ์กฐ

AddindexEntryRoot 0x0C

DeleteindexEntryRoot 0x0D

AddIndexEntryAllocation 0x0F

SetIndexEntryVenAllocation 0x12

UpdateFileNameRoot 0x13

UpdateFileNameAllocation 0x14

SetBitsInNonresidentBitMap 0x15

ClearBitsInNonresidentBitMap 0x16

PrepareTransaction 0x19

CommitTransaction 0x1A

ForgetTransaction 0x1B

OpenNonresidentAttribute 0x1C

DirtyPageTableDump 0x1F

TransactionTableDump 0x20

UpdateRecordDataRoot 0x21

Page 23: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 23 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„

- ํŒŒ์ผ ์ƒ์„ฑ ์ด๋ฒคํŠธ

- ํŒŒ์ผ ์‚ญ์ œ ์ด๋ฒคํŠธ

- ํŒŒ์ผ ๋ฐ์ดํ„ฐ ์ž‘์„ฑ/์ˆ˜์ • ์ด๋ฒคํŠธ

- ํŒŒ์ผ๋ช… ๋ณ€๊ฒฝ ์ด๋ฒคํŠธ

Page 24: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 24 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„

Resident File ์ƒ์„ฑ ๊ด€๋ จ ์ด๋ฒคํŠธ

Resident File ์ƒ์„ฑ ์ด๋ฒคํŠธ ์ˆœ์„œ(Redo/Undo) : ์ค‘๊ฐ„์— ๋“ค์–ด๊ฐˆ ์ˆ˜ ์žˆ๋Š” OpenNonResidentAttribute Redo ์ž‘์—…์€ ๋ฌด์‹œ

1. 0x15/0x16(Set Bits In Nonresident Bit Map/Clear Bits In Nonresident Bit Map)

2. 0x00/0x03(Noop/Deallocate File Record Segment)

3. 0x0E/0x0F(Add Index Entry Allocation/Delete Index Entry Allocation)

4. 0x02/0x00(Initialize File Record Segment/Noop)

5. 0x1B/0x01(Forget Transaction/Compensation Log Record)

ํŒŒ์ผ ์ƒ์„ฑ ์ด๋ฒคํŠธ

Page 25: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 25 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„

Resident File ์ƒ์„ฑ ๊ด€๋ จ ์ด๋ฒคํŠธ์—์„œ ์–ป์–ด ์˜ฌ ์ˆ˜ ์žˆ๋Š” ์ •๋ณด 1

โ€ข MFT ๋ ˆ์ฝ”๋“œ ๋ฒˆํ˜ธ, ์ƒ์„ฑ ํŒŒ์ผ ์ „์ฒด ๊ฒฝ๋กœ

0x15/0x16(Set Bits In Nonresident Bit Map/Clear Bits In Nonresident Bit Map) ์ž‘์—…์˜ Redo ๋ฐ์ดํ„ฐ์—์„œ ์–ป์–ด์˜ด

Redo ๋ฐ์ดํ„ฐ์˜ ์ฒซ 4๋ฐ”์ดํŠธ๋Š” ์ž‘์—… ๋Œ€์ƒ MFT ๋ ˆ์ฝ”๋“œ ๋ฒˆํ˜ธ์ž„

MFT ๋ ˆ์ฝ”๋“œ ๋ฒˆํ˜ธ๋ฅผ ํ†ตํ•ด ํ•ด๋‹น ํŒŒ์ผ์˜ ์ •๋ณด๋ฅผ ๊ฐ€์ ธ์˜ฌ ์ˆ˜ ์žˆ์Œ

โ€ข ํ•ด๋‹น MFT ๋ ˆ์ฝ”๋“œ์˜ $FILE_NAME ์†์„ฑ์—์„œ ์ƒ์„ฑ ํŒŒ์ผ๋ช… ํš๋“

โ€ข MFT ๋ฒˆํ˜ธ๋ฅผ ์•Œ๋ฉด MFT ํ•ด์„์„ ํ†ตํ•ด ์ƒ์„ฑ๋œ ํŒŒ์ผ์˜ ์ „์ฒด ๊ฒฝ๋กœ๋ฅผ ๊ฐ€์ ธ ์˜ฌ ์ˆ˜ ์žˆ์Œ

ํŒŒ์ผ ์ƒ์„ฑ ์ด๋ฒคํŠธ

Current LSN

Previous LSN

Redo Op

Undo Op

Page 26: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 26 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„

Resident File ์ƒ์„ฑ ๊ด€๋ จ ์ด๋ฒคํŠธ์—์„œ ์–ป์–ด ์˜ฌ ์ˆ˜ ์žˆ๋Š” ์ •๋ณด 2

โ€ข ํŒŒ์ผ ์ƒ์„ฑ ์‹œ๊ฐ„๊ณผ ์ƒ์„ฑ ํŒŒ์ผ๋ช…, ์ „์ฒด ๊ฒฝ๋กœ

0x02/0x00(Initialize File Record Segment/Noop) ์ž‘์—…์˜ Redo ๋ฐ์ดํ„ฐ์—์„œ ์–ป์–ด์˜ด

Redo ๋ฐ์ดํ„ฐ ๋‚ด์šฉ์€ MFT ๋ ˆ์ฝ”๋“œ์˜ ๋‚ด์šฉ

โ€ข $STANDARD_INFORMATION ์†์„ฑ์—์„œ ํŒŒ์ผ ์ƒ์„ฑ ์‹œ๊ฐ„์„ ๊ฐ€์ ธ์˜ด

โ€ข $FILE_NAME ์†์„ฑ์—์„œ ์ƒ์„ฑ ํŒŒ์ผ์˜ ์ด๋ฆ„์„ ๊ฐ€์ ธ์˜ด, Parent File Reference Address ๊ฐ’์„ ํ†ตํ•ด ๋ถ€๋ชจ ๋””๋ ‰ํ† ๋ฆฌ์™€ ์ „์ฒด ๊ฒฝ๋กœ๋ฅผ ์•Œ ์ˆ˜ ์žˆ์Œ

โ€ข $INDEX_ROOT ์†์„ฑ์ด ์žˆ๋‹ค๋ฉด ๋””๋ ‰ํ† ๋ฆฌ ์ƒ์„ฑ์ž„

ํŒŒ์ผ ์ƒ์„ฑ ์ด๋ฒคํŠธ

Current LSN

Previous LSN

Redo Op

Undo Op

Redo Data

Page 27: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 27 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„

Non Resident ํŒŒ์ผ ์ƒ์„ฑ ์ด๋ฒคํŠธ

โ€ข Resident ํŒŒ์ผ๊ณผ ๋™์ผ

MFT ๋ ˆ์ฝ”๋“œ ํ• ๋‹นํ•˜๋Š” ๊ฒƒ์—์„œ๋Š” Resident ํŒŒ์ผ ์ƒ์„ฑ ์ž‘์—…๊ณผ ์ฐจ์ด ์—†์Œ

Resident ํŒŒ์ผ ์ƒ์„ฑ ๊ฒฝ์šฐ์™€ ๋™์ผํ•˜๊ฒŒ ์ •๋ณด ํš๋“ ๊ฐ€๋Šฅ

ํŒŒ์ผ ์ƒ์„ฑ ์ด๋ฒคํŠธ

Page 28: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 28 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„

๊ธด ํŒŒ์ผ๋ช…์˜ ํŒŒ์ผ ์ƒ์„ฑ์ผ ๊ฒฝ์šฐ

โ€ข 0x0E/0x0F(Add Index Entry Allocation/Delete Index Entry Allocation) ์ž‘์—…์„ ํ•œ ๋ฒˆ ๋” ๋ฐ˜๋ณตํ•จ

๊ธด ํŒŒ์ผ๋ช…์ด๊ธฐ ๋•Œ๋ฌธ์— Index Entry๋ฅผ ํ•˜๋‚˜ ๋” ํ• ๋‹น

โ€ข ํŒŒ์ผ๋ช…์„ ๊ฐ€์ ธ์˜ฌ ๊ฒฝ์šฐ, ๋‘ ๋ฒˆ์งธ $FILE_NAME ์†์„ฑ์—์„œ ๊ฐ€์ ธ์˜ด

ํŒŒ์ผ ์ƒ์„ฑ ์ด๋ฒคํŠธ

Page 29: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 29 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„ - ํŒŒ์ผ ์ƒ์„ฑ ์ด๋ฒคํŠธ

- ํŒŒ์ผ ์‚ญ์ œ ์ด๋ฒคํŠธ

- ํŒŒ์ผ ๋ฐ์ดํ„ฐ ์ž‘์„ฑ/์ˆ˜์ • ์ด๋ฒคํŠธ

- ํŒŒ์ผ๋ช… ๋ณ€๊ฒฝ ์ด๋ฒคํŠธ

Page 30: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 30 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„

Resident File ์‚ญ์ œ ๊ด€๋ จ ์ด๋ฒคํŠธ

Resident File ์‚ญ์ œ ์ด๋ฒคํŠธ ์ˆœ์„œ(Redo/Undo) : ์ค‘๊ฐ„์— ๋“ค์–ด๊ฐˆ ์ˆ˜ ์žˆ๋Š” OpenNonResidentAttribute Redo ์ž‘์—…์€ ๋ฌด์‹œ

1. 0x0F/0x0E(Delete Index Entry Allocation/Add Index Entry Allocation)

2. 0x03/0x02(Deallocation File Record Segment/Initialize File Record Segment)

3. 0x16/0x15(Clear Bits In Nonresident Bit Map/Set Bits In Nonresident Bit Map)

4. 0x1B/0x01(Forget Transaction/Compensation Log Record)

ํŒŒ์ผ ์‚ญ์ œ ์ด๋ฒคํŠธ

Page 31: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 31 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„

Resident File ์‚ญ์ œ ๊ด€๋ จ ์ด๋ฒคํŠธ์—์„œ ์–ป์–ด ์˜ฌ ์ˆ˜ ์žˆ๋Š” ์ •๋ณด

โ€ข ์‚ญ์ œ๋œ ํŒŒ์ผ๋ช…, ์ „์ฒด ๊ฒฝ๋กœ

0x0F/0x0E(Delete Index Entry Allocation/Add Index Entry Allocation) ์ž‘์—…์˜ Undo ๋ฐ์ดํ„ฐ์—์„œ ์–ป์–ด์˜ด

Undo ๋ฐ์ดํ„ฐ์˜ ๋‚ด์šฉ์€ Index Entry ์•ˆ์˜ Content ๋‚ด์šฉ($FileName ์†์„ฑ)

Parent File Reference Address ๊ฐ’์„ ํ†ตํ•ด ๋ถ€๋ชจ ๋””๋ ‰ํ† ๋ฆฌ์™€ ์ „์ฒด ๊ฒฝ๋กœ๋ฅผ ๊ฐ€์ ธ์˜ด

Name ๊ฐ’์„ ํ†ตํ•ด ์‚ญ์ œ๋œ ํŒŒ์ผ๋ช… ํš๋“

ํŒŒ์ผ ์‚ญ์ œ ์ด๋ฒคํŠธ

Current LSN

Previous LSN

Redo Op

Undo Op

Undo Data

Page 32: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 32 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„

๊ธด ํŒŒ์ผ๋ช…์˜ ํŒŒ์ผ์„ ์‚ญ์ œํ•  ๊ฒฝ์šฐ โ€ข 0x0F/0x0E(Delete Index Entry Allocation/Add Index Entry Allocation) ์ž‘์—…์ด ๋‘ ๋ฒˆ ์ผ์–ด๋‚จ

๊ธด ํŒŒ์ผ๋ช…์ด๊ธฐ ๋•Œ๋ฌธ์— Index Entry๊ฐ€ ๋‘ ๊ฐœ์ด๊ธฐ ๋•Œ๋ฌธ

โ€ข ์‚ญ์ œ๋œ ํŒŒ์ผ๋ช…์„ ๊ฐ€์ ธ์˜ค๊ธฐ ์œ„ํ•ด์„œ๋Š” ๋‘ ๋ฒˆ์งธ 0x0F/0x0E(Delete Index Entry Allocation/Add Index Entry Allocation) ์ž‘์—…์˜ Undo ๋ฐ์ดํ„ฐ์—์„œ ๊ฐ€์ ธ์˜ด

ํŒŒ์ผ ์‚ญ์ œ ์ด๋ฒคํŠธ

Page 33: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 33 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„

Non Resident ํŒŒ์ผ ์‚ญ์ œ ์ด๋ฒคํŠธ

โ€ข Resident ์‚ญ์ œ ์ž‘์—…๊ณผ ๋™์ผํ•˜๊ฒŒ ํŒ๋‹จ

Resident ์‚ญ์ œ ์ž‘์—…๊ณผ ๋งˆ์ฐฌ๊ฐ€์ง€๋กœ ํŒŒ์ผ๋ช…์ด ๊ธด ๊ฒฝ์šฐ, Delete Index Entry Allocation ์ž‘์—…์ด ๋‘ ๋ฒˆ ์ผ์–ด๋‚จ

์‚ญ์ œ ํŒŒ์ผ๋ช…, ์ „์ฒด ๊ฒฝ๋กœ๋Š” Resident ํŒŒ์ผ ์‚ญ์ œ์˜ ๊ฒฝ์šฐ์™€ ๋™์ผํ•˜๊ฒŒ ํš๋“

โ€ข Non Resident File ์‚ญ์ œ ์ด๋ฒคํŠธ ์ˆœ์„œ(Redo/Undo) : โ€œDelete Index Entry Rootโ€ Redo ์ž‘์—…์ด ๋“ค์–ด๊ฐˆ ์ˆ˜ ์žˆ์Œ

1. 0x0F/0x0E(Delete Index Entry Allocation(or Root)/Add Index Entry Allocation(or Root))

2. 0x03/0x02(Deallocation File Record Segment/Initialize File Record Segment)

3. 0x16/0x15(Clear Bits In Nonresident Bit Map/Set Bits In Nonresident Bit Map)

4. 0x1B/0x01(Forget Transaction/Compensation Log Record)

ํŒŒ์ผ ์‚ญ์ œ ์ด๋ฒคํŠธ

Page 34: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 34 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„ - ํŒŒ์ผ ์ƒ์„ฑ ์ด๋ฒคํŠธ

- ํŒŒ์ผ ์‚ญ์ œ ์ด๋ฒคํŠธ

- ํŒŒ์ผ ๋ฐ์ดํ„ฐ ์ž‘์„ฑ/์ˆ˜์ • ์ด๋ฒคํŠธ

- ํŒŒ์ผ๋ช… ๋ณ€๊ฒฝ ์ด๋ฒคํŠธ

Page 35: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 35 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„

Resident File ํŒŒ์ผ ๋ฐ์ดํ„ฐ ์ž‘์„ฑ

โ€ข Redo ์ž‘์—…์ด Update Resident Value ์ด๊ณ  Record Offset ์ด 0xF8 ์ด์ƒ, ๊ทธ๋ฆฌ๊ณ  Attr Offset ์ด 0x18 ์ด์ƒ์ด๋ฉด $Data ์†์„ฑ์— ๋Œ€ํ•œ ์—…๋ฐ์ดํŠธ ์ž‘์—…์ด๋ผ๊ณ  ๋ณผ ์ˆ˜ ์žˆ์Œ

ํŒŒ์ผ๋ช… ๊ธธ์ด๊ฐ€ 1์ธ ๊ฒฝ์šฐ(์งง์€ ํŒŒ์ผ๋ช…), $Data์†์„ฑ์˜ ์‹œ์ž‘์œ„์น˜๋Š” 0xF8

$Data ์†์„ฑ์—์„œ 0x18 ์œ„์น˜๋ถ€ํ„ฐ ์‹ค์ œ ๋ฐ์ดํ„ฐ๊ฐ€ ๋“ค์–ด๊ฐ

โ€ข Undo์˜ ๋ฐ์ดํ„ฐ๊ฐ€ ๋ชจ๋‘ 0์ด๋ฉด ์ƒˆ๋กœ์šด ํŒŒ์ผ ๋‚ด์šฉ ์ž‘์„ฑ, ๊ทธ๋ ‡์ง€ ์•Š์œผ๋ฉด ํŒŒ์ผ ๋‚ด์šฉ ์ˆ˜์ •

ํŒŒ์ผ ๋ฐ์ดํ„ฐ ์ž‘์„ฑ/์ˆ˜์ • ์ด๋ฒคํŠธ

Current LSN

Previous LSN

Redo Op

Undo Op

Redo Data

Undo Data

Record Offset

Attr Offset

Page 36: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 36 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„

Resident File ํŒŒ์ผ ๋ฐ์ดํ„ฐ ์ˆ˜์ •

โ€ข Undo ์— ๋ฐ์ดํ„ฐ๊ฐ€ ์žˆ์Œ

Undo์˜ ๋ฐ์ดํ„ฐ๊ฐ€ ์ˆ˜์ • ์ „์˜ ๋‚ด์šฉ

Redo์˜ ๋ฐ์ดํ„ฐ๊ฐ€ ์ˆ˜์ • ํ›„์˜ ๋‚ด์šฉ

ํŒŒ์ผ ๋ฐ์ดํ„ฐ ์ž‘์„ฑ/์ˆ˜์ • ์ด๋ฒคํŠธ

Current LSN

Previous LSN

Redo Op

Undo Op

Redo Data

Undo Data

Record Offset

Attr Offset

Page 37: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 37 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„

๋Œ€์ƒ ํŒŒ์ผ ์ฐพ๊ธฐ

โ€ข Update Resident Value ์ž‘์—…์˜ Target LCN, MFT Cluster Index ๊ฐ’๊ณผ Initialize File Record Segment ์ž‘์—…์˜

Target LCN, MFT Cluster Index ๊ฐ’์„ ๋น„๊ต

โ€ข ๊ฐ™์€ Target LCN, MFT Cluster Index ๊ฐ’์„ ๊ฐ€์ง€๊ณ  ์žˆ์œผ๋ฉด Initialize File Record Segment ์ž‘์—…์„ ํ†ตํ•ด ์ƒ์„ฑ๋œ

ํŒŒ์ผ์˜ ๋‚ด์šฉ์„ ์ž‘์„ฑ/์ˆ˜์ •ํ•œ ๊ฒƒ์ด๋ผ ๋ณผ ์ˆ˜ ์žˆ์Œ

ํŒŒ์ผ ๋ฐ์ดํ„ฐ ์ž‘์„ฑ/์ˆ˜์ • ์ด๋ฒคํŠธ

Page 38: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 38 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„

Non Resident ๋‚ด์šฉ/์ž‘์„ฑ ์ˆ˜์ • ์ด๋ฒคํŠธ

โ€ข Non Resident ํŒŒ์ผ์˜ ๊ฒฝ์šฐ, ์‹ค์ œ ํŒŒ์ผ์˜ ๋‚ด์šฉ์ด ์™ธ๋ถ€ ํด๋Ÿฌ์Šคํ„ฐ์— ์ €์žฅ๋จ

0x09/0x09(Update Mapping Pairs/Update Mapping Pairs) ์ž‘์—…์„ ํ†ตํ•ด ๋ฐ์ดํ„ฐ ์ž‘์„ฑ ์œ„์น˜๋ฅผ ํ™•์ธ ํ•  ์ˆ˜ ์žˆ์Œ

Attr Offset์ด 0x40 ์ผ ๊ฒฝ์šฐ, Cluster Run ์ž‘์„ฑ ๋‚ด์šฉ์„ Redo/Undo ๋ฐ์ดํ„ฐ์—์„œ ํš๋“ํ•  ์ˆ˜ ์žˆ์Œ(0x41์ผ ๊ฒฝ์šฐ, ํ™•์ธ ๋ถˆ๊ฐ€)

Redo/Undo ์ž‘์—…์˜ ๋ฐ์ดํ„ฐ๋Š” Cluster Run ์ž‘์„ฑ ๋‚ด์šฉ์ž„

์•„๋ž˜์˜ ๊ฒฝ์šฐ, 0x26๋ฒˆ์งธ ํด๋Ÿฌ์Šคํ„ฐ๋ถ€ํ„ฐ 2ํด๋Ÿฌ์Šคํ„ฐ๊ฐ€ ์‚ฌ์šฉ๋˜์—ˆ์Œ

ํŒŒ์ผ ๋ฐ์ดํ„ฐ ์ž‘์„ฑ/์ˆ˜์ • ์ด๋ฒคํŠธ

Current LSN

Previous LSN

Redo Op

Undo Op

Redo Data

Undo Data

Record Offset

Attr Offset

Page 39: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 39 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„

Non Resident ํŒŒ์ผ ์ƒ์„ฑ์‹œ, ํ•ด๋‹น ํŒŒ์ผ์˜ ๋ฐ์ดํ„ฐ ์œ„์น˜ ํŒŒ์•…ํ•˜๊ธฐ

โ€ข Resident ํŒŒ์ผ ๋‚ด์šฉ ์ž‘์„ฑ์˜ ๊ฒฝ์šฐ์™€ ๋งˆ์ฐฌ๊ฐ€์ง€๋กœ Target LCN, MFT Cluster Index ๋น„๊ต๋ฅผ ํ†ตํ•ด ๋ฐ์ดํ„ฐ๊ฐ€ ์ž‘์„ฑ๋˜๋Š” ํŒŒ์ผ์„ ์ฐพ์„ ์ˆ˜ ์žˆ์Œ

โ€ข ์ผ๋ฐ˜์ ์œผ๋กœ ํŒŒ์ผ ์ƒ์„ฑ ์ด๋ฒคํŠธ ๋‹ค์Œ์— ๋ฐ”๋กœ ์˜ค๋Š” Update Mapping Pairs ์ž‘์—…์ด ์ƒ์„ฑํ•œ ํŒŒ์ผ์˜ ๋ฐ์ดํ„ฐ ์“ฐ๊ธฐ ์ž‘์—…์ž„

โ€ข Non Resident ํŒŒ์ผ ์ƒ์„ฑ์‹œ, ๋ฐ์ดํ„ฐ ์ž‘์„ฑ ์ด๋ฒคํŠธ

1. 0x06/0x05(Delete Attribute/Create Attribute)

2. 0x05/0x06(Create Attribute/Delete Attribute)

3. 0x15/0x16(Set Bits In Nonresident Bit Map/Clear Bits In Nonresident Bit Map)

4. 0x0B/0X0B(Set New Attribute Sizes/ Set New Attribute Sizes)

5. 0X09/0X09(Update Mapping Pairs/ Update Mapping Pairs)

6. 0x0B/0X0B(Set New Attribute Sizes/ Set New Attribute Sizes)

7. 0X1B/0X01(Forget Transaction/Compensation Log Record)

ํŒŒ์ผ ๋ฐ์ดํ„ฐ ์ž‘์„ฑ/์ˆ˜์ • ์ด๋ฒคํŠธ

Page 40: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 40 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„ - ํŒŒ์ผ ์ƒ์„ฑ ์ด๋ฒคํŠธ

- ํŒŒ์ผ ์‚ญ์ œ ์ด๋ฒคํŠธ

- ํŒŒ์ผ ๋ฐ์ดํ„ฐ ์ž‘์„ฑ/์ˆ˜์ • ์ด๋ฒคํŠธ

- ํŒŒ์ผ๋ช… ๋ณ€๊ฒฝ ์ด๋ฒคํŠธ

Page 41: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 41 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„

ํŒŒ์ผ๋ช… ๋ณ€๊ฒฝ ์‹œ, ์ผ์–ด๋‚˜๋Š” ์ž‘์—…

โ€ข ์ธ๋ฑ์Šค ์‚ญ์ œ, ์ถ”๊ฐ€ ์ž‘์—…

โ€ข $FILE_NAME ์†์„ฑ ์‚ญ์ œ, ์ถ”๊ฐ€ ์ž‘์—…

Record Offset ์ด 0x98, Attr Offset ์ด 0x00 ์ธ Delete Attribute์™€ Create Attribute ์ž‘์—…์ด ์—ฐ์†์ ์œผ๋กœ ์˜ค๋ฉด ํŒŒ์ผ๋ช… ๋ณ€๊ฒฝ ์ผ๋ฐ˜์ ์œผ๋กœ $FILE_NAME ์†์„ฑ์€ MFT ๋ ˆ์ฝ”๋“œ์—์„œ 0x98 ์œ„์น˜์— ์žˆ์Œ

๋‘ ์ž‘์—…์˜ Target LCN์ด ๋™์ผํ•ด์•ผ ํ•จ

โ€ข ํŒŒ์ผ๋ช… ๋ณ€๊ฒฝ ์ด๋ฒคํŠธ ์ˆœ์„œ

1. 0x0F/0X0E(Delete Index Entry Allocation/Add Index Entry Allocation)

2. 0x06/0x05(Delete Attribute/Create Attribute)

3. 0x05/0x06(Create Attribute/Delete Attribute)

4. 0x0E/0x0F(Add Index Entry Allocation/Delete Index Entry Allocation)

5. 0x1B/0x01(Forget Transaction/Compensation Log Record)

ํŒŒ์ผ๋ช… ๋ณ€๊ฒฝ ์ด๋ฒคํŠธ

Page 42: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 42 / 51

$LogFile ์ด๋ฒคํŠธ ๋ถ„์„

Delete Attribute(0x06) Create Attribute(0x05)

โ€ข ๊ฐ ์ž‘์—…์˜ Redo Data ์—์„œ ๋ณ€๊ฒฝ ์ „ ํŒŒ์ผ๋ช…๊ณผ ๋ณ€๊ฒฝ ํ›„ ํŒŒ์ผ๋ช…์„ ์•Œ ์ˆ˜ ์žˆ์Œ

ํŒŒ์ผ๋ช… ๋ณ€๊ฒฝ ์ด๋ฒคํŠธ

Current LSN

Previous LSN

Redo Op

Undo Op

Target LCN

Redo Data

Record Offset

Attr Offset

Page 43: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 43 / 51

$LogFile Parser ๊ตฌํ˜„

- ๋„๊ตฌ ์„ค๊ณ„

- ๊ธฐ๋Šฅ ์„ค๋ช…

Page 44: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 44 / 51

$LogFile Parser ๊ตฌํ˜„

1. $MFT, $LogFile ์„ ์ž…๋ ฅ์œผ๋กœ ๋ฐ›์Œ

2. $LogFile ์ž‘์—… ๋ ˆ์ฝ”๋“œ์˜ LSN๊ณผ $MFT์˜ ๋ ˆ์ฝ”๋“œ์˜ LSN ๋น„๊ตํ•˜์—ฌ ํŒŒ์ผ๋ช…/์ „์ฒด ๊ฒฝ๋กœ/์‹œ๊ฐ„์ •๋ณด ํš๋“

3. $LogFile ์ž‘์—… ๋ ˆ์ฝ”๋“œ ํŒŒ์‹ฑ ์ค‘์— ์–ป๋Š” Parent File Reference Address ๊ฐ’์€ $MFT ๋ชจ๋“ˆ์— ๋„˜๊ฒจ ์ „์ฒด ๊ฒฝ๋กœ ํš๋“

4. $LogFile ์ž‘์—… ๋ ˆ์ฝ”๋“œ๋ฅผ ํŒŒ์‹ฑํ•˜์—ฌ ํŒŒ์ผ ์ƒ์„ฑ, ์‚ญ์ œ, ๋ฐ์ดํ„ฐ ์ž‘์„ฑ, ํŒŒ์ผ๋ช… ๋ณ€๊ฒฝ ์ด๋ฒคํŠธ ํš๋“

๋„๊ตฌ ์„ค๊ณ„

Page 45: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 45 / 51

$LogFile Parser ๊ตฌํ˜„ - ๋„๊ตฌ ์„ค๊ณ„

- ๊ธฐ๋Šฅ ์„ค๋ช…

Page 46: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 46 / 51

$LogFile Parser ๊ตฌํ˜„

ํŒŒ์ผ ์ƒ์„ฑ ์ด๋ฒคํŠธ ์ถœ๋ ฅ

โ€ข Redo ์ž‘์—… ๋ฐ์ดํ„ฐ์—์„œ ํŒŒ์ผ๋ช…, ์ƒ์„ฑ ์‹œ๊ฐ„ ํš๋“

โ€ข Redo ์ž‘์—… ๋ฐ์ดํ„ฐ์˜ Parent File Reference Address ๊ฐ’์€ $MFT ๋ชจ๋“ˆ์— ๋„˜๊ฒจ ์ „์ฒด ๊ฒฝ๋กœ ํš๋“

ํŒŒ์ผ ์‚ญ์ œ ์ด๋ฒคํŠธ ์ถœ๋ ฅ

โ€ข Undo ์ž‘์—… ๋ฐ์ดํ„ฐ์—์„œ ํŒŒ์ผ๋ช… ํš๋“

โ€ข Undo ์ž‘์—… ๋ฐ์ดํ„ฐ์˜ Parent File Reference Address ๊ฐ’์€ $MFT ๋ชจ๋“ˆ์— ๋„˜๊ฒจ ์ „์ฒด ๊ฒฝ๋กœ ํš๋“

โ€ข ์‚ญ์ œ ์‹œ๊ฐ„์€ ์•Œ ์ˆ˜ ์—†์Œ ( ์•ž ๋’ค ์ด๋ฒคํŠธ ๋ฐœ์ƒ ์‹œ๊ฐ„์„ ํ†ตํ•ด ๋Œ€๋žต์ ์ธ ์‚ญ์ œ ์‹œ๊ฐ„ ์œ ์ถ”)

๊ธฐ๋Šฅ ์„ค๋ช…

Page 47: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 47 / 51

$LogFile Parser ๊ตฌํ˜„

ํŒŒ์ผ ๋ฐ์ดํ„ฐ ์ž‘์„ฑ ์ด๋ฒคํŠธ ์ถœ๋ ฅ

โ€ข Resident ํŒŒ์ผ ๋ฐ์ดํ„ฐ ์ž‘์„ฑ ์ด๋ฒคํŠธ

์ž‘์„ฑ๋œ ํŒŒ์ผ ๋ฐ์ดํ„ฐ์˜ $LogFile ํŒŒ์ผ ๋‚ด Offset ๊ฐ’์„ ์ถœ๋ ฅ(์ถ”ํ›„์— ํ—ฅ์‚ฌ๊ฐ’ ์ถœ๋ ฅ์œผ๋กœ ์—…๋ฐ์ดํŠธ)

์ผ๋ฐ˜์ ์œผ๋กœ ์ƒ์„ฑ ์ด๋ฒคํŠธ ๋ฐ”๋กœ ๋’ค์— ๋ฐ์ดํ„ฐ ์ž‘์„ฑ ์ด๋ฒคํŠธ๊ฐ€ ๋”ฐ๋ผ์„œ ๋‚˜์˜ด

โ€ข Non-Resident ํŒŒ์ผ ๋ฐ์ดํ„ฐ ์ž‘์„ฑ ์ด๋ฒคํŠธ

ํŒŒ์ผ ๋ฐ์ดํ„ฐ ์ž‘์„ฑ๋œ LCN ๊ฐ’ ์ถœ๋ ฅ

์ผ๋ฐ˜์ ์œผ๋กœ๋Š” ์ƒ์„ฑ ์ด๋ฒคํŠธ ๋ฐ”๋กœ ๋’ค์— ๋ฐ์ดํ„ฐ ์ž‘์„ฑ ์ด๋ฒคํŠธ๊ฐ€ ๋”ฐ๋ผ์„œ ๋‚˜์˜ด

๊ธฐ๋Šฅ ์„ค๋ช…

Page 48: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 48 / 51

$LogFile Parser ๊ตฌํ˜„

ํŒŒ์ผ๋ช… ๋ณ€๊ฒฝ ์ด๋ฒคํŠธ ์ถœ๋ ฅ

โ€ข ๋ณ€๊ฒฝ ์ „ ํŒŒ์ผ๋ช…๊ณผ ๋ณ€๊ฒฝ ํ›„ ํŒŒ์ผ๋ช… ์ถœ๋ ฅ

โ€ข MFT Modified Time์„ ํ†ตํ•ด ํŒŒ์ผ๋ช… ๋ณ€๊ฒฝ ์‹œ๊ฐ„ ํš๋“

ํ‚ค์›Œ๋“œ ๊ฒ€์ƒ‰

โ€ข ์›ํ•˜๋Š” ํ‚ค์›Œ๋“œ๊ฐ€ ํฌํ•จ๋œ ์ด๋ฒคํŠธ๋งŒ ํ•„ํ„ฐ๋ง

โ€ข ํ•„ํ„ฐ๋ง ์˜ˆ

โ€œ.exeโ€ or โ€œ.dllโ€ or โ€œ.sysโ€ PE ํŒŒ์ผ ํ–‰์œ„ ๋ถ„์„์— ํ™œ์šฉ

โ€œ.lnkโ€ ๋ฌธ์„œ ์—ด๋žŒ ํ”์  ์ถ”์ ์— ํ™œ์šฉ

โ€œ.pfโ€ PE ํŒŒ์ผ ์‹คํ–‰ ํ”์  ์ถ”์ ์— ํ™œ์šฉ

๊ธฐ๋Šฅ ์„ค๋ช…

Page 49: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 49 / 51

๊ฒฐ๋ก 

Page 50: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 50 / 51

๊ฒฐ๋ก 

NTFS ์ž‘์—… ํžˆ์Šคํ† ๋ฆฌ ์ถ”์ 

โ€ข ํŒŒ์ผ/๋””๋ ‰ํ† ๋ฆฌ ์ƒ์„ฑ, ์‚ญ์ œ, ์ด๋ฆ„ ๋ณ€๊ฒฝ, MFT ์ˆ˜์ • ์ž‘์—…์˜ ํƒ€์ž„๋ผ์ธ ์ž‘์„ฑ

MFT ์—์„œ ๋ฐœ๊ฒฌํ•˜์ง€ ๋ชปํ•œ ์‚ญ์ œ๋œ ํŒŒ์ผ ํ”์  ์ถ”์ 

โ€ข ์‚ญ์ œ๋œ ํŒŒ์ผ์˜ MFT๊ฐ€ ๋ฎ์—ฌ์กŒ์„ ๊ฒฝ์šฐ๋ผ๋„ $LogFile ์—๋Š” ์‚ญ์ œ ๊ธฐ๋ก์ด ๋‚จ์•„ ์žˆ์Œ

โ€ข Resident ํŒŒ์ผ์˜ ๊ฒฝ์šฐ, ํŒŒ์ผ ๋ฐ์ดํ„ฐ ํ™•์ธ ๊ฐ€๋Šฅ

โ€ข Non-Resident ํŒŒ์ผ์˜ ๊ฒฝ์šฐ, ํŒŒ์ผ ๋ฐ์ดํ„ฐ๊ฐ€ ์ž‘์„ฑ๋œ ํด๋Ÿฌ์Šคํ„ฐ ์œ„์น˜ ํ™•์ธ ๊ฐ€๋Šฅ

๋ฌธ์„œ ํŒŒ์ผ ์—ด๋žŒ ํ”์ , PE ํŒŒ์ผ ์‹คํ–‰ ๋ฐ ์ƒ์„ฑ/์‚ญ์ œ ํ”์  ์ถ”์ ์— ํ™œ์šฉ

$LogFile์˜ ํฌ๋ Œ์‹์  ์˜๋ฏธ

Page 51: (120513) #fitalk   a dig into the $log file

forensicinsight.org Page 51 / 51

์งˆ๋ฌธ ๋ฐ ๋‹ต๋ณ€