Hello,
I post "message 1" and you asked me to raised the question to manufacturer.
I do so and I received "message 2" from Guidance Software, but I was not
satisfaite with Darell's response. So I send "Message 3" a month ago ...
without answer.
So I re-submit "message 1" to securityfocus ...
Best regards
Paul
===================message3===========================================================
Hi Darrell,
The problem is not exactly that one. We have this HFS drive and made a copy
image with encase. During the analysis process, some files appear in the "Lost
Files" directory. Until now, nothing unusual. For some other reasons, we had to
generate a running copy of the HFS drive using the image. We run the Macintosh
and the files that were put in the "Lost Files" directory appear as regular
files, not deleted ones. It's important for us to know exactly why in the copy
image the files are "deleted" and why in the running system the files are not.
In one case we can conclude that an evidence exists to support the fact that
the user erased the compromised files to conceal his behavior, and in the other
case we can conclude that the suspect wasn't trying to conceal his actions, and
for us (and the court) it has a direct impact on the next steps of the
procedure.
Thanks,
Paul
============================message 2==================================
Paul, Here's the rundown on how "Lost Files" operate. I'm certainly positive
it works the same with HFS.
In the Master File Table (MFT) in NTFS, all files and folders are marked as a
folder or file and as belonging to a parent. The files within a folder are
that folder's children. If a user first deletes the files, then deletes the
folder, and then creates a new folder, the originally deleted files can be
lost. The new folder's entry in the MFT overwrites the deleted folder's entry.
The original parent folder and its entry in the MFT are overwritten and gone.
Its children, however, have not been overwritten and their entries are still
in the MFT. As with NTFS, with UFS and EXT2/3 partitions, EnCase parses the
MFT and finds those files that are still listed, but have not parent
directory. All of these files are recovered and placed in the gray Lost Files
folder.
=========================message
1=====================================================
Hello,
During the reconstruction process of a HFS file system with Encase (v 3.22g)
some directories are wrongly put in a "Lost Files" directory whereas they are
regular files.
Is it a known problem with this version of Encase? Did I miss anything special
to do when dealing with HFS file systems? Most important: can you provide an
advise or a solution?
Best regards
--
LERTI - Laboratoire d'Expertise et de
Recherche de Traces Informatiques
http://www.lerti.fr +33.4 76 90 65 97
