Linux Forensics

Dr. Phil Polstra @ppolstra

PhD, CISSP, CEH http://philpolstra.com
Certifications:
http://www.securitytube-training.com

Pentester Academy: http://www.PentesterAcademy.com

©SecurityTube.net
Inode Extensions & Details

©SecurityTube.net
 15
Reg/Slink-13/Socket-14

14
Directory/Block Bit 13
13
Char Device/Block Bit 14
12

FIFO
11

Set UID
10

Set GID
9

Sticky Bit
8

Owner Read
7

Owner Write
6

©SecurityTube.net

Owner Exec
File Mode
5

Group Read
4

Group Write
3

Group Exec
2

Others Read
1

Others Write
0

Others Exec
 15
File tail not merged

14
Data written through journal
13
AFS Magic
12

Directory has hash indexes

11

Encrypted Inode
10

Don't compress file

9

Compressed clusters
8

Dirty compressed file

7

No access time update

6

©SecurityTube.net

No dump
5

Append only
4

File is immutable
3

Synchronous Writes
2
Inode Flags (low word)

File is compressed
1

Preserve for undelete

0

Secure Deletion
 31
Reserved for Ext4 Library

30
Unused
29
Unused
28

Inode has inline data

27

Snapshot shrink completed

26

Snapshot is being deleted

25

Unused
24

Inode is snapshot
23

Unused
22

©SecurityTube.net

Blocks past EOF (depric)

21

Inode stores large ext attrib

20

Unused
19

Inode uses extents

18
Inode Flags (high word)

Huge file
17

Top of directory
16

Directory entry sync writes

 Inode Timestamps
●
Change/Modify/Access/Delete timestamps in
lower 128 bytes
●
Timestamps stored in Signed 32-bit seconds
since epoch
●
Extra timestamp values in upper bytes
– Lowest 2 bits used to extend timestamp to 34-bit value
– Upper 30 bits provide nanosecond accuracy of timestamps

©SecurityTube.net
Examining Inodes

©SecurityTube.net