Rune Nordvik

• Stoykova, Radina; Nordvik, Rune; Ahmed, Munnazzar; Franke, Katrin; Axelsson, Stefan & Toolan, Fergus (2022). Legal and technical questions of file system reverse engineering. Computer Law and Security Review. ISSN 0267-3649. 46. doi: 10.1016/j.clsr.2022.105725. Full text in Research Archive Show summary

  Reverse engineering of file systems is indispensable for tool testing, accurate evidence acquisition, and correct interpretation of data structures by law enforcement in criminal investigations. This position paper examines emerging techno-legal challenges from the practice of reverse engineering for law enforcement purposes. We demonstrate that this new context creates uncertainties about the legality of tools and methods used for evidence acquisition and the compliance of law enforcement with obligations to protect intellectual property and confidential information. Further identified are gaps between legal provisions and practice related to disclosure and peer-review of sensitive digital forensic methodology, trade secrets in investigations, and governmental vulnerability disclosure. It is demonstrated that reverse engineering of file systems is insufficiently addressed by legislators, which results in a lack of file system interpretation and validation information for law enforcement and their dependence on tools. Outlined are recommendations for further developments of digital forensic regulation.

• Nordvik, Rune & Axelsson, Stefan (2022). It is about time–Do exFAT implementations handle timestamps correctly? Forensic Science International: Digital Investigation. ISSN 2666-2825. 42-43. doi: 10.1016/j.fsidi.2022.301476. Full text in Research Archive Show summary

  Digital forensic investigations require that file metadata are interpreted correctly. In this paper we focus on the timestamps of the exFAT file system. How these timestamps are written may depend on the implementation of the file system. We have performed experiments using Windows, MacOS and Linux to examine whether the respective file system drivers for exFAT use timestamps in the same manner, and whether they take the directory entry UTCOffset fields into account. We have also studied whether the forensic tools: Autopsy, X-Ways Forensics, EnCase Examiner, and FTK Imager interpret the timestamps consistently. The results show that there are substantial inconsistencies both in the file system implementations and in how forensic tools handle these inconsistencies. For the unwary forensic examiner, there is a clear risk of interpreting timestamps incorrectly by a substantial margin. We conclude that timestamp interpretation during criminal investigations should not be based on the assumption that the file system specifications are followed flawlessly by the file system driver developers or necessarily interpreted and displayed correctly by the digital forensic tools.

• Humphries, Georgina Louise; Nordvik, Rune; Manifavas, Harry; Cobley, Phil & Sorell, Matthew (2021). Law enforcement educational challenges for mobile forensics. Forensic Science International: Digital Investigation. ISSN 2666-2825. 38. doi: 10.1016/j.fsidi.2021.301129. Full text in Research Archive
• Nordvik, Rune; Stoykova, Radina Raychova; Franke, Katrin; Axelsson, Stefan & Toolan, Fergus (2021). Reliability validation for file system interpretation. Forensic Science International: Digital Investigation. ISSN 2666-2825. 37, p. 1–14. doi: 10.1016/j.fsidi.2021.301174. Full text in Research Archive Show summary

  This paper examines current best practices for Digital Forensic (DF) tool and method validation in the context of file system interpretation for digital evidence. In order to meet the legal and scientific requirements in criminal procedures file system (FS) reverse engineering (RE) is a necessity. Currently, there is no standard procedure for reliability testing of FS RE. Ideal validation requirements exist, but they are on high-level and practical implementation is missing. In this paper we propose a formal reliability validation procedure for file system reverse engineering, documenting the forensic process, including the tools used, ensuring reliability and reproducibility of the method and the results. The procedure is based on legal and scientific criteria and tested against file system reverse engineering methods. It is applicable to all types of reverse engineering methods in digital forensics.

• Porter, Kyle; Nordvik, Rune; Toolan, Fergus & Axelsson, Stefan (2021). Timestamp prefix carving for filesystem metadata extraction. Forensic Science International: Digital Investigation. ISSN 2666-2825. 38, p. 1–13. doi: 10.1016/j.fsidi.2021.301266. Full text in Research Archive Show summary

  While file carving is a popular and effective method for extracting file content from unallocated space in a forensic image, it can be time consuming to carve for the wide variety of possible file signatures. Furthermore, file carving does not connect the discovered file to its filesystem metadata. These limitations of file carving are the advantages of Generic Metadata Time Carving, in which filesystem metadata is searched for by first finding repeated co-located timestamps using a potential timestamp carving algorithm. The potential metadata is verified by a filesystem specific parser, and the pointer within the metadata to the file data may allow for full file recovery. Currently, a limitation of the Generic Metadata Time Carving method is that it will only find metadata records that have multiple equivalent timestamps, thus missing metadata records and files with differing, but very similar, timestamps. Therefore, in order to improve the recall of the Generic Metadata Time Carving methodology, we have designed and implemented a prefix matching potential timestamp carving algorithm. We apply our experiments to realistic NTFS and Ext4 forensic images, in which we compare the precision and recall results for differing prefix lengths. Our results indicate that using prefix-based potential timestamp carving can yield significantly greater recall for extracting filesystem metadata records, with little to no reduction in precision as compared to the original exact potential timestamp carving method.

• Nordvik, Rune; Porter, Kyle; Toolan, Fergus; Axelsson, Stefan & Franke, Katrin (2020). Generic Metadata Time Carving. Forensic Science International: Digital Investigation. ISSN 2666-2825. 33. doi: 10.1016/j.fsidi.2020.301005. Full text in Research Archive Show summary

  Recovery of files can be a challenging task in file system investigations, and most carving techniques are based on file signatures or semantics within the file. However, these carving techniques often only recover the files, but not the metadata associated with the file. In this paper, we propose a novel, generic approach for carving metadata by searching for equal and co-located timestamps. The rationale is that there are some common metadata for files and directories within each file system. Our generic time carver provides potential timestamp locations for repeated timestamps in each metadata structure, identifying potential metadata for files. A semantic parser then filters the results with respect to the specific file system type. In our experiments, extraction of MFT entries in NTFS and inodes in Ext4 had near perfect precision for metadata entries with multiple equivalent timestamps, and for such metadata structures we obtained perfect recall for NTFS. For known file systems, we use the information found within identified metadata to recover files, and by recovering files and their associated metadata we increase the evidential value of recovered files.

• Nordvik, Rune; Georges, Henry; Toolan, Fergus & Axelsson, Stefan (2019). Reverse engineering of ReFS. Digital Investigation. The International Journal of Digital Forensics and Incident Response. ISSN 1742-2876. 30(September), p. 127–147. doi: 10.1016/j.diin.2019.07.004. Full text in Research Archive Show summary

  File system forensics is an important part of Digital Forensics. Investigators of storage media have traditionally focused on the most commonly used file systems such as NTFS, FAT, ExFAT, Ext2-4, HFS+, APFS, etc. NTFS is the current file system used by Windows for the system volume, but this may change in the future. In this paper we will show the structure of the Resilient File System (ReFS), which has been available since Windows Server 2012 and Windows 8. The main purpose of ReFS is to be used on storage spaces in server systems, but it can also be used in Windows 8 or newer. Although ReFS is not the current standard file system in Windows, while users have the option to create ReFS file systems, digital forensic investigators need to investigate the file systems identified on a seized media. Further, we will focus on remnants of non-allocated metadata structures or attributes. This may allow metadata carving, which means searching for specific attributes that are not allocated. Attributes found can then be used for file recovery. ReFS uses superblocks and checkpoints in addition to a VBR, which is different from other Windows file systems. If the partition is reformatted with another file system, the backup superblocks can be used for partition recovery. Further, it is possible to search for checkpoints in order to recover both metadata and content. Another concept not seen for Windows file systems, is the sharing of blocks. When a file is copied, both the original and the new file will share the same content blocks. If the user changes the copy, new data runs will be created for the modified content, but unchanged blocks remain shared. This may impact file carving, because part of the blocks previously used by a deleted file might still be in use by another file. The large default cluster size, 64 KiB, in ReFS v1.2 is an advantage when carving for deleted files, since most deleted files are less than 64 KiB and therefore only use a single cluster. For ReFS v3.2 this advantage has decreased because the standard cluster size is 4 KiB. Preliminary support for ReFS v1.2 has been available in EnCase 7 and 8, but the implementation has not been documented or peer-reviewed. The same is true for Paragon Software, which recently added ReFS support to their forensic product. Our work documents how ReFS v1.2 and ReFS v3.2 are structured at an abstraction level that allows digital forensic investigation of this new file system. At the time of writing this paper, Paragon Software is the only digital forensic tool that supports ReFS v3.x. It is the most recent version of the ReFS file system that is most relevant for digital forensics, as Windows automatically updates the file system to the latest version on mount. This is why we have included information about ReFS v3.2. However, it is possible to change a registry value to avoid updating. The latest ReFS version observed is 3.4, but the information presented about 3.2 is still valid. In any criminal case, the investigator needs to investigate the file system version found.

• Nordvik, Rune; Toolan, Fergus & Axelsson, Stefan (2019). Using the object ID index as an investigative approach for NTFS file systems. Digital Investigation. The International Journal of Digital Forensics and Incident Response. ISSN 1742-2876. 28, p. 30–39. doi: 10.1016/j.diin.2019.01.013. Full text in Research Archive Show summary

  When investigating an incident it is important to document user activity, and to document which storage device was connected to which computer. We present a new approach to documenting user activity in computer systems using the NTFS file system by using the $ObjId Index to document user activity, and to correlate this index with the corresponding records in the MFT table. This may be the only possible approach when investigating external NTFS storage devices, and is hence a valuable addition to the storage forensics toolbox.

• Nordvik, Rune; Liao, Yi-Ching & Langweg, Hanno (2014). AccountabilityFS: A File System Monitor for Forensic Readiness, Proceedings of 2014 IEEE Joint Intelligence and Security Informatics Conference. IEEE (Institute of Electrical and Electronics Engineers). ISSN 9781479963638. p. 308–311. doi: 10.1109/JISIC.2014.61. Full text in Research Archive Show summary

  We present a file system monitor, AccountabilityFS, which prepares an organization for forensic analysis and incident investigation in advance by ensuring file system operation traces readily available. We demonstrate the feasibility of AccountabilityFS in terms of performance and storage overheads, and prove its reliability against malware attacks.

View all works in NVA

• Nordvik, Rune & Axelsson, Lars Stefan (2023). Corrigendum to “It is about time–do exFAT implementations handle timestamps correctly?” [Forensic Science International: Digital Investigation 42–43 (2022) 301476] (Forensic Science International: Digital Investigation (2022) 42–43, (S2666281722001573), (10.1016/j.fsidi.2022.301476)). Forensic Science International: Digital Investigation. ISSN 2666-2825. doi: 10.1016/j.fsidi.2023.301542. Full text in Research Archive
• Nordvik, Rune; Axelsson, Stefan; Toolan, Fergus & Dyrkolbotn, Geir Olav (2024). Interpretation of File System Metadata in a Criminal Investigation Context. Norges teknisk-naturvitenskapelige universitet. ISSN 9788232678235. Full text in Research Archive Show summary

  The reliable reconstruction of digital events is imperative for solving criminal cases. Computers, servers, mobile and IoT devices, vehicles, and EV charging infrastructure all use either local or remote storage (cloud). The storage needs to use a file system in order to store and retrieve files. Currently, digital forensic tools implement support for the most popular file systems, either fully or partially. In order to determine what has taken place, investigators today are dependent on tools that automate much of the investigation. Unfortunately, these tools use techniques that are not necessarily published, tested or peer-reviewed, which increases the uncertainty of their results. Furthermore, investigators normally use well known artifacts from the Operating System (OS) when trying to determine what occurred, however, file system interpretation is often automated by the tools and trusted as reliable and complete by the investigators. In many cases the OS is not available, for instance, when an external storage device is seized. This means the investigator only has the file system and the file content available for investigation. We found metadata structures that may connect an external device to the computers used to create files on the device, which order these files have been created, and when the computers were booted. These findings will help investigators to identify which computers are relevant for the investigation, create timelines, and detect timestamp manipulation, but also identify which files users have created, opened, or saved. It is not unusual that external devices are damaged or reformatted with new file systems. In this context it is important to be able to recover files from the damaged file system. We were able to invent a novel and generic method to carve and identify metadata for files using equality or approximate equality to identify timestamps that are co-located, a pattern typical for file metadata structures in most file systems. Our prototype tool outperforms the other tools we tested in recovery from damaged file systems. Investigators often use timestamps to create timelines or to limit their investigation to a particular time frame. We found that both tools and different file system drivers are implemented differently, not necessarily following the file system specifications. Even normal usage of an external USB disk on multiple operating systems may change timestamps to invalid settings, and it is imperative that investigators are able to identify such usage. This thesis will focus on interpreting the file system metadata to identify and understand the accurate meaning of structures that the digital forensic tools currently do not support or only partly support, identifying new knowledge that will increase the quality of digital investigations.

View all works in NVA