Membership

Fourth Extended File System (EXT4) Forensics (W36)

Explore forensic analysis of the EXT4 file system. Build on imaging and hashing knowledge to understand Linux file-system evidence. This is an earlier course edition; examples reflect the tools and versions used when it was recorded.

Instructor · Divya Lakshmanan

Modules:
6
Lessons:
175

eForensics learning

Practical skills.
Verified progress.

What you'll learn

  • Explain EXT4 layout and internal structures.
  • Examine file-system data at byte level.
  • Apply forensic methods to EXT4 evidence.

Prerequisites

Basics of Digital Forensics: Imaging, hashing, file naming conventions. Equipment and software: A computer with Ubuntu 16.04 LTS installed in it (It is possible to use a VM, but in this course we will be using Ubuntu 16.04 LTS installed directly on the host machine – it would be a better option for the learning process.) Good internet connection to download tools on the fly

Module 2

Module 1

  1. 1. (W36M00) Module 1 Downloads

  2. 2. (W36M01) Introduction to File Systems

  3. 3. (W36M02) Versions of the Extended File System

  4. 4. (W36M03) Layout of the Fourth Extended File System

  5. 5. (W36M04) Interpreting the data structures

  6. 6. (W36M05) Introduction to the tools used in this course

  7. 7. (W36M06) How to step into the forensic process on ext4?

  8. 8. (W36M07) Processing the Superblock

  9. 9. (W36M08) Processing the Group Descriptor Table

  10. 10. (W36M09) Processing the Block Bitmap

  11. 11. (W36M10) Processing the Inode Bitmap

  12. 12. (W36M11) Processing the Inode Table - Inode 2

  13. 13. (W36M00) Module 1 Downloads

  14. 14. (W36M12) The case of the curious learner - Module 1 Lab

  15. 15. Practice: (W36Q01Q01)

  16. 16. Practice: (W36Q01Q03)

  17. 17. Practice: (W36Q01Q04)

  18. 18. Practice: (W36Q01Q05)

  19. 19. Practice: (W36Q01Q06)

  20. 20. Practice: (W36Q01Q07)

  21. 21. Practice: (W36Q01Q08)

  22. 22. Practice: (W36Q01Q09)

  23. 23. Practice: (W36Q01Q10)

  24. 24. Practice: (W36Q01Q11)

  25. 25. Practice: (W36Q01Q12)

  26. 26. Practice: (W36Q01Q15)

  27. 27. Practice: (W36Q01Q16)

  28. 28. Practice: (W36Q01Q17)

  29. 29. Practice: (W36Q01Q18)

  30. 30. Practice: (W36Q01Q19)

  31. 31. Practice: (W36Q01Q20)

  32. 32. Practice: (W36Q01Q21)

  33. 33. Practice: (W36Q01Q22)

  34. 34. Practice: (W36Q01Q23)

  35. 35. Practice: (W36Q01Q24)

  36. 36. Practice: (W36Q01Q26)

  37. 37. Practice: (W36Q01Q27)

  38. 38. Practice: (W36Q01Q28)

  39. 39. Practice: (W36Q01Q29)

  40. 40. Practice: (W36Q01Q30)

  41. 41. Practice: (W36Q01Q31)

  42. 42. Practice: (W36Q01Q32)

  43. 43. Practice: (W36Q01Q33)

  44. 44. Practice: (W36Q01Q34)

  45. 45. Practice: (W36Q01Q35)

  46. 46. Practice: (W36Q01Q36)

  47. 47. Practice: (W36Q01Q38)

  48. 48. Practice: (W36Q01Q39)

  49. 49. Practice: (W36Q01Q40)

  50. 50. Practice: (W36Q01Q41)

  51. 51. Practice: (W36Q01Q42)

Assessments

Quiz Required

(W36Q01) THE CASE OF THE CURIOUS LEARNER - solution submission

Module 3

Module 2

  1. 1. (W36M00) Module 2 Downloads

  2. 2. (W36M13) Locate small file

  3. 3. (W36M14) Locate directory

  4. 4. (W36M15) How to extract a deleted small file

  5. 5. (W36M16) How to extract a deleted directory

  6. 6. (W36M17) Locate large file - understanding extents

  7. 7. (W36M18) How to extract a deleted large file

  8. 8. (W36M19) A primer to file carving

  9. 9. (W36M00) Module 2 Downloads

  10. 10. (W36M00) The case of deletion - Module 2 Lab

  11. 11. Practice: (W36Q02Q01)

  12. 12. Practice: (W36Q02Q02)

  13. 13. Practice: (W36Q02Q04)

  14. 14. Practice: (W36Q02Q05)

  15. 15. Practice: (W36Q02Q06)

  16. 16. Practice: (W36Q02Q07)

  17. 17. Practice: (W36Q02Q08)

  18. 18. Practice: (W36Q02Q09)

  19. 19. Practice: (W36Q02Q11)

  20. 20. Practice: (W36Q02Q12)

  21. 21. Practice: (W36Q02Q13)

  22. 22. Practice: (W36Q02Q14)

  23. 23. Practice: (W36Q02Q15)

  24. 24. Practice: (W36Q02Q16)

  25. 25. Practice: (W36Q02Q18)

  26. 26. Practice: (W36Q02Q19)

  27. 27. Practice: (W36Q02Q20)

  28. 28. Practice: (W36Q02Q21)

  29. 29. Practice: (W36Q02Q22)

  30. 30. Practice: (W36Q02Q23)

  31. 31. Practice: (W36Q02Q24)

  32. 32. Practice: (W36Q02Q25)

  33. 33. Practice: (W36Q02Q26)

  34. 34. Practice: (W36Q02Q27)

  35. 35. Practice: (W36Q02Q28)

  36. 36. Practice: (W36Q02Q29)

  37. 37. Practice: (W36Q02Q30)

  38. 38. Practice: (W36Q02Q31)

  39. 39. Practice: (W36Q02Q32)

  40. 40. Practice: (W36Q02Q33)

  41. 41. Practice: (W36Q02Q34)

  42. 42. Practice: (W36Q02Q35)

  43. 43. Practice: (W36Q02Q36)

  44. 44. Practice: (W36Q02Q37)

  45. 45. Practice: (W36Q02Q38)

  46. 46. Practice: (W36Q02Q39)

  47. 47. Practice: (W36Q02Q40)

Assessments

Quiz Required

(W36Q02) THE CASE OF DELETION - solution submission

Module 4

Module 3

  1. 1. (W36M00) Module 3 downloads

  2. 2. (W36M20) Soft Links

  3. 3. (W36M21) Hard Links

  4. 4. (W36M22) Extended Attributes, Large Extended Attributes and Access Control Lists

  5. 5. (W36M23) A Quick Perusal

  6. 6. (W36M24) Reading - The Sleuth Kit

  7. 7. (W36M00) Module 3 downloads

  8. 8. (W36M00) The case of links and attributes - Module 3 lab

  9. 9. Practice: (W36Q03Q01)

  10. 10. Practice: (W36Q03Q02)

  11. 11. Practice: (W36Q03Q03)

  12. 12. Practice: (W36Q03Q04)

  13. 13. Practice: (W36Q03Q05)

  14. 14. Practice: (W36Q03Q06)

  15. 15. Practice: (W36Q03Q07)

  16. 16. Practice: (W36Q03Q08)

  17. 17. Practice: (W36Q03Q09)

  18. 18. Practice: (W36Q03Q11)

  19. 19. Practice: (W36Q03Q12)

  20. 20. Practice: (W36Q03Q13)

  21. 21. Practice: (W36Q03Q15)

  22. 22. Practice: (W36Q03Q16)

  23. 23. Practice: (W36Q03Q17)

  24. 24. Practice: (W36Q03Q20)

  25. 25. Practice: (W36Q03Q21)

  26. 26. Practice: (W36Q03Q23)

  27. 27. Practice: (W36Q03Q24)

  28. 28. Practice: (W36Q03Q25)

  29. 29. Practice: (W36Q03Q26)

  30. 30. Practice: (W36Q03Q27)

  31. 31. Practice: (W36Q03Q28)

  32. 32. Practice: (W36Q03Q29)

  33. 33. Practice: (W36Q03Q30)

  34. 34. Practice: (W36Q03Q31)

  35. 35. Practice: (W36Q03Q32)

  36. 36. Practice: (W36Q03Q33)

  37. 37. Practice: (W36Q03Q34)

  38. 38. Practice: (W36Q03Q35)

  39. 39. Practice: (W36Q03Q36)

  40. 40. Practice: (W36Q03Q37)

  41. 41. Practice: (W36Q03Q38)

  42. 42. Practice: (W36Q03Q39)

  43. 43. Practice: (W36Q03Q40)

Assessments

Quiz Required

(W36Q03) THE CASE OF LINKS AND ATTRIBUTES - Solution submission

Module 5

Module 4

  1. 1. (W36M00) Module 4 Downloads

  2. 2. (W36M25) Hello Journal

  3. 3. (W36M26) Please read me!

  4. 4. (W36M27) Journal, I can understand you now

  5. 5. (W36M28) Are you encrypted?

  6. 6. (W36M29) File System Encryption

  7. 7. (W36M30) I am EXT4, I am going to glorify myself!

  8. 8. (W36M31) A word about extents in a large file

  9. 9. (W36M32) How to approach File System Forensics?

  10. 10. (W36M00) Module 4 Downloads

  11. 11. (W36M00) The case of the file journal - Module 4 lab

  12. 12. Practice: (W36Q04Q01)

  13. 13. Practice: (W36Q04Q02)

  14. 14. Practice: (W36Q04Q04)

  15. 15. Practice: (W36Q04Q06)

  16. 16. Practice: (W36Q04Q08)

  17. 17. Practice: (W36Q04Q09)

  18. 18. Practice: (W36Q04Q10)

  19. 19. Practice: (W36Q04Q11)

  20. 20. Practice: (W36Q04Q12)

  21. 21. Practice: (W36Q04Q13)

  22. 22. Practice: (W36Q04Q14)

  23. 23. Practice: (W36Q04Q22)

  24. 24. Practice: (W36Q04Q23)

  25. 25. Practice: (W36Q04Q24)

  26. 26. Practice: (W36Q04Q25)

  27. 27. Practice: (W36Q04Q28)

  28. 28. Practice: (W36Q04Q29)

  29. 29. Practice: (W36Q04Q30)

Assessments

Quiz Required

(W36Q04) THE CASE OF THE FILE SYSTEM JOURNAL - solution submission

Course access

Unlock Fourth Extended File System (EXT4) Forensics (W36).

Enter your email. We’ll send a sign-in code here without taking you away from this course.