TZWorks LLC
System Analysis and Programming
www.tzworks.com
(Version 0.13)
TZWorks LLC software and related documentation ("Software") is governed by separate licenses issued from TZWorks LLC. The User Agreement, Disclaimer, and/or Software may change from time to time. By continuing to use the Software after those changes become effective, you agree to be bound by all such changes. Permission to use the Software is granted provided that (1) use of such Software is in accordance with the license issued to you and (2) the Software is not resold, transferred or distributed to any other person or entity. Refer to your specific EULA issued to for your specific the terms and conditions. There are 3 types of licenses available: (i) for educational purposes, (ii) for demonstration and testing purposes and (iii) business and/or commercial purposes. Contact TZWorks LLC (info@tzworks.com) for more information regarding licensing and/or to obtain a license. To redistribute the Software, prior approval in writing is required from TZWorks LLC. The terms in your specific EULA do not give the user any rights in intellectual property or technology, but only a limited right to use the Software in accordance with the license issued to you. TZWorks LLC retains all rights to ownership of this Software.
The Software is subject to U.S. export control laws, including the U.S. Export Administration Act and its associated regulations. The Export Control Classification Number (ECCN) for the Software is 5D002, subparagraph C.1. The user shall not, directly or indirectly, export, re-export or release the Software to, or make the Software accessible from, any jurisdiction or country to which export, re-export or release is prohibited by law, rule or regulation. The user shall comply with all applicable U.S. federal laws, regulations and rules, and complete all required undertakings (including obtaining any necessary export license or other governmental approval), prior to exporting, re-exporting, releasing, or otherwise making the Software available outside the U.S.
The user agrees that this Software made available by TZWorks LLC is experimental in nature and use of the Software is at user's sole risk. The Software could include technical inaccuracies or errors. Changes are periodically added to the information herein, and TZWorks LLC may make improvements and/or changes to Software and related documentation at any time. TZWorks LLC makes no representations about the accuracy or usability of the Software for any purpose.
ALL SOFTWARE ARE PROVIDED "AS IS" AND "WHERE IS" WITHOUT WARRANTY OF ANY KIND INCLUDING ALL IMPLIED WARRANTIES AND CONDITIONS OF MERCHANTABILITY, FITNESS FOR ANY PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT SHALL TZWORKS LLC BE LIABLE FOR ANY KIND OF DAMAGE RESULTING FROM ANY CAUSE OR REASON, ARISING OUT OF IT IN CONNECTION WITH THE USE OR PERFORMANCE OF INFORMATION AVAILABLE FROM THIS SOFTWARE, INCLUDING BUT NOT LIMITED TO ANY DAMAGES FROM ANY INACCURACIES, ERRORS, OR VIRUSES, FROM OR DURING THE USE OF THE SOFTWARE.
The Software are the original works of TZWorks LLC. However, to be in compliance with the Digital Millennium Copyright Act of 1998 ("DMCA") we agree to investigate and disable any material for infringement of copyright. Contact TZWorks LLC at email address: info@tzworks.com, regarding any DMCA concerns.
This tool was created to be light weight and assist in the analysis of FAT32 and exFAT filesystems while looking at only the raw disk sectors or volume clusters. The tool's algorithm is operating system agnostic when parsing the files or folders, and since it has no installation requirements, it is useful in various live collection and triaging situations. Furthermore, the tool's architecture was designed to be extensible so as to act as an architecture framework for future FAT filesystem work.
When considering the FAT32 is typically the default filesystem for USB flash drives, coming up with a portable tool that can analyze the contents of the internal structures with or without mounting the device, as well as, not leaving a tool footprint on the system is useful in many forensic use-cases. Now that exFAT is commonly available and used for large storage devices, extending the fata architecture to handle that as well was a logic next step.
The fata tool parses all internal FAT32 and exFAT filesystem data, and attempts to condense the reporting results in such a way as to make the output clear, while restricting the output to one line per record (file or folder). Header information is provided, if requested to assist in the identification of the file content without physically opening the file. Various hashing algorithms options are provided and can be annotated to the output, if requested. By default, both disk and volume offsets are provided where it makes sense, like for cluster runs, volume offset and directory entry locations. In this way, the information allows one to validate any of the results produced by this tool.
In addition to the filesystem internals, fata, allows one to copy all the files that were enumerated; and/or all the system structures, such as the Volume Boot Record, FAT table(s), Bitmap table, unallocated clusters, etc. When found, deleted folders and files are shown and can be extracted, if requested.
Below is the menu with the various options available. Details of each option can be found here.
Usage: Disk/Volume file enumeration -disk <#> [-offset #] [options] = process disk number -partition <letter> [options] = process mounted volume -image <name> [-offset #] [options] = process disk/vol image Additional file options -copyfiles = extract file content -copy_sysdata = extract file system data -copy_unalloc_data = extract unalloc data -header_info = examine file header -md5 = compute MD5 hash -sha1 = compute SHA1 hash -sha256 = compute SHA256 hash Format options -csv = output is CSV format -csvl2t = log2timeline output -dateformat mm/dd/yyyy = "yyyy-mm-dd" is the default -timeformat hh:mm:ss = "hh:mm:ss.xxx" is the default -no_whitespace = remove whitespace -csv_separator "|" = change delimiter -base10 = use base10 numbers Output option -out <results> = where to put results Disk/Image scan utilities -scandrives = attached drives details -scanimage <dd file> = 'dd' image details
The basic options are the various file enumeration cases. One can enumerate the files via: (a) mounted partition letter, (b) disk number and volume offset relative to disk start, or (c) by a single file that contains a 'dd' image of another disk or volume. fata will return any file or folder it finds including deleted ones. Included with each file/folder is a complete set of metadata that was used by the filesystem internally to manage the file or folder. Each entry will be output on a separate line. The formats available are: CSV or Log2Timeline formats. Both are delimited data formats so they can be easily ported into an existing archival system.
If one has a disk that is to be analyzed that is attached to the computer system where the fata tool is run, then an option is available to analyze it as a raw disk. As a preparatory step, one first needs to find the physical disk number that is to be analyzed (see the User's guide section on Scanning options). Once that is done, one can invoke the -disk <number> command and the fata tool will enumerate the entire disk locating all the volumes, and if the filesystem is either FAT or exFAT, will report all the files on the respective volumes. If the disk has multiple volumes, one can target the specific volume by using the -offset <value> sub-option. This value inputted should be the volume offset relative to the start of the disk (eg. physical sector 0). For this last option, refer to the user's guide section of 'Scanning options' to help locate the volume offsets.
Using the disk# parsing approach one do the following:
> fata64 -disk 2 -out results.csv
The last option, can be used for Windows, Linux or macOS and will target a disk or volume in the form of a file (eg. image). This option assumes the image is not compressed or encrypted; the image file needs to be a 'dd' copy of a file. To process this image, one can use the -image <file> option. If the image file has multiple volumes, one can target the specific volume by using the -offset <value> sub-option. This value inputted should be the volume offset relative to the start of the image file. For this last option, refer to the section of 'Scanning options' to help locate the volume offsets.
Using the -image <dd file> parsing approach one do the following:
> fata64 -image test.dd -out results.csv
This option is only for Windows use. Given any Windows FAT32 or exFAT mounted volume, one can use the -partition <letter> to parse the folders/files in the volume.
The fata tool has a few options to extract more than just file path and its metadata. One can also copy the file contents, system filesystem structures that mange the filesystem and unallocated clusters. One can select these options independently or in any combination thereof.
If the option -copyfiles is invoked, the tool will try to copy any file will an extracted cluster run. This includes both valid and deleted files. They are archived in the export/[VBR_<offset>] subfolder. See section on Where files are copied to for an example on using this option.
If the option -copy_sysdata is invoked, the tool will try to copy system structures and store the data in separate files. System structures include: Volume Boot Record (VBR), File Access Tables, Reserved sectors, Bitmap table (for exFAT), etc. All the files created are binary data in that they reflect the actual bytes from the data structures, with the exception of the offset_map.txt file. See user's guide section on Where system data is copied to for an example on using this option.
If the option -copy_unalloc_data is invoked, the tool will try to copy all the unallocated clusters and store the data into one file. The reason why this is not included in the -copy_sysdata option, is the resulting file that is generated can be very large depending on the size of the disk (or disk/volume image) and the number of unallocated clusters it has. With multi-terabyte drives as typical and exFAT able to make use of all the available space, one needs to plan accordingly when using -copy_unalloc_data option, since depending on how much space is unallocated, this option would create a very large file. For this reason, this functionality is split off from the -copy_sysdata option. See the user's guide section on Mapping of unallocated space system for an example on using this option
Option | Description |
---|---|
-image | Process the volumes present in the image file. The syntax is: -image <filename> [-offset <volume offset value>] . If no offset is provided, then all the volumes in the image are processed. If the offset is provided, only that volume is processed. This option can be used for Windows, Linux or macOS. |
-disk |
Process the volumes present in the physical disk number. The syntax is:
|
-partition | Process the volume that equates to the partition letter passed in. The syntax is: -partition <letter>. Note. This is only a Windows option. |
-csv | Outputs the data fields delimited by whatever delimter is specified. Since filenames can have commas, to ensure the fields are uniquely separated, any commas in the filenames get converted to spaces. |
-csvl2t | Outputs the data fields in accordance with the log2timeline format. |
-no_whitespace | Used in conjunction with -csv option to remove any whitespace between the field value and the CSV separator. |
-csv_separator | Used in conjunction with the -csv option to change the CSV separator from the default comma to something else. Syntax is -csv_separator "|" to change the CSV separator to the pipe character. To use the tab as a separator, one can use the -csv_separator "tab" OR -csv_separator "\t" options. |
-dateformat | Output the date using the specified format. Default behavior is -dateformat "yyyy-mm-dd". Using this option allows one to adjust the format to mm/dd/yy, dd/mm/yy, etc. The restriction with this option is the forward slash (/) or dash (-) symbol needs to separate month, day and year and the month is in digit (1-12) form versus abbreviated name form. |
-timeformat | Output the time using the specified format. Default behavior is -timeformat "hh:mm:ss.xxx" One can adjust the format to microseconds, via "hh:mm:ss.xxxxxx" or nanoseconds, via "hh:mm:ss.xxxxxxxxx", or no fractional seconds, via "hh:mm:ss". The restrictions with this option is that a colon (:) symbol needs to separate hours, minutes and seconds, a period (.) symbol needs to separate the seconds and fractional seconds, and the repeating symbol 'x' is used to represent number of fractional seconds. (Note: the fractional seconds applies only to those time formats that have the appropriate precision available. The Windows internal filetime has, for example, 100 nsec unit precision available. The DOS time format and the UNIX 'time_t' format, however, have no fractional seconds). Some of the times represented by this tool may use a time format without fractional seconds and therefore will not show a greater precision beyond seconds when using this option. |
-out | Specifies the file to send the output to. Syntax is: -out <output file>. |
-quiet | Show no progress during the parsing operation |
-base10 | Output values in base10. Default is base16. |
-utf8_bom | All output is in Unicode UTF-8 format. If desired, one can prefix an UTF-8 byte order mark to the CSV output using this option. |
-copyfiles | Option that tells fata to extract file contents, if possible. The data for these folders/files are put in the export subfolder that has the parent of the base output folder. |
-copy_sysdata | Option that tells fata to extract certain filesystem data structures. This includes the: VBR (volume boot record), FAT (file allocation table), Bitmap (if available for that filesystem), etc. The output for these extra files are put in a [export/[VBR_xxxx]_sysdata] subfolder where the root is the base output folder. Finally, for all the sections extracted, a summary file (offset_map.txt) is created in the same subdirectory. |
-copy_unalloc_data |
Option that tells fata to extract all the unallocated data into one file.
Since this resulting file will have fragmented clusters of unallocated
data consequently ordered, one can reconstruct the which clusters are
associated by volume offset, but referring to the offset_map.txt file
where each cluster is mapped. The output for the unallocated clusters is a file [unalloc_clusters.bin], in the subfolder [export/[VBR_xxxx]_sysdata] where the root is the base output folder. In addition to the sections extracted, the summary of all the extracted files is presented in the offset_map.txt file. |
-header_info | Option to examine the first sector of the file and if a signature is found, it is displayed in the output. |
-md5 | Computes the MD hash of the valid file contents (does not include the slack in the file). |
-sha1 | Computes the SHA1 hash of the valid file contents (does not include the slack in the file). |
-sha256 | Computes the SHA256 hash of the valid file contents (does not include the slack in the file). |
-scandrives | Details about the volumes of the attached drives on the system where fata is run. |
-scanimage | Details about the volumes in an image file. The syntax is: -scanimage <dd file>. The 'dd' file needs to be uncompressed image of the disk or volume and cannot be encrypted. |
This tool has authentication built into the binary. The primary authentication mechanism is the digital X509 code signing certificate embedded into the binary (Windows and macOS).
The other mechanism is the runtime authentication, which applies to all the versions of the tools (Windows, Linux and macOS). The runtime authentication ensures that the tool has a valid license. The license needs to be in the same directory of the tool for it to authenticate. Furthermore, any modification to the license, either to its name or contents, will invalidate the license.
The tools from TZWorks will output header information about the tool's version and whether it is running in limited, demo or full mode. This is directly related to what version of a license the tool authenticates with. The limited and demo keywords indicates some functionality of the tool is not available, and the full keyword indicates all the functionality is available. The lacking functionality in the limited or demo versions may mean one or all of the following: (a) certain options may not be available, (b) certain data may not be outputted in the parsed results, and (c) the license has a finite lifetime before expiring.