Re: Veritas

Ivan,

Ivan Buetler wrote:
> 
> I have to analyze a disk previously installed within a Solaris 9 box. It looks 
> like the disk contains Veritas depending partitions.

Veritas is not supported by any forensic tool I know, most probably because
their disk layout is not publicly documented (hence no open-source tools) and
licensing this proprietary information is either expensive or not available
at all (hence no commercial tools).

Linux can mount Veritas partitions read-only (beware, the Veritas file system
has evolved over five different disk layouts, so yours may or may not be
supported,
I personally have never tested the Linux driver, any comments are most welcome,
my initial guess would be that UnixWare vxfs partitions may be mountable ...)
In any case, such a mount would not get you MAC timestamps of deleted files...

> I would like to do a MACTIME analysis using tct or sleuthkit. Any ideas how to 
> proceed, because the veritas cluster partition stops further investigation. 

Given the situation described above, not much can be done, unless you happened
to stumble across a .h file on your system describing the layout of your vxfs
inode. If you had that information, you could run a perl script against a dd
image of your partition to carve for timestamps (taking advantage of the fact
that you know the rough range of values to expect in the timestamps, e.g.
epoch values between something like 1/1/2000 and today). You would still have
to link those timestamps to a inode number, a lot there depends on whether
your file system explicitly records inode numbers inside the data structure
or whether the number is implicitly derived from the physical location of
the inode on disk. Recent file systems tend to do the former, so you may
be lucky there. You could also try and carve for inode timestamp values
without haveing access to the relevant include file, but then you would have
to make some very bold assumptions about the way the timestamps are encoded
in your Veritas file system. Just looking at ffs.h in tct or sleuthkit
tells you there is more than one way to do this (*BSD vs Solaris style).

In terms of recovering files, file systems usually make every effort to
keep file contiguous, so a hex editor can get you a long way in terms
of recovery, if you roughly know what's inside the files you deleted...

Regards,

Knut