• English
  • Deutsch
  • Log In
    Password Login
    Research Outputs
    Fundings & Projects
    Researchers
    Institutes
    Statistics
Repository logo
Fraunhofer-Gesellschaft
  1. Home
  2. Fraunhofer-Gesellschaft
  3. Scopus
  4. Mount SMB.pcap: Reconstructing file systems and file operations from network traffic
 
  • Details
  • Full
Options
2024
Journal Article
Title

Mount SMB.pcap: Reconstructing file systems and file operations from network traffic

Abstract
File system and network forensics are fundamental in forensic investigations, but are often treated as distinct disciplines. This work seeks to unify these fields by introducing a novel framework capable of mounting network captures, enabling investigators to seamlessly browse data using conventional tools. Although our implementation supports various protocols such as HTTP, TLS, and FTP, this work will particularly focus on the complexities of the Server Message Block (SMB) protocol, which is fundamental for shared file system access, especially within local networks. For this, we present a detailed methodology to extract essential file system data from SMB network traffic, aiming to reconstruct the share's file system as accurately as the original. Our approach goes beyond traditional tools like Wireshark, which typically only extract individual files from SMB transmissions. Instead, we reconstruct the entire file system hierarchy, retrieve all associated metadata, and handle multiple versions of files captured within the same network traffic. In addition, we also investigate how file operations impact SMB commands and show how these can be used to accurately recreate user activities on an SMB share based solely on network traffic. Although both methodologies and implementations can be applied independently, their combination provides investigators with a comprehensive view of the reconstructed file system along with the corresponding user activities extracted from network traffic.
Author(s)
Hilgert, Jan-Niclas  
Fraunhofer-Institut für Kommunikation, Informationsverarbeitung und Ergonomie FKIE  
Mahr, Axel
Fraunhofer-Institut für Kommunikation, Informationsverarbeitung und Ergonomie FKIE  
Lambertz, Martin  
Fraunhofer-Institut für Kommunikation, Informationsverarbeitung und Ergonomie FKIE  
Journal
Forensic Science International : FSI. Digital Investigation  
Conference
Annual Digital Forensics Research Conference 2024  
DOI
10.1016/j.fsidi.2024.301807
Language
English
Fraunhofer-Institut für Kommunikation, Informationsverarbeitung und Ergonomie FKIE  
Keyword(s)
  • Digital forensics

  • File extraction

  • File systems

  • Network forensics

  • Server message block

  • Cookie settings
  • Imprint
  • Privacy policy
  • Api
  • Contact
© 2024