Background Reference

• Background Reference
  • NTFS Internal Data Structures
    • B+ Trees for Directory Indexing
    • Metadata Change Log ($LogFile)
    • ext3/ext4 Journaling
  • 802.11 Endianness
  • TCP Handshake in a Timeline Context
  • Legal Constraints on Forensic Investigations
    • Fourth Amendment and Warrant Requirements
    • Statutory Privacy Laws (HIPAA, FERPA, ECPA)

This page collects background concepts that appear in the forensics course but are not covered in depth in the main lecture notes. None of these topics are required to complete the labs, but understanding them will deepen your intuition for why the tools work the way they do and why the legal constraints exist.

For networking fundamentals (TCP flags, BPF syntax, hex offsets, encoding) see netsec/background.md.

NTFS Internal Data Structures

B+ Trees for Directory Indexing

NTFS stores directory contents in a B+ tree indexed by filename. A B+ tree is a balanced search tree where all data is in the leaf nodes and interior nodes hold only keys. This gives O(log n) lookup, insertion, and deletion for any filename in a large directory.

Forensic relevance: when a file is deleted, its B+ tree node is removed from the directory index but the MFT record (and the underlying data clusters) may persist. Recovery tools traverse the MFT directly rather than the directory index — this is why fls with the * prefix can find deleted files that are no longer visible to the OS directory listing.

Metadata Change Log ($LogFile)

NTFS maintains $LogFile, a write-ahead transaction log for metadata operations. Before committing a metadata change (e.g., updating the MFT record for a file rename), NTFS writes the intended change to $LogFile. On unclean shutdown, NTFS replays $LogFile to restore metadata consistency.

Forensic relevance: mounting an NTFS image without suppressing journal replay (-o noload or norecovery in ntfs-3g) can cause the OS to replay logged metadata transactions, potentially altering timestamps in the image. Always mount forensic images read-only with journal replay disabled. See Imaging for correct mount flags.

ext3/ext4 Journaling

Linux ext3 and ext4 use a similar journaling mechanism. The journal (/dev/sdX inode 8) logs metadata (and optionally data) changes before committing them to their final location. If the journal is active (the filesystem was not cleanly unmounted), mounting will replay the journal.

Forensic relevance: use -o ro,noload when mounting ext3/4 forensic images to prevent journal replay. See Imaging.

802.11 Endianness

802.11 frames use little-endian byte ordering for most multi-byte fields (e.g., sequence numbers, duration/ID), but the destination/source MAC addresses are transmitted most-significant-byte first (big-endian). This mixed ordering is a consequence of the 802.11 specification inheriting different conventions from Ethernet and 802.11-specific fields.

Practical impact: forensic tools (Wireshark, airodump-ng) handle endianness transparently. If you write raw BPF filters that operate on byte offsets within 802.11 frames, you must account for the correct byte order. For most investigative work, use Wireshark display filters rather than raw BPF to avoid byte-order errors.

See also: netsec/background.md — BPF Filters for BPF syntax.

TCP Handshake in a Timeline Context

The three-way TCP handshake establishes a connection:

1. SYN — client sends segment with the SYN flag set; picks an initial sequence number
2. SYN-ACK — server acknowledges the SYN and sends its own SYN; picks its own ISN
3. ACK — client acknowledges the server’s SYN; connection is now established

Timeline forensics application: when correlating network logs with file system timelines, TCP connection timestamps appear in multiple sources:

A file downloaded at 14:32:10 by the web server log may appear at 14:32:11 in the NTFS MFT due to download completion latency. These small differences are normal and expected.

For more on TCP: see networking.md.

Legal Constraints on Forensic Investigations

These topics are covered in dedicated course pages. The brief notes here provide just enough context to understand why the constraints appear in lab instructions.

Fourth Amendment and Warrant Requirements

The Fourth Amendment prohibits unreasonable searches and seizures by the government. Digital evidence collected without a warrant (or an applicable exception) may be suppressed — rendered inadmissible. For a forensic investigator, this means:

• Verify that a warrant, consent, or an exception (plain view, exigent circumstances) covers the evidence you are examining before examining it.
• Document the legal authority under which you acted in your chain-of-custody records and report.

Full coverage: Fourth Amendment in an E-World, Structure of the Legal System.

Statutory Privacy Laws (HIPAA, FERPA, ECPA)

Beyond the Constitution, several federal statutes restrict access to specific categories of data:

If your investigation touches medical records, student data, or email content at a provider, you need specific legal authority (warrant, subpoena, or consent) before accessing it.

Full coverage: Privacy Law, E-Discovery and Evidence.