Skip to content

v 2.0

Latest
Latest

Choose a tag to compare

View all tags
@TazWake TazWake released this 14 Sep 19:20
· 1 commit to main since this release
2.0
9e27b22
This commit was signed with the committer’s verified signature.
TazWake Taz Wake
GPG key ID: E4D463AD6EC8FF3E
Verified
Learn about vigilant mode.

EXT Journal Analyzer v2.0. Release Notes

Overview

The EXT Journal Analyzer is a comprehensive forensic tool for analyzing EXT3/4 filesystem journals from disk images. This advanced tool extracts and analyzes journal transaction data from raw disk images and Expert Witness Format (EWF) files, converting binary journal structures into human-readable CSV format with intelligent content analysis for forensic investigations.

Key Features

Core Capabilities

  • Multi-format Support: Processes both raw disk images (DD format) and Expert Witness Format (.E01/.Ex01) files
  • EXT3/4 Compatibility: Supports both EXT3 (JBD) and EXT4 (JBD2) journal formats with automatic detection
  • Automatic Journal Detection: Locates journals stored as regular files (inode 8) or external devices
  • Advanced Transaction Parsing: Extracts descriptor blocks, data blocks, commit records, and revocation entries
  • Flexible Filtering: Support for transaction sequence range filtering and partition offset handling

Forensic Analysis

  • Intelligent Content Analysis: Automatically extracts human-readable strings from data blocks
  • File Content Classification: Identifies text files, configuration files, log entries, and other content
    types
  • Comprehensive Forensic Summary: Detailed analysis reports with string extraction statistics
  • Journal Mode Detection: Identifies JOURNAL, ORDERED, or WRITEBACK journaling modes
  • Path Reconstruction: Advanced inode-to-path resolution with directory tree building
  • String Pattern Matching: Detects URLs, file paths, configuration entries, and forensically relevant
    content

Output and Analysis

The tool generates comprehensive CSV files with forensic analysis data:

  • Event Offset: Relative event ordering (T+0, T+1, etc.) - not actual timestamps
  • Transaction Sequence: Journal sequence numbers for ordering events
  • Block Type: Type of journal block (descriptor/data/commit/revocation/superblock)
  • Filesystem Block Number: Filesystem block being modified
  • Operation Type: Inferred operation (file_data_update, text_file_update, etc.)
  • Affected Inode: Inode number when determinable
  • File Path: Extracted strings (STRINGS: content) when available
  • File Type: Classification (text_file, config_file, log_file, etc.)
  • File Size: From inode analysis
  • Link Count: Hard link count
  • Filename: From directory entries
  • Parent Directory Inode: Parent directory inode number
  • Change Type: Type of change (new_entry, data_change, etc.)
  • Full Path: Complete reconstructed file path

Forensic Applications

Primary Use Cases

  • Timeline Analysis: Reconstruct filesystem activity chronology with relative event ordering
  • Data Recovery: Extract human-readable content from journal data blocks
  • Content Analysis: Recover deleted file fragments, configuration data, and log entries
  • Incident Response: Track unauthorised file system changes and data modifications
  • Evidence Analysis: Support legal and compliance investigations with comprehensive reports
  • System Auditing: Monitor filesystem integrity and analyse change patterns

System Requirements

  • Supported Platforms: Ubuntu/RHEL platforms (x86_64)
  • Dependencies: libewf library for EWF format support
  • Installation: Standalone binary with no additional runtime dependencies

Usage Examples

# Process an EWF evidence file
./ext-journal-analyzer -i evidence.E01 -o journal_analysis.csv -v

# Process a raw disk image
./ext-journal-analyzer -i disk.dd -o output.csv --verbose

# Process a specific partition
./ext-journal-analyzer -i evidence.E01 -o output.csv --partition-offset 227328

# Filter transaction range
./ext-journal-analyzer -i evidence.E01 -o filtered.csv --start-seq 100 --end-seq 200

Important Limitations

  • Read-only Analysis: Tool performs non-invasive analysis of evidence images
  • Relative Timing Only: No absolute timestamps available - uses relative sequence ordering
  • Content Dependency: String extraction depends on journal mode (JOURNAL vs ORDERED)
  • Path Resolution: File path reconstruction depends on available directory metadata in journal
  • Encrypted Data: Cannot extract readable strings from encrypted or heavily compressed content
Assets 3
Loading