Lab 12: ️ Sleuth Kit Forensics - Menganalisis Disk Image dengan The Sleuth Kit

cd ~ && mkdir forensics-lab12 && cd forensics-lab12

# 1. Buat disk image simulasi dengan partisi
python3 << 'PYEOF'
import os, struct

# Buat image mentah 10MB dengan 2 partisi
img = bytearray(10 * 1024 * 1024)  # 10MB filled with zeros

# MBR (Master Boot Record) di sector 0
# Partition 1: FAT32-like, start=2048, size=4MB
# Partition 2: ext4-like, start=10240, size=5MB

# MBR signature
img[510:512] = b'\x55\xAA'

# Partition table entry 1 (offset 446)
# Status, CHS start, type, CHS end, LBA start, size (sectors)
img[446:450] = struct.pack('<I', 0x80)  # bootable
img[450] = 0x0B  # FAT32 type
img[454:458] = struct.pack('<I', 2048)  # start LBA
img[458:462] = struct.pack('<I', 8192)  # size (4MB)

# Partition table entry 2 (offset 462)
img[462] = 0x00  # non-bootable  
img[466] = 0x83  # Linux (ext4) type
img[470:474] = struct.pack('<I', 10240)  # start LBA
img[474:478] = struct.pack('<I', 10240)  # size (5MB)

with open('disk-forensik.dd', 'wb') as f:
    f.write(img)

print("✅ disk-forensik.dd created (10MB, 2 partitions)")
PYEOF

# 2. Analisis partition table
echo "=== mmls - Partition Table ==="
mmls disk-forensik.dd

# 3. File system stats
echo ""
echo "=== fsstat - File System Info ==="
fsstat -o $((2048*512)) disk-forensik.dd 2>/dev/null || echo "(image empty, but structure visible)"

# 4. List files in partition (simulated output)
echo ""
echo "=== fls - File Listing ==="
echo "r/r 12-128-3:  README.txt"
echo "r/r 13-128-2:  data.csv"  
echo "d/d 11-128-2:  documents"
echo "r/r * 14-128-3: deleted_report.pdf  ← (deleted!)"

# 5. Inode detail
echo ""
echo "=== istat - Inode Info ==="
cat << 'INODE'
Inode: 12
Type: regular file
Mode: rw-r--r--
UID/GID: 1000/1000
Size: 24576 bytes
Timestamps:
  Modified:   2026-06-15 14:30:00
  Accessed:   2026-06-16 09:15:00
  Changed:    2026-06-15 14:30:00
Direct Blocks: 128, 129, 130, 131
INODE