homepage
Open menu Go one level top
  • Train and Certify
    • Get Started in Cyber
    • Courses & Certifications
    • Training Roadmap
    • Search For Training
    • Online Training
    • OnDemand
    • Live Training
    • Summits
    • Cyber Ranges
    • College Degrees & Certificates
    • NICE Framework
    • DoDD 8140
    • Specials
  • Manage Your Team
    • Overview
    • Security Awareness Training
    • Voucher Program
    • Private Training
    • Workforce Development
    • Skill Assessments
    • Hiring Opportunities
  • Resources
    • Overview
    • Reading Room
    • Webcasts
    • Newsletters
    • Blog
    • Tip of The Day
    • Posters
    • Top 25 Programming Errors
    • The Critical Security Controls
    • Security Policy Project
    • Critical Vulnerability Recaps
    • Affiliate Directory
  • Focus Areas
    • Blue Team Operations
    • Cloud Security
    • Digital Forensics & Incident Response
    • Industrial Control Systems
    • Leadership
    • Offensive Operations
  • Get Involved
    • Overview
    • SANS Community
    • CyberTalent
    • Work Study
    • Instructor Development
    • Sponsorship Opportunities
    • COINS
  • About
    • About SANS
    • Why SANS?
    • Instructors
    • Cybersecurity Innovation Awards
    • Contact
    • Frequently Asked Questions
    • Customer Reviews
    • Press Room
  • Log In
  • Join
  • Contact Us
  • SANS Sites
    • GIAC Security Certifications
    • Internet Storm Center
    • SANS Technology Institute
    • Security Awareness Training
  • Search
  1. Home >
  2. Blog >
  3. Strings, Strings, Are Wonderful Things
Keven Murphy

Strings, Strings, Are Wonderful Things

May 5, 2009

One of the basics of doing forensics involves gathering the ASCII and Unicode strings in the file system and searching for keywords. Using Linux we can gather the strings for both ASCII and Unicode using the strings command.

To Gather the ASCII Strings

# strings -td /dev/sdb > sdb.ascii

Note: The "-td" in the above line tells strings to print the offset in decimal for the line.

To Gather the Unicode Strings

# strings -td -el /dev/sdb > sdb.unicode

Note: The "-el" option will have the strings command handle 16-bit little endian encoding. Strings can handle other types of encoding such as 32-bit big/little endian. See the man page on strings and the -e option.

Below is a sample output from the command:

192301896     <member name="F:Microsoft.DirectX.DirectPlay.Address.FlowControlNone">
192301972       <summary>This field is deprecated. Deprecated components of Microsoft DirectX 9.0 for Managed Code are considered obsolete. While these components are still supported in this release of DirectX 9.0 for Managed Code, they may be removed in the future. When writing new applications, you should avoid using these deprecated components. When modifying existing applications, you are strongly encouraged to remove any dependency on these components.Deprecated.</summary>
192302446     </member>
192302461     <member name="F:Microsoft.DirectX.DirectPlay.Address.FlowControlRtsDtr">
192302539       <summary>This field is deprecated. Deprecated components of Microsoft DirectX 9.0 for Managed Code are considered obsolete. While these components are still supported in this release of DirectX 9.0 for Managed Code, they may be removed in the future. When writing new applications, you should avoid using these deprecated components. When modifying existing applications, you are strongly encouraged to remove any dependency on these components.Deprecated.</summary>
192303013     </member>
192303028     <member name="F:Microsoft.DirectX.DirectPlay.Address.FlowControlXonXoff"SZDD

Now that we have the output we can use a variety of tools to search for keywords in the output files. Some examples are:

grep -i keyword sdb.ascii > sdb.ascii.keyword

    "-i" tells grep to ignore case. This is a pretty useful option as we do not always know how the keyword will be laid out in reference to case.

    grep -i -f keywords.txt sdb.ascii > sdb.ascii.keywords

      The "-f" option in the above command allows you to create a keyword file with all of keywords you are looking for.

      egrep -color -i -f keywords.txt sdb.ascii

        Egrep is equivalent to doing a "grep -E". It allows for extend regular expressions, which in itself is another topic. The key thing right now to pick up on the above command is the -color option. This will print any matching keyword in a different color. On my Fedora systems, the keyword is in red. One thing to note about this is, if you pipe egrep output to another command or redirect the output to a file, you will lose the color on matching text. It is a nice command to get a keyword to pop out for doing a quick search.

        • Perl programs like https://blogs.sans.org/computer-forensics/2008/12/03/perl-and-forensics/ and http://www.citadelsystems.net/index.php/forensics-tools/36-word-search/53-wordsearchpl

        Offset Math

        Sometimes you want to take a closer look at the clusters/blocks for where your keyword was found. Using the offsets listed in the strings output you can quickly figure out where the keyword is in the drive or file. For example:

        192303028     <member name="F:Microsoft.DirectX.DirectPlay.Address.FlowControlXonXoff"SZDD

        The offset here is 192303028 for our DirectX keyword. For this NTFS file system, the cluster size is 4096 bytes. To figure out which cluster DirectX is in do:

        Offset / cluster size or

        192303028 / 4096 = 46948.981445312 or cluster 46948

        If you wanted the sector where the keyword is located:

        192303028 / 512 = 375591.8515625 or sector 375591

        Figuring Out Cluster Size

        You can use the "ntfsinfo" command to figure out the cluster size for NTFS file system. To do this use:

        # ntfsinfo --mft   /dev/sda1
        Volume Information
        Name of device: /dev/sda1
        Device state: 11
        Volume Name:
        Volume State: 1
        Volume Version: 3.1
        <strong>Sector Size: 512
        Cluster Size: 4096</strong>
        Volume Size in Clusters: 13181323

        In the above output in bold, the command has listed the sector size and the cluster size.

        For Linux the block size can be found with the "tune2fs" command. I have piped it out to grep as the output can be lengthy.

        # tune2fs -l /dev/sda2 | grep Block
        Block count:              12799788
        <strong>Block size:               4096</strong>
        Blocks per group:         32768

        Again the block size is in bold.

        There you have it, the basics of using the strings command and how to calculate the cluster/block/sector for where the keyword can be found.

        Keven Murphy, GCFA Gold #24, is the Senior Forensics Specialist for a Fortune 100 defense contractor.

        Share:
        TwitterLinkedInFacebook
        Copy url Url was copied to clipboard
        Subscribe to SANS Newsletters
        Join the SANS Community to receive the latest curated cybersecurity news, vulnerabilities, and mitigations, training opportunities, plus our webcast schedule.
        United States
        Canada
        United Kingdom
        Spain
        Belgium
        Denmark
        Norway
        Netherlands
        Australia
        India
        Japan
        Singapore
        Afghanistan
        Aland Islands
        Albania
        Algeria
        American Samoa
        Andorra
        Angola
        Anguilla
        Antarctica
        Antigua and Barbuda
        Argentina
        Armenia
        Aruba
        Austria
        Azerbaijan
        Bahamas
        Bahrain
        Bangladesh
        Barbados
        Belarus
        Belize
        Benin
        Bermuda
        Bhutan
        Bolivia
        Bonaire, Sint Eustatius, and Saba
        Bosnia And Herzegovina
        Botswana
        Bouvet Island
        Brazil
        British Indian Ocean Territory
        Brunei Darussalam
        Bulgaria
        Burkina Faso
        Burundi
        Cambodia
        Cameroon
        Cape Verde
        Cayman Islands
        Central African Republic
        Chad
        Chile
        China
        Christmas Island
        Cocos (Keeling) Islands
        Colombia
        Comoros
        Cook Islands
        Costa Rica
        Croatia (Local Name: Hrvatska)
        Curacao
        Cyprus
        Czech Republic
        Democratic Republic of the Congo
        Djibouti
        Dominica
        Dominican Republic
        East Timor
        East Timor
        Ecuador
        Egypt
        El Salvador
        Equatorial Guinea
        Eritrea
        Estonia
        Ethiopia
        Falkland Islands (Malvinas)
        Faroe Islands
        Fiji
        Finland
        France
        French Guiana
        French Polynesia
        French Southern Territories
        Gabon
        Gambia
        Georgia
        Germany
        Ghana
        Gibraltar
        Greece
        Greenland
        Grenada
        Guadeloupe
        Guam
        Guatemala
        Guernsey
        Guinea
        Guinea-Bissau
        Guyana
        Haiti
        Heard And McDonald Islands
        Honduras
        Hong Kong
        Hungary
        Iceland
        Indonesia
        Iraq
        Ireland
        Isle of Man
        Israel
        Italy
        Jamaica
        Jersey
        Jordan
        Kazakhstan
        Kenya
        Kingdom of Saudi Arabia
        Kiribati
        Korea, Republic Of
        Kosovo
        Kuwait
        Kyrgyzstan
        Lao People's Democratic Republic
        Latvia
        Lebanon
        Lesotho
        Liberia
        Liechtenstein
        Lithuania
        Luxembourg
        Macau
        Macedonia
        Madagascar
        Malawi
        Malaysia
        Maldives
        Mali
        Malta
        Marshall Islands
        Martinique
        Mauritania
        Mauritius
        Mayotte
        Mexico
        Micronesia, Federated States Of
        Moldova, Republic Of
        Monaco
        Mongolia
        Montenegro
        Montserrat
        Morocco
        Mozambique
        Myanmar
        Namibia
        Nauru
        Nepal
        Netherlands Antilles
        New Caledonia
        New Zealand
        Nicaragua
        Niger
        Nigeria
        Niue
        Norfolk Island
        Northern Mariana Islands
        Oman
        Pakistan
        Palau
        Palestine
        Panama
        Papua New Guinea
        Paraguay
        Peru
        Philippines
        Pitcairn
        Poland
        Portugal
        Puerto Rico
        Qatar
        Reunion
        Romania
        Russian Federation
        Rwanda
        Saint Bartholemy
        Saint Kitts And Nevis
        Saint Lucia
        Saint Martin
        Saint Vincent And The Grenadines
        Samoa
        San Marino
        Sao Tome And Principe
        Senegal
        Serbia
        Seychelles
        Sierra Leone
        Sint Maarten
        Slovakia (Slovak Republic)
        Slovenia
        Solomon Islands
        South Africa
        South Georgia and the South Sandwich Islands
        South Sudan
        Sri Lanka
        St. Helena
        St. Pierre And Miquelon
        Suriname
        Svalbard And Jan Mayen Islands
        Swaziland
        Sweden
        Switzerland
        Taiwan
        Tajikistan
        Tanzania
        Thailand
        Togo
        Tokelau
        Tonga
        Trinidad And Tobago
        Tunisia
        Turkey
        Turkmenistan
        Turks And Caicos Islands
        Tuvalu
        Uganda
        Ukraine
        United Arab Emirates
        United States Minor Outlying Islands
        Uruguay
        Uzbekistan
        Vanuatu
        Vatican City
        Venezuela
        Vietnam
        Virgin Islands (British)
        Virgin Islands (U.S.)
        Wallis And Futuna Islands
        Western Sahara
        Yemen
        Yugoslavia
        Zambia
        Zimbabwe

        Tags:
        • Digital Forensics and Incident Response

        Related Content

        Blog
        SUMMIT_Free_SANS_2021_Summits_Teaser.jpg
        Digital Forensics and Incident Response, Cyber Defense Essentials, Industrial Control Systems Security, Purple Team, Blue Team Operations, Penetration Testing and Ethical Hacking, Cloud Security, Security Management, Legal, and Audit
        November 30, 2020
        Good News: SANS Virtual Summits Will Be FREE for the Community in 2021
        They’re virtual. They’re global. They’re free.
        Emily Blades
        read more
        Blog
        En.png
        Digital Forensics and Incident Response
        November 24, 2020
        SANS DFIR Presenta Nuevos Webcasts en Español
        SANS DFIR presenta sus nuevos episodios en Español! En este blog podrás ver todos los episodios con concluciones y con recursos para aprender DFIR
        SANS DFIR
        read more
        Blog
        shutterstock_1473864617.jpg
        Digital Forensics and Incident Response
        October 14, 2020
        Defense Spotlight: Finding Hidden Windows Services
        Attackers can make a Window services disappear from view. Fortunately these services can still be found, through unconventional discovery techniques.
        370x370_Joshua-Wright.jpg
        Joshua Wright
        read more
        • Register to Learn
        • Courses
        • Certifications
        • Degree Programs
        • Cyber Ranges
        • Job Tools
        • Security Policy Project
        • Posters
        • The Critical Security Controls
        • Focus Areas
        • Blue Team Operations
        • Cloud Security
        • Cybersecurity Leadership
        • Digital Forensics
        • Industrial Control Systems
        • Offensive Operations
        Subscribe to SANS Newsletters
        Join the SANS Community to receive the latest curated cybersecurity news, vulnerabilities, and mitigations, training opportunities, plus our webcast schedule.
        United States
        Canada
        United Kingdom
        Spain
        Belgium
        Denmark
        Norway
        Netherlands
        Australia
        India
        Japan
        Singapore
        Afghanistan
        Aland Islands
        Albania
        Algeria
        American Samoa
        Andorra
        Angola
        Anguilla
        Antarctica
        Antigua and Barbuda
        Argentina
        Armenia
        Aruba
        Austria
        Azerbaijan
        Bahamas
        Bahrain
        Bangladesh
        Barbados
        Belarus
        Belize
        Benin
        Bermuda
        Bhutan
        Bolivia
        Bonaire, Sint Eustatius, and Saba
        Bosnia And Herzegovina
        Botswana
        Bouvet Island
        Brazil
        British Indian Ocean Territory
        Brunei Darussalam
        Bulgaria
        Burkina Faso
        Burundi
        Cambodia
        Cameroon
        Cape Verde
        Cayman Islands
        Central African Republic
        Chad
        Chile
        China
        Christmas Island
        Cocos (Keeling) Islands
        Colombia
        Comoros
        Cook Islands
        Costa Rica
        Croatia (Local Name: Hrvatska)
        Curacao
        Cyprus
        Czech Republic
        Democratic Republic of the Congo
        Djibouti
        Dominica
        Dominican Republic
        East Timor
        East Timor
        Ecuador
        Egypt
        El Salvador
        Equatorial Guinea
        Eritrea
        Estonia
        Ethiopia
        Falkland Islands (Malvinas)
        Faroe Islands
        Fiji
        Finland
        France
        French Guiana
        French Polynesia
        French Southern Territories
        Gabon
        Gambia
        Georgia
        Germany
        Ghana
        Gibraltar
        Greece
        Greenland
        Grenada
        Guadeloupe
        Guam
        Guatemala
        Guernsey
        Guinea
        Guinea-Bissau
        Guyana
        Haiti
        Heard And McDonald Islands
        Honduras
        Hong Kong
        Hungary
        Iceland
        Indonesia
        Iraq
        Ireland
        Isle of Man
        Israel
        Italy
        Jamaica
        Jersey
        Jordan
        Kazakhstan
        Kenya
        Kingdom of Saudi Arabia
        Kiribati
        Korea, Republic Of
        Kosovo
        Kuwait
        Kyrgyzstan
        Lao People's Democratic Republic
        Latvia
        Lebanon
        Lesotho
        Liberia
        Liechtenstein
        Lithuania
        Luxembourg
        Macau
        Macedonia
        Madagascar
        Malawi
        Malaysia
        Maldives
        Mali
        Malta
        Marshall Islands
        Martinique
        Mauritania
        Mauritius
        Mayotte
        Mexico
        Micronesia, Federated States Of
        Moldova, Republic Of
        Monaco
        Mongolia
        Montenegro
        Montserrat
        Morocco
        Mozambique
        Myanmar
        Namibia
        Nauru
        Nepal
        Netherlands Antilles
        New Caledonia
        New Zealand
        Nicaragua
        Niger
        Nigeria
        Niue
        Norfolk Island
        Northern Mariana Islands
        Oman
        Pakistan
        Palau
        Palestine
        Panama
        Papua New Guinea
        Paraguay
        Peru
        Philippines
        Pitcairn
        Poland
        Portugal
        Puerto Rico
        Qatar
        Reunion
        Romania
        Russian Federation
        Rwanda
        Saint Bartholemy
        Saint Kitts And Nevis
        Saint Lucia
        Saint Martin
        Saint Vincent And The Grenadines
        Samoa
        San Marino
        Sao Tome And Principe
        Senegal
        Serbia
        Seychelles
        Sierra Leone
        Sint Maarten
        Slovakia (Slovak Republic)
        Slovenia
        Solomon Islands
        South Africa
        South Georgia and the South Sandwich Islands
        South Sudan
        Sri Lanka
        St. Helena
        St. Pierre And Miquelon
        Suriname
        Svalbard And Jan Mayen Islands
        Swaziland
        Sweden
        Switzerland
        Taiwan
        Tajikistan
        Tanzania
        Thailand
        Togo
        Tokelau
        Tonga
        Trinidad And Tobago
        Tunisia
        Turkey
        Turkmenistan
        Turks And Caicos Islands
        Tuvalu
        Uganda
        Ukraine
        United Arab Emirates
        United States Minor Outlying Islands
        Uruguay
        Uzbekistan
        Vanuatu
        Vatican City
        Venezuela
        Vietnam
        Virgin Islands (British)
        Virgin Islands (U.S.)
        Wallis And Futuna Islands
        Western Sahara
        Yemen
        Yugoslavia
        Zambia
        Zimbabwe
        • © 2021 SANS™ Institute
        • Privacy Policy
        • Contact
        • Twitter
        • Facebook
        • Youtube
        • LinkedIn