File System Analysis with Binwalk | By Alex Ocheme Ogbole

File System Analysis with Binwalk

Binwalk is a simple Linux tool used for analysis of binary image files. Analyzing binary image files may include; reverse engineering, extracting firmware images, file systems, embedded files or executable codes from the binary images. These binary images could be from firmware of routers, IOT devices or any digital device.

To understand the way the tool works, I ran analysis on a forensic image obtained from 4GB eMMC chip off LG Smart TV. The image was obtained by chip-offforensics method and read through HancomGMD product MD-RED. From my analysis using Binwalk, it revealed the following: Squashfs filesystem, Ext4 Linux filesystem, an Ubiquiti partition header and a YAFFS filesystem.

The steps taken to achieve this is what I would like to share and described below.

LG IMAGE ANALYSIS USING BINWALK

1. Install Binwalk: First run the command “apt get install binwalk” to install the tool

2. Running Binwalk tool: On the LG Forensic Image (KLM4G1FETE-B041_ChipOff_20190806_ALLPART.mdf) as seen in the syntax in screen shot image below
   
    
3. Outcome of Running Binwalk: Screenshots of outcome header 

   Showing Ubiquiti partition header, Squashfs filesystem and linux Ext4 filesystem. 

4.