Open Source Resources for Forensics in the Cloud

EC2 DFIR Workshop

Lab 7: Using ‘sorter’


Use the sorter command characterize the files from both allocated and unallocated space on the EVIDENCE volume


  1. Run the sorter command
  2. Explore the results

Step 1 – Run the sorter command

Run the sorter command in the background:

nohup sorter -s -f ext4 -d /mnt/data -x \
 /cases/changed/known_files.md5 /dev/xvdf1 &


sSave the actual file content to sub-directories in the directory specified by '-d'. For example, all JPG and GIF files would actually be saved in the 'images' directory
dSpecify the location of where all files should be written. This includes the index files and subdirectories if the '-s' flag is given.
fSpecify the file system type of the image(s).
xSpecify the location a hash database with entries of known 'good' files. If any file is found with an MD5 hash value in this database, it will be ignored and not processed.

VIDEO: Lab 8 Step 1 - Run the sorter command

Step 2 - Explore the results

This command uses the known_files hash list that was indexed previously and stores the output onto a new data volume that is at least the size of the EVIDENCE volume.

Browse the /mnt/data/ folder and look for anything interesting:

TIP: Try this grep "^\S*$" /mnt/data/exec.txt | less to examine exec.txt

VIDEO: Lab 8 Step 2 - Explore the results