CIS Business Computer Forensics and Incident Response. Lab Protocol 02: FileSystems/VM

Transcription

1 Name: CIS 8630 Business Computer Forensics and Incident Response Lab Protocol 02: FileSystems/VM Purpose: Ensure every student has experienced forensics distinctions between imaging digital storage media, hashing digital media, transferring digital media and verification of hash values using forensically proper techniques. Materials required: None Deliverable: This lab protocol from individual students. Be sure your name is on the material delivered. Part 1 Preparation 1. Download the HxD disk editing tools from: 2. Unzip the files to C:\dayspace\tools 3. Download the Lab02 disk image from: 4. Unzip the file to C:\dayspace\tools Part 2 Prepare to examine the binary contents of the disk image 1. Run HxD in the directory C:\dayspace\tools If asked, click OK to dismiss the First start of HxD dialog box 2. Select Open Disk Image from the Extras pull-down menu. Choose the file cis8630lab02.img 3. The sector size dialog box will open. Choose Set the hex-dec-oct drop down box to hex or dec (hexadecimal or decimal) 5. Note: If you open this through windows, disk images are opened through the Extras menu. Part 3 Examine the Volume Boot Sector (VSB) of the media Refer to Table 2.2 of the Bunting Text. 1. What is the Formatting OS used for this media? Located at byte 3-10 (0x03)

2 2. Was this media fixed or removable? Located at byte 21 (0x15) F0 Removable. F8 Fixed 3. What did the user name this volume? a. Located at bytes (0x2B) 4. What is the file system type? b. Located at bytes (0x36) 5. What is the likely physical media represented by this image (hard drive, thumbstick, floppy, other)? 6. How did you arrive at this opinion? Part 4 Examine the File Allocation Table and Root Directory of the media. In this particular type of file system, a cluster has only one sector in it. Therefore clusters = sectors (for this type of file system). 1. The file allocation table is in clusters 1-9 (there is a backup copy in clusters 10-18). Note that data clusters 0 & 1 are unaddressable (reserved for use). Therefore allocations for data clusters at (0x200) are used to store system indicators. 2. What is the hexadecimal value for the allocation of cluster 2? Remember to adjust for little endian. Located at bytes (0x204) 3. Is data cluster 2 allocated to a file or unallocated? 4. How many data clusters are allocated files? 2 of 5

3 5. Below is the directory listing for this image. This root directory begins at Media Cluster 19. Refer to Bunting Table 2.4. Locate the entry for WINNER.TXT. What is the beginning data cluster number of this file? Remember to adjust for little endian. 6. Locate the root directory entry for LOSER.TXT. What is the beginning data cluster number of this file? Remember to adjust for little endian. 7. Why doesn t does the file LOSER.TXT appear in the directory listing? How can you prove this explanation? 8. The data area begins at cluster 30 (the end of the fixed length Root Directory). What is the content of WINNER.TXT? 9. What is the content of the deleted file LOSER.TXT? Part 5 Introduction to your VMware workstation 1. Open Microsoft Remote Desktop. Start > Run > mstsc > OK 3 of 5

4 2. On the Remote Desktop Connection window, select Options 3. Click the Local Resources tab and select the Disk drives check box 4. Click Connect to log in. 5. Type in CIS4000-userX.cis.gsu.edu [where X is the number of your VM] 6. Enter username and password 7. Choose My Computer from the desktop. Record: a. Memory Size b. Processor Speed c. Disk Size 8. Log off of the VM. Part 6 Date and Time Issues (Complete this part on your own computer. Administrator privileges are required.) 1. Connect a memory thumbstick to an available USB port. Note the system time in the lower right-hand corner of the taskbar. (system time) 4 of 5

5 2. Right-click on the c:\drive and select Properties. Under the General tab, what is the File System used on this drive? Repeat this process for the memory thumbstick. (c:\ drive file system ) (Thumbstick file system) 3. Using notepad or equivalent, create two text files, one on your desktop named DT1- NTFS.txt and one on the thumbstick named DT2-FAT.txt. Right click on each file and select properties. What is the modified date/time stamp on each file? (DT1-NTFS.txt ) (DT2-FAT.txt) 4. On the lower right-hand corner of the taskbar, right-click on the time. Select Adjust Date/Time. Wellington. Under the timezone tab, select GMT +12:00 Auckland, Note the system time. (system time) 5. What is the modified date/time stamp on each file? (DT1-NTFS.txt - Desktop) (DT2-FAT.txt - Thumbstick) 6. Copy DT1-NTFS.txt to the thumbstick. 7. On the lower right-hand corner of the taskbar, right-click on the time. Select Adjust Date/Time. & Canada). Under the timezone tab, select GMT -5:00 Eastern Time (US Note the system time. (system time) 8. Right click on each file and select properties. What is the modified date/time stamp on each file? (DT1-NTFS.txt - Desktop) (DT1-NTFS.txt - Thumbstick) (DT2-FAT.txt - Thumbstick) 9. Why did some times change while others did not? 5 of 5