MIS 2202 – Digital Forensic University of Colombo, School of Computing Digital Digital Forensic Forensic - File File System System - Assignme Assignment nt
Name : Erica Jayasundera Student ID: 2016MIS013
MD5 Hash value: “7bc4222dd5dadc8592064d816b6749aa”
Hash Key Generated %%%% HASHDEEP-1.0 %%%% size,md5,filename ## Invoked from: /home/user/Desktop/MIS2202 ## # hashdeep -c md5 TechBank_User_Mach TechBank_User_Machine.dd ine.dd ## 4285338624,7bc4222dd5dadc8592064d816b6749aa,/home/user/Desktop/MIS2202/Tec hBank_User_Machine.dd I have used 3 tools to get these results namely : 1. mount on a linux linux machine machine and traversing between the files files for for basic information information 2. Access Data FTK Tool 3. OSForensics trail version version to invetigate invetigate deep in to the case. OSMount to mount the .dd file 1
1. File Analysis 1.1. List of most recent used files
1.2. List of searched files
2
1.3. Last command executed
1.4. Last Files saved
3
1.5. Which files are on the user Desktop?
1.6. Identify which files were deleted and are still in the Recycle bin
4
1.7. List of deleted files
1.8. Recover any deleted image
5
6
1.9. Does any of the deleted images contain sensitive information? If so what is that information? TrueCrypt Password found: CrackMe1fUc@N! and QR Code will contain sensitive information
1.10. Assuming that the images stored on the disk image were taken with the machine's owner digital camera, what make and model was the digital camera used? using exiftool and using properties in the window
7
2. Applications Analysis 2.1. Last time the password was changed
8
2.2. Was a USB stick ever connected to the machine and if so what information can you gather about that USB? USBSTOR\DiskKingstonDataTraveler_2.0PMAP USBSTOR \DiskKingstonDataTraveler_2.0 USBSTOR\DiskKingston USBSTOR \KingstonDataTraveler_2.0P KingstonDataTraveler_2.0P USBSTOR\GenDisk GenDisk USBSTOR\DiskTOSHIBA_MK6459GSX___________ USBSTOR \DiskTOSHIBA_MK6459GSX_______ USBSTOR\DiskTOSHIBA_ USBSTOR \TOSHIBA_MK6459GSX________ TOSHIBA_MK6459GSX________ USBSTOR \GenDisk GenDisk
2.3. What encryption software does the user use?TrueCrypt
9
2.4. When was the encryption software installed (exact time)?
2.5. Is there any encrypted information on the machine?
2.6. If so, can you find the content of them?
10
2.7. Any sensitive information stored in the user email
Position Amaya Karunanayake hold. 2.7. What information you can gather about the user of this machine? Please list them (Ex: Complete Name, Occupation, Contact details, Bank account numbers etc). Actual PC User : Amaya Karunanayake Email Address :
[email protected] and
[email protected]
client-ip=188.138.112.172; Manager, TechBank Credit Cards
11
12
3. Browsing Information 3.1. Which browser does the user use?
Mozilla Firefox This Installation Finished: 2011-09-29 9:57:05
3.2. List of typed URL
3.3. List of the URL visited by the user
13
3.4. What was the last page visited by the user?
3.5. Did the user visit any chat room? If so, state which ones and who are the people chat with this user? And content of those conversations?
3.6. Did the user joined with any social networking community websites? If so identify what are those websites, Information about the user profile and what kind of activities the user was doing? 14
Timezone: GMT +5:30
about:Home Activity Type: Internet Explorer URL Item URL: about:Home Username: techuser Access Time: 8/27/2011, 10:49:57 AM Location: G:\Documents and Settings\techuser\Local Settings\History\History.IE5 \index.dat
Account recovery information (13) Activity Type: Firefox URL Item URL: https://www.facebook.com/update_security_info.php?wizard=1 Username: techuser Profile: unwmd2z0.default Access Time: 9/29/2011, 11:19:35 PM Location: G:\Documents and Settings\techuser\Application Data\Mozilla\Firefox\Profiles \unwmd2z0.default\
Account settings (13) Activity Type: Firefox URL Item URL: https://www.facebook.com/settings?tab=account§ion=email&t Username: techuser Profile: unwmd2z0.default Access Time: 9/29/2011, 11:53:07 PM Location: G:\Documents and Settings\techuser\Application Data\Mozilla\Firefox\Profiles \unwmd2z0.default\
Account settings (13) 15
Activity Type: Firefox URL Item URL: https://www.facebook.com/settings Username: techuser Profile: unwmd2z0.default Access Time: 9/29/2011, 11:53:00 PM Location: G:\Documents and Settings\techuser\Application Data\Mozilla\Firefox\Profiles \unwmd2z0.default\
Amaya Karunanayake Activity Type: Firefox URL Item URL: https://www.facebook.com/profile.php?id=100002201709185 Username: techuser Profile: unwmd2z0.default Access Time: 9/30/2011, 11:48:32 PM
16
