Case4.e01
•Download as TXT, PDF•
0 likes•128 views
The document summarizes the forensic analysis of a USB drive. It provides details of the drive such as size, sector count, and computed hashes. It also notes the acquisition of an image from the drive, including start and end times, as well as verification of the image hashes matching the physical device. The examiner of the case is listed as Alana Puckerin.
Report
Share
Report
Share
![Created By AccessData® FTK® Imager 3.1.0.1514
Case Information:
Acquired using: ADI3.1.0.1514
Case Number: Case4
Evidence Number: USB.01
Unique description: USB drive
Examiner: Alana Puckerin
Notes:
--------------------------------------------------------------
Information for forensics-user1students12001066DesktopCase4:
Physical Evidentiary Item (Source) Information:
[Drive Geometry]
Bytes per Sector: 512
Sector Count: 247,776
Source data size: 120 MB
Sector count: 247776
[Computed Hashes]
MD5 checksum: 64a2d7f3176656f5e9bba35c7399cdd8
SHA1 checksum: aa711c7f8625faf8ee5de67d0bb343e47fa262c9
Image Information:
Acquisition started: Mon Nov 12 11:22:29 2012
Acquisition finished: Mon Nov 12 11:25:17 2012
Segment list:
forensics-user1students12001066DesktopCase4.E01
Image Verification Results:
Verification started: Mon Nov 12 11:25:17 2012
Verification finished: Mon Nov 12 11:25:38 2012
MD5 checksum: 64a2d7f3176656f5e9bba35c7399cdd8 : verified
SHA1 checksum: aa711c7f8625faf8ee5de67d0bb343e47fa262c9 : verified](https://image.slidesharecdn.com/case4-e01-121113092105-phpapp01/85/Case4-e01-1-320.jpg)
Recommended
2010 2013 sandro suffert memory forensics introdutory work shop - public
Course Objectives:
• Help the student to achieve a broad understanding of the
main types of memory forensic data gathering and analysis
• Serve as an introduction to low level concepts necessary for
a proper understanding of the task of performing memory
forensics on Windows, MacOSX and Linux (incl. Android).
• Put the student in contact with different memory forensics
tools and provide him information on how to use the
gathered forensic data to perform a wide range of
investigations
Mac Forensics
The document provides information on analyzing Macintosh computers for digital forensics purposes. It discusses the file systems, operating systems, and applications used by Macs and how to acquire disk images and examine key artifacts. Specific topics covered include acquiring memory using Target Disk Mode, disabling disk arbitration, analyzing browser data from Safari, Firefox, Internet Explorer, and AOL, and examining email from applications like Mail, Entourage and AOL. Forensic tools mentioned include dd, dcfldd, Emailchemy, and the Safari Tools browser analyzer.
Memory forensics
This document discusses computer memory forensics. It explains that memory forensics involves acquiring volatile memory contents from RAM and preserving them for later forensic analysis. The document outlines the different types of forensic analysis that can be performed on memory contents, including storage, file system, application, and network analysis. It also discusses the challenges of memory forensics, such as anti-forensic techniques used by malware to hide processes, drivers, and other artifacts in memory.
Page cache in Linux kernel
Page cache mechanism in Linux kernel.
Note: When you view the the slide deck via web browser, the screenshots may be blurred. You can download and view them offline (Screenshots are clear).
Windows Memory Forensic Analysis using EnCase
The document discusses performing memory forensic analysis on Windows systems using EnCase, including acquiring memory images using tools like WinEn and MoonSols Windows Memory Toolkit, and analyzing the images using EnScripts to extract information on processes, modules, and open files through techniques like traversing kernel data structures and searching for object fingerprints. Hands-on examples are provided to demonstrate acquiring memory from a system and analyzing it using EnScripts to identify processes and differences before and after terminating a process.
Linux Kernel - Virtual File System
Virtual File System in Linux Kernel
Note: When you view the the slide deck via web browser, the screenshots may be blurred. You can download and view them offline (Screenshots are clear).
2.1 design hard disk layout v2
The document discusses designing hard disk layouts in Linux systems. It describes partitioning schemes, including extended and logical partitions. It explains how to create filesystems and swap spaces using tools like fdisk, mkfs, mkswap. It also covers formatting disks or partitions, and the various Linux filesystem types and standards like FHS.
Unit 6 adding new users and storage
This document discusses how to add new users and storage on a Linux system. It covers editing the /etc/passwd and /etc/shadow files to define a new user account, setting an initial password, creating the user's home directory, installing startup files, and setting permissions. The key steps are using a command like useradd to edit the password and shadow files, setting the password with passwd, creating the home directory, copying default startup files, and setting ownership of the home directory to the new user.
Recommended
2010 2013 sandro suffert memory forensics introdutory work shop - public
Course Objectives:
• Help the student to achieve a broad understanding of the
main types of memory forensic data gathering and analysis
• Serve as an introduction to low level concepts necessary for
a proper understanding of the task of performing memory
forensics on Windows, MacOSX and Linux (incl. Android).
• Put the student in contact with different memory forensics
tools and provide him information on how to use the
gathered forensic data to perform a wide range of
investigations
Mac Forensics
The document provides information on analyzing Macintosh computers for digital forensics purposes. It discusses the file systems, operating systems, and applications used by Macs and how to acquire disk images and examine key artifacts. Specific topics covered include acquiring memory using Target Disk Mode, disabling disk arbitration, analyzing browser data from Safari, Firefox, Internet Explorer, and AOL, and examining email from applications like Mail, Entourage and AOL. Forensic tools mentioned include dd, dcfldd, Emailchemy, and the Safari Tools browser analyzer.
Memory forensics
This document discusses computer memory forensics. It explains that memory forensics involves acquiring volatile memory contents from RAM and preserving them for later forensic analysis. The document outlines the different types of forensic analysis that can be performed on memory contents, including storage, file system, application, and network analysis. It also discusses the challenges of memory forensics, such as anti-forensic techniques used by malware to hide processes, drivers, and other artifacts in memory.
Page cache in Linux kernel
Page cache mechanism in Linux kernel.
Note: When you view the the slide deck via web browser, the screenshots may be blurred. You can download and view them offline (Screenshots are clear).
Windows Memory Forensic Analysis using EnCase
The document discusses performing memory forensic analysis on Windows systems using EnCase, including acquiring memory images using tools like WinEn and MoonSols Windows Memory Toolkit, and analyzing the images using EnScripts to extract information on processes, modules, and open files through techniques like traversing kernel data structures and searching for object fingerprints. Hands-on examples are provided to demonstrate acquiring memory from a system and analyzing it using EnScripts to identify processes and differences before and after terminating a process.
Linux Kernel - Virtual File System
Virtual File System in Linux Kernel
Note: When you view the the slide deck via web browser, the screenshots may be blurred. You can download and view them offline (Screenshots are clear).
2.1 design hard disk layout v2
The document discusses designing hard disk layouts in Linux systems. It describes partitioning schemes, including extended and logical partitions. It explains how to create filesystems and swap spaces using tools like fdisk, mkfs, mkswap. It also covers formatting disks or partitions, and the various Linux filesystem types and standards like FHS.
Unit 6 adding new users and storage
This document discusses how to add new users and storage on a Linux system. It covers editing the /etc/passwd and /etc/shadow files to define a new user account, setting an initial password, creating the user's home directory, installing startup files, and setting permissions. The key steps are using a command like useradd to edit the password and shadow files, setting the password with passwd, creating the home directory, copying default startup files, and setting ownership of the home directory to the new user.
Ccsr cps leadership summit 2013 final
The Consortium on Chicago School Research (CCSR) conducted a recent analysis on the extent to which students in CPS are using technology for school and whether factors such as school culture and the use of technology by their teachers and principals contribute to this. CCSR has identified a number of key factors that influence students’ in-school technology use. In this CPS and CCSR joint session, we will explore the key findings from this study and provide concrete suggestions on how you, as a leader, can support and increase student’s in-school use of technology within your building.
Sermons For Youth - Checkerboard Faith
Use wheat kernels and a chessboard to teach the idea of a little faith growing into something very big.
Ccu big v meeting 1
This document outlines a course on cross-cultural understanding that will examine cultural diversity and the problems that can arise between people from different cultures. The course will cover the cultures of various international regions, domestic ethnic groups in Indonesia, and local North Maluku culture. It defines culture and discusses aspects of culture, including beliefs, values, behaviors, customs, language, and artifacts. It warns against overgeneralizing about people based on their nationality or background. Students will participate in online forums, provide their email, and do a group presentation at the end of the course.
Caso concreto semana 01 resolvido
O pedido de reconsideração não é considerado um recurso pela lei, mas é tratado como um sucedâneo recursal pela doutrina. Para a aplicação do princípio da fungibilidade, é necessária uma fundada douta objetiva sobre qual recurso é cabível. No caso, o recorrente apresentou pedido de reconsideração ao invés de embargos de declaração, caracterizando erro grosseiro quanto ao recurso adequado.
Serrat 50 Años de Música
Han pasado 50 años desde que Joan Manuel Serrat se diese a conocer en Radioscope (Radio Barcelona). Por entonces, acaba de licenciarse como perito agrícola, solo cantaba en catalán y todavía no había publicado ningún disco. Fue el conductor del programa, Salvador Escamilla, el que le dio el empujón que le faltaba y lo presentó a una compañía discográfica.
Todo empezó la mañana del 18 de febrero de 1965. Ràdioscope era uno de los programas más populares de la radio catalana, se retransmitía a diario y en directo desde el estudio Toresky de Radio Barcelona. Esa mañana Salvador Escamilla, su creador, presentó a un joven del Poble Sec barcelonés que había escrito algunas canciones en catalán. Y no solo le abrió las ondas de la radio más escuchada del momento sino que lo recomendó a la discográfica Edigsa, la que cortaba el bacalao en cosas de cançó catalana. Así, en cosa de pocas semanas un aún desconocido Joan Manuel Serrat pasó a grabar su primer disco, e incorporarse, previo examen, a Els Setze Jutges (fue el miembro número trece) e iniciar sus primeros conciertos públicos (el primero en mayo de ese año en Esplugues de Llobregat).
CDE15 BRIEF Jive_V_OD (1)
The document discusses the phasing out of E-rate subsidies for phone services like VoIP through 2019. It recommends that school districts upgrade their communications solutions to hosted, cloud-based VoIP now in order to take advantage of remaining E-rate discounts of up to 70% in 2015 that will decrease by 20% each year. Hosted VoIP offers benefits like reduced costs, improved security and scalability, and easier maintenance compared to on-premises phone systems. The application process for 2015 E-rate funds begins in January with a February 26 deadline to file forms.
Sermon slides april 21 2013
This document discusses four types of "joy stealers" that can diminish happiness: 1) Negative people who bring others down, 2) Difficult life circumstances beyond one's control, 3) Material things that are sought after but do not provide lasting fulfillment, and 4) Excessive worrying about the future or past instead of living in the present moment. The document concludes by welcoming the reader to the city of Philippi.
CCS technology development Norway - key activities - learnings – way forward
GASSNOVA HAS A MAJOR AND
VERY DEMANDING MANDATE,
given to us by the nation of Norway: We are to help provide solutions
for CO2 capture and storage (CCS), so that humanity does not make
this world uninhabitable for coming generations.
Service proj
Devon Hoskins volunteered at a homeless shelter to help make and distribute food to those in need. They helped prepare large amounts of food and set up a buffet line to hand out the food. The people at the shelter were very grateful to receive the meals. Through this experience, Devon learned that many people are less fortunate and that volunteering even a small amount of time, such as preparing a meal, can greatly help those in need.
Case study MOSEP
“Young learners, between the age of 14 and 16, find themselves at transition points in their lives at which they have to choose between going into upper secondary education or entering vocational training. It is a time when they have to make decisions and need to be supported in making the best choices for their future careers...
Case-Study-Cyber-Investigations-8-5-2015
Timothy J. Nolan has over 17 years of experience leading cyber investigations and incident response. He has investigated a wide range of cyber incidents such as data theft, malware attacks, and policy violations. As the manager of intrusion detection at Bridgestone Americas, a Fortune 500 company, he was responsible for monitoring, investigations, and response. Nolan has worked with law enforcement and forensic experts on complex global investigations that have led to prosecutions, lawsuits, and employee terminations. References praise his dedication, diligence in finding evidence, and ability to balance security needs with business objectives.
Cdelpalofemenino 16-sin-perder
El equipo femenino CD El Palo ha tenido una racha imparable de victorias en sus últimos partidos de liga y copa, ganando 15 de 16 partidos de liga y avanzando a la final de la Copa Federación tras vencer a Puerto de la Torre y Torreño.
Sermon slides april 28 2013
This document discusses serving and sacrificing for others as well as glorifying God. It poses questions about thinking of others, serving others, sacrificing for others, and glorifying God. The document repeats these questions in separate paragraphs, suggesting they are important concepts to consider.
Digital Forensic Tools - Application Specific.
Based on queries regarding the tools needed for Computer Forensics Investigations. I recommend this presentation. This would help in customizing tools depending upon the requirement of a specific case.
This presentation has been presented Jim Lyle. His contact info is available on the first slide. Kindly reach him for further queries. >> ravi
Digital Forensic tools - Application Specific
Based on queries regarding the tools needed for Computer Forensics Investigations. I recommend this presentation. This would help in customizing tools depending upon the requirement of a specific case.
This presentation has been presented by Dr.Jim Lyle. His contact info is available on the first slide. Kindly reach him for further queries. >> ravi
Andy Davis' Black Hat USA Presentation Revealing embedded fingerprints
The document discusses techniques for fingerprinting operating systems and applications based on their responses during the USB enumeration process. It describes how small differences in the ordering and types of descriptor requests, timing information, and responses to invalid data can be used to identify the OS or application interacting with a USB device. The document also summarizes an exploit against the Windows 8 RNDIS driver that allows overwriting kernel memory by manipulating fields in the USB configuration descriptor.
Foundation of Digital Forensics
Digital Forensics is a very important and new skill which is useful to uncover data and interpreting digital data. Yet, not many people understand about it.
Adw cleaner[r0]
The document is a report from AdwCleaner that scanned a Windows 7 system. It found traces of Superfish, Vosteran, and other potentially unwanted programs in the Chrome user profiles, Windows folders, registry, and scheduled tasks. AdwCleaner detected alternative browser search providers and files or folders related to Superfish, Vosteran, OpenCandy, and other programs.
More Related Content
Viewers also liked
Ccsr cps leadership summit 2013 final
The Consortium on Chicago School Research (CCSR) conducted a recent analysis on the extent to which students in CPS are using technology for school and whether factors such as school culture and the use of technology by their teachers and principals contribute to this. CCSR has identified a number of key factors that influence students’ in-school technology use. In this CPS and CCSR joint session, we will explore the key findings from this study and provide concrete suggestions on how you, as a leader, can support and increase student’s in-school use of technology within your building.
Sermons For Youth - Checkerboard Faith
Use wheat kernels and a chessboard to teach the idea of a little faith growing into something very big.
Ccu big v meeting 1
This document outlines a course on cross-cultural understanding that will examine cultural diversity and the problems that can arise between people from different cultures. The course will cover the cultures of various international regions, domestic ethnic groups in Indonesia, and local North Maluku culture. It defines culture and discusses aspects of culture, including beliefs, values, behaviors, customs, language, and artifacts. It warns against overgeneralizing about people based on their nationality or background. Students will participate in online forums, provide their email, and do a group presentation at the end of the course.
Caso concreto semana 01 resolvido
O pedido de reconsideração não é considerado um recurso pela lei, mas é tratado como um sucedâneo recursal pela doutrina. Para a aplicação do princípio da fungibilidade, é necessária uma fundada douta objetiva sobre qual recurso é cabível. No caso, o recorrente apresentou pedido de reconsideração ao invés de embargos de declaração, caracterizando erro grosseiro quanto ao recurso adequado.
Serrat 50 Años de Música
Han pasado 50 años desde que Joan Manuel Serrat se diese a conocer en Radioscope (Radio Barcelona). Por entonces, acaba de licenciarse como perito agrícola, solo cantaba en catalán y todavía no había publicado ningún disco. Fue el conductor del programa, Salvador Escamilla, el que le dio el empujón que le faltaba y lo presentó a una compañía discográfica.
Todo empezó la mañana del 18 de febrero de 1965. Ràdioscope era uno de los programas más populares de la radio catalana, se retransmitía a diario y en directo desde el estudio Toresky de Radio Barcelona. Esa mañana Salvador Escamilla, su creador, presentó a un joven del Poble Sec barcelonés que había escrito algunas canciones en catalán. Y no solo le abrió las ondas de la radio más escuchada del momento sino que lo recomendó a la discográfica Edigsa, la que cortaba el bacalao en cosas de cançó catalana. Así, en cosa de pocas semanas un aún desconocido Joan Manuel Serrat pasó a grabar su primer disco, e incorporarse, previo examen, a Els Setze Jutges (fue el miembro número trece) e iniciar sus primeros conciertos públicos (el primero en mayo de ese año en Esplugues de Llobregat).
CDE15 BRIEF Jive_V_OD (1)
The document discusses the phasing out of E-rate subsidies for phone services like VoIP through 2019. It recommends that school districts upgrade their communications solutions to hosted, cloud-based VoIP now in order to take advantage of remaining E-rate discounts of up to 70% in 2015 that will decrease by 20% each year. Hosted VoIP offers benefits like reduced costs, improved security and scalability, and easier maintenance compared to on-premises phone systems. The application process for 2015 E-rate funds begins in January with a February 26 deadline to file forms.
Sermon slides april 21 2013
This document discusses four types of "joy stealers" that can diminish happiness: 1) Negative people who bring others down, 2) Difficult life circumstances beyond one's control, 3) Material things that are sought after but do not provide lasting fulfillment, and 4) Excessive worrying about the future or past instead of living in the present moment. The document concludes by welcoming the reader to the city of Philippi.
CCS technology development Norway - key activities - learnings – way forward
GASSNOVA HAS A MAJOR AND
VERY DEMANDING MANDATE,
given to us by the nation of Norway: We are to help provide solutions
for CO2 capture and storage (CCS), so that humanity does not make
this world uninhabitable for coming generations.
Service proj
Devon Hoskins volunteered at a homeless shelter to help make and distribute food to those in need. They helped prepare large amounts of food and set up a buffet line to hand out the food. The people at the shelter were very grateful to receive the meals. Through this experience, Devon learned that many people are less fortunate and that volunteering even a small amount of time, such as preparing a meal, can greatly help those in need.
Case study MOSEP
“Young learners, between the age of 14 and 16, find themselves at transition points in their lives at which they have to choose between going into upper secondary education or entering vocational training. It is a time when they have to make decisions and need to be supported in making the best choices for their future careers...
Case-Study-Cyber-Investigations-8-5-2015
Timothy J. Nolan has over 17 years of experience leading cyber investigations and incident response. He has investigated a wide range of cyber incidents such as data theft, malware attacks, and policy violations. As the manager of intrusion detection at Bridgestone Americas, a Fortune 500 company, he was responsible for monitoring, investigations, and response. Nolan has worked with law enforcement and forensic experts on complex global investigations that have led to prosecutions, lawsuits, and employee terminations. References praise his dedication, diligence in finding evidence, and ability to balance security needs with business objectives.
Cdelpalofemenino 16-sin-perder
El equipo femenino CD El Palo ha tenido una racha imparable de victorias en sus últimos partidos de liga y copa, ganando 15 de 16 partidos de liga y avanzando a la final de la Copa Federación tras vencer a Puerto de la Torre y Torreño.
Sermon slides april 28 2013
This document discusses serving and sacrificing for others as well as glorifying God. It poses questions about thinking of others, serving others, sacrificing for others, and glorifying God. The document repeats these questions in separate paragraphs, suggesting they are important concepts to consider.
Viewers also liked (15)
CCS technology development Norway - key activities - learnings – way forward
CCS technology development Norway - key activities - learnings – way forward
Similar to Case4.e01
Digital Forensic Tools - Application Specific.
Based on queries regarding the tools needed for Computer Forensics Investigations. I recommend this presentation. This would help in customizing tools depending upon the requirement of a specific case.
This presentation has been presented Jim Lyle. His contact info is available on the first slide. Kindly reach him for further queries. >> ravi
Digital Forensic tools - Application Specific
Based on queries regarding the tools needed for Computer Forensics Investigations. I recommend this presentation. This would help in customizing tools depending upon the requirement of a specific case.
This presentation has been presented by Dr.Jim Lyle. His contact info is available on the first slide. Kindly reach him for further queries. >> ravi
Andy Davis' Black Hat USA Presentation Revealing embedded fingerprints
The document discusses techniques for fingerprinting operating systems and applications based on their responses during the USB enumeration process. It describes how small differences in the ordering and types of descriptor requests, timing information, and responses to invalid data can be used to identify the OS or application interacting with a USB device. The document also summarizes an exploit against the Windows 8 RNDIS driver that allows overwriting kernel memory by manipulating fields in the USB configuration descriptor.
Foundation of Digital Forensics
Digital Forensics is a very important and new skill which is useful to uncover data and interpreting digital data. Yet, not many people understand about it.
Adw cleaner[r0]
The document is a report from AdwCleaner that scanned a Windows 7 system. It found traces of Superfish, Vosteran, and other potentially unwanted programs in the Chrome user profiles, Windows folders, registry, and scheduled tasks. AdwCleaner detected alternative browser search providers and files or folders related to Superfish, Vosteran, OpenCandy, and other programs.
Similar to Case4.e01 (6)
Andy Davis' Black Hat USA Presentation Revealing embedded fingerprints
Andy Davis' Black Hat USA Presentation Revealing embedded fingerprints
Case4.e01
- 1. Created By AccessData® FTK® Imager 3.1.0.1514 Case Information: Acquired using: ADI3.1.0.1514 Case Number: Case4 Evidence Number: USB.01 Unique description: USB drive Examiner: Alana Puckerin Notes: -------------------------------------------------------------- Information for forensics-user1students12001066DesktopCase4: Physical Evidentiary Item (Source) Information: [Drive Geometry] Bytes per Sector: 512 Sector Count: 247,776 Source data size: 120 MB Sector count: 247776 [Computed Hashes] MD5 checksum: 64a2d7f3176656f5e9bba35c7399cdd8 SHA1 checksum: aa711c7f8625faf8ee5de67d0bb343e47fa262c9 Image Information: Acquisition started: Mon Nov 12 11:22:29 2012 Acquisition finished: Mon Nov 12 11:25:17 2012 Segment list: forensics-user1students12001066DesktopCase4.E01 Image Verification Results: Verification started: Mon Nov 12 11:25:17 2012 Verification finished: Mon Nov 12 11:25:38 2012 MD5 checksum: 64a2d7f3176656f5e9bba35c7399cdd8 : verified SHA1 checksum: aa711c7f8625faf8ee5de67d0bb343e47fa262c9 : verified