Loading...

Messages

Proposals

Stuck in your homework and missing deadline? Get urgent help in $10/Page with 24 hours deadline

Get Urgent Writing Help In Your Essays, Assignments, Homeworks, Dissertation, Thesis Or Coursework & Achieve A+ Grades.

Privacy Guaranteed - 100% Plagiarism Free Writing - Free Turnitin Report - Professional And Experienced Writers - 24/7 Online Support

Ftk lab

05/01/2021 Client: saad24vbs Deadline: 14 Days

Advanced Computer Forensics


Windows FTK Forensics Lab

Read the ENTIRE document before starting to be sure you have all the necessary tools and files required to complete the lab. You should further explore the tools used in this lab to ensure your familiarity with alternative investigation options.


Lab Setup for using RLES vCloud


This lab is designed to function on the RLES vCloud. The interface is available by navigating to https://rlesvcloud.rit.edu/cloud/org/NAT. You have created a vApp in your previous labs. Now, you will add the vApp template, 841_Win_Forensics_Updated , from the Public Catalogs, to the same vApp following the instruction of Add Virtual Machines to a vApp without a network required (see RLES vCloud User Guide).


FTK software including FTK 1.8, Registry Viewer and FTK Imager are install in the 841_Win_Forensics_Updated VM. The EnCase evidence file, WinLabEnCase, is located in the local E:\ drive in RLES VM. Please read FTK 1.80 User Manual, posted in RLES, for FTK details.


The 841_Win_Forensics_Updated VM login


Username: Administrator


Password: netsys


NOTE: If you are not able to open the VM, please reset the VM’s mac address (right click on the VM, choose property, then click on the Hardware tab, click on the drop down arrow of mace address to reset the mac address)


PART I: Familiar with FTK Imager


Bonus Exercise 1 (5 points): Assume that you have a write-protected USB device.


Image a USB device or a floppy disk to create an image in a DD format. (Note: You are not able to use the 841_Win_Forensics_Updated VM to perform this bonus exercise. You have to use your own computer for this exercise).


Provide a snapshot from FTK Imager.


Requires: a USB device or a floppy disk


Launch FTK Imager


Click File > Create Disk Image


Click Physical Drive and Next


Select the device and select Raw (dd) Image Type


Exercise 2: View images


Click File > Add Evidence Item


Select Image file and then click Next


Browse to your WinLabEnCase.E01 image and click Finish


View the image in the Evidence Tree view


Question 1: What is the VBR file used for? How to export this file? How to export a file Hash?


Exercise 3: Convert the WinLabEnCase image to a DD image


In the Evidence Tree view, select the WinLabEnCase image


Click File > Export Disk Image


In the Create Image dialog, click Add


Select the raw image type and name it as converted.


Exercise 4: Verify images


Select the Encase Image and click File > Verify Drive/Image


Add in the converted raw image to the FTK Imager and click File > Verify Drive/Image.


Question 2: What are the results of verification? Comparing both hashes, are they same or not?


PART II: Working with FTK 1.8x


All exercises and questions in this part are designed for FTK 1.8x.


NOTE: If you choose to use FTK 4 instead of FTK 1.8x, please follow PART III.


Objective: Based on the experience you have in the previous lab, you will utilize FTK to conduct an analysis of an incident. This project will help you tie all of the pieces and techniques together, so that you have a better understanding of the whole picture of forensics investigation.


Requires: FTK and a windows’ disk image provided by your instructor.


Descriptions: In this lab you will be given a scenario and a disk image to go along with it. You will use FTK to analyze the disk image, retrieve deleted files and terms that have been purposefully hidden, and then use FTK to create a report about this incident.


Scenario: ACME Industries develops custom software for the aviation industry. Its main competitors are companies Raytheon and Boeing and a few smaller contractors.


Pat Smith has worked for ACME Industries for 5 years. His supervisor has noted that after being past over several times for a promotion, Pat has become quite disgruntled. The company fears that Pat may be offering proprietary company information to a competitor in exchange for a job.


The first investigator has created an Encase image of Pat’s computer’s hard drive. Your job is to examine it and extract all pertinent information to the investigation. You are to make no assumptions of innocence or guilt, just to gather information.


Steps involved:


1) Locate the EnCase evidence file “WinLabEnCase.E01”


2) Create a new case and add the EnCase evidence file to FTK for investigation.


3) Analyze the image.


Show the activities such as recovering deleted files; finding information that have been purposefully hidden; analyzing MAC time, signatures and Hash sets; searching keywords; gathering pertinent information from compound files such as outlook express .dbx files and registry files; examining IE history file, searching recycled files though the hidden Recycled folder and printer’s spool files located in WINDOWS\system32\spool\PRINTERS etc.


4) Generate a report


Note: All information in your report needs to be verified and repeatable in order to be admissible in court.


DETAILED PROCEDURES THAT MAY HELP YOU TO GO THROUGH THE FTK SOFTWARE


Exercise 1: Starting a New Case

Click File > “New Case” to begin a new case.


Name the case “FTK Case 1”


Enter your name as the examiner.


Enter your information as the forensic Examiner Information


Question 3: What information is required to create a new case using the FTK New Case Wizard?


In the Case Log Options window, leave all options marked. Try to understand each of the options.


In the Processes to Perform window, leave all options marked. Try to understand each of the options.


In both the Refine Case Default and the Refine Index Default windows, leave all options marked. Try to understand each of the options.


Add an Image to the exist case

In the Add Evidence to the Case window click “Add Evidence”, choose “Acquired Image of Drive”


Question 4: What are the types of evidence that can be added to a case in FTK?


Select the “WinLabEnCase.E01” file.


Set the Time Zone


When you acquire a computer as evidence it is important to make note of the computer’s time and time zone, especially if you need to correlate evidence from different time zones (never assume the time or time zone on a computer is correct.)


To set the time zone in FTK, in the Local Evidence Time Zone Selection window, choose your local time zone.


Exercise 2: Working with FTK


Click the OVERVIEW tab; note the numbers for each type of file.


Question 5: How to make the number of the Checked Items to go up? How to make the number of Flagged Thumbnails to go up?


File Signatures

A file type (JPEG, Word Document, MP3 file) can be determined by the file’s extension and by a header that precedes the data in the file. If a file’s extension has been changed, then the only way to determine its type is by looking at its header.


Question 6: Click on Bad Extension from Overview tab. Do you find any signature mismatch? What are they?

Homework is Completed By:

Writer Writer Name Amount Client Comments & Rating
Instant Homework Helper

ONLINE

Instant Homework Helper

$36

She helped me in last minute in a very reasonable price. She is a lifesaver, I got A+ grade in my homework, I will surely hire her again for my next assignments, Thumbs Up!

Order & Get This Solution Within 3 Hours in $25/Page

Custom Original Solution And Get A+ Grades

  • 100% Plagiarism Free
  • Proper APA/MLA/Harvard Referencing
  • Delivery in 3 Hours After Placing Order
  • Free Turnitin Report
  • Unlimited Revisions
  • Privacy Guaranteed

Order & Get This Solution Within 6 Hours in $20/Page

Custom Original Solution And Get A+ Grades

  • 100% Plagiarism Free
  • Proper APA/MLA/Harvard Referencing
  • Delivery in 6 Hours After Placing Order
  • Free Turnitin Report
  • Unlimited Revisions
  • Privacy Guaranteed

Order & Get This Solution Within 12 Hours in $15/Page

Custom Original Solution And Get A+ Grades

  • 100% Plagiarism Free
  • Proper APA/MLA/Harvard Referencing
  • Delivery in 12 Hours After Placing Order
  • Free Turnitin Report
  • Unlimited Revisions
  • Privacy Guaranteed

6 writers have sent their proposals to do this homework:

Helping Hand
University Coursework Help
Writer Writer Name Offer Chat
Helping Hand

ONLINE

Helping Hand

I am an Academic writer with 10 years of experience. As an Academic writer, my aim is to generate unique content without Plagiarism as per the client’s requirements.

$110 Chat With Writer
University Coursework Help

ONLINE

University Coursework Help

Hi dear, I am ready to do your homework in a reasonable price.

$112 Chat With Writer

Let our expert academic writers to help you in achieving a+ grades in your homework, assignment, quiz or exam.

Similar Homework Questions

Depaul university sociology - Mass effect 3 kakliosaur location - D10 - Week 6 Final Paper and Folio - Problem solving selection criteria sample - I came i saw i shopped story summary - Excel chapter 4 grader project - Discussion - Self assessment paper for psychology - Nile lashed to the slave stick tab - Gourmet to go case analysis - Case study: Southern Cross Healthcare - 50-A1, D1 - Healthcare Informatics and Technology - Year 10 english acara - Brett courtenay son of bryce - Wps pearsoned co uk financial management - Where do animals live - Case Brief 4 - V belt design guide - MNCs and Globalization - Annotated prologue romeo and juliet - Accepted value for the solubility product of calcium hydroxide - Cwv 101 topic 7 review - Electron configuration of br ion - EVIDENCE MIDTERM- STRICT DEADLINE - Crown prosecution service process mapping - Mission, Vision, and Strategy - Trevor noah world war d - Discussion Social Problems - Week 6 word of week - Finance 100 - Ludo game code in c language - Word chapter 3 simulation exam - Https atpnet new hdefault html - Thomson one banker warwick - Yo les envié (sent) postales a mis amigos - Vin diesel owns the fredonia barber shop - Ultimate pet partners limited - Stoichiometry mole ratio study lab - Andy mapple how did he die - Review Article - Characteristics of a care worker - Sociology chapter 6 review answer key - Index for inclusion developing learning and participation in schools - Cortex m4 generic user guide - Week 2 quiz - What professions comprise your career field workplace? - Of mice and men dreams - Two ways to live - Deira international school teachers - Gcu style template - ((+2349022657119))... {&} HOW DO I JOIN RITUAL MONEY ORGANIZATION FOR MONEY RITUAL. - Explain Nola Pender's model and how can you apply it to your nursing practice. Explain in 150 words - Unit VIII Amercian Hystory - University of bradford internal - Cromer beach car park - How to solve postfix and prefix expression - Hunches that communication theory are built about should be - Reply to Community Health Discussion on School Health Issues - Threats to a computerized accounting system - 48 shades of brown sparknotes - Birms university of birmingham - Post a systematic review and write a critical appraisal for an (Article related to pain management abuse) - How to help morbidly obese friend - Data mining 7a - Cloud Computing-1 - Order 2392591: Case Study & Reflection - Adaptive Selling Personality Type - Seven primary categories of access controls system - Black ops 4 zombies crowd affinity item available - Groupthink: psychological studies of policy decisions and fiascoes - Sky box maintenance cover - Apply the service profit chain concept to airbnb - Toyota supply chain management - Why is radioactive decay so predictable - How can job descriptions be used as a management tool - Maria full of grace character analysis - 3 month probation review template - The mask you live in 2015 - Lab report heat of reaction - Purchasing state lottery tickets is reinforced - Wakefield coroner's court parking - Glucose negative feedback loop - Psychology - Organ leader & Decision making - Practice of clinical psychology worksheet - Does bianca die in othello - Cyber domain parts - Reorganization - Muddy wild splash sea of thieves - How does a tv transmitter work - Similarities between egypt and philippines culture - Application of differential calculus in daily activities - Duck company malaysia - Process of wave refraction - The sales funnel model of classifying prospects involves - Tyco traffic & transportation - Theatre production planning worksheet - Tic tac sugar free chill mints