Reference no: EM132221979
Instructions
Use The Sleuth Kit. (TSK) to examine the file system image diskimage.dd on the Virtual Desktop Infrastructure (VDI) at Champlain to complete the Lab.
Using The Sleuth Kit (TSK) on the VDI
"The Sleuth Kit is a collection of command line tools and a C library that allows you to analyze disk images and recover files from them. It is used behind the scenes in Autopsy and many other open source and commercial forensics tools."
Questions:
1. Copy the attached onto your desktop on the VDI:
diskimage.dd (file)
bin (folder)
Take a screenshot of these items on your desktop with the URL of the VDI. The file name, folder name, and URL should be clearly visible in the screenshot.
Attach the screenshot to answer this question.
Note: The TSK programs will not work unless the bin folder and the forensic images being examined are on the VDI desktop.
2. According to the TSK Overview, which TSK program is used to find the layout of a hard drive, including partition information?
3. According to the TSK Overview, which TSK program is used to find the file system statistics of a hard drive?
4. According to the TSK Overview, which TSK program is used to find the files on a forensic image?
5. According to the TSK Overview, which TSK program is used to find the meta data of a given file?
6. At what sector do the FAT CONTENTS begin on diskimage.dd?
7. Where are the file allocation tables begin and end on diskimage.dd?
8.Use the appropriate program to determine the number of sectors in each cluster of diskimage.dd.
Each cluster of diskimage.dd consists of ________ sectors. [Enter number of sectors.]
9. According to Marko's paper, which TSK program would you use to determine whether there is a Host Protected Area on a hard disk?
Why is this information important from a forensic standpoint?
(Include the page number of Marko's paper where you found this answer.)
10. The following resulted from using bin\mmls.exe image2.dd, with image2.dd being a forensic image of a hard drive:
How many active partitions are on this hard drive?
Explain how you reached this conclusion. (Marko's paper provides an explanation of how partitions are labeled in TSK output.
11.Using the output for Question 10, at what sector does the file system start on image2.dd?
12.Use the appropriate TSK program to the layout and partition information for diskimage.dd. Direct the output to a .txt file. Copy the output into answer.
13. How many active partitions does diskimage.dd contain?
14.Use the appropriate program to find file system statistics for diskimage.dd. What is the cluster size for diskimage.dd?
15.What is the volume label for diskimage.dd? What forensic relevance could the volume label have?
16. Use the appropriate TSK program to view the files on diskimage.dd. Which files, if any, are deleted? Explain how you determined this information.
17. Which file on diskimage.dd is largest? Explain how you determined this information.
18. Use the appropriate TSK program to determine the metadata associated with the file bullies.jpg. When was bullies.jpg created, written, and accessed?
19. At what sectors does the Master Boot Record begin and end on diskimage.dd? Explain how you arrived at this conclusion.
Attachment:- lab.rar