What are the hash value and the output of the image info

Assignment Help Other Engineering
Reference no: EM131722813

Lab: Memory Acquisition Lab

For this exercise you will be capturing memory from your own laptops (or a virtual machine if you prefer). It is important, however, that you use a machine that is actually used. (E.g., don't install a Windows VM for this exercise to acquire it; you're looking for other real-world data.) You WILL NOT hand in your own memory image, for obvious privacy reasons. Memory acquisition can be time-consuming (directly related to how much memory you have in your machine). Accordingly, this exercise will start by capturing memory from an active machine you control BEFORE the lab period.

It is recommended you do this no later than two nights before the lab. Run the acquisition overnight, and if for some reason it doesn't work, try again the next night. Bring this image to lab with you.

Be sure to have Volatility installed on the forensics image created in the last lab; you may need additional Volatility profiles, depending on the type of machine you image. You can view the Volatility cheatsheet to get an idea of which commands to use.

This assignment is designed so you can do some hands-on acquisition and familiarize yourself with Volatility. Working with other students with different operating systems is encouraged, but the answers should remain your own and be related to your own image.

Answer the following:

1. Capture the memory of your system; what are the hash value and the output of the image info command on your image? How would you forensically handle the image (i.e., chain of custody/integrity of evidence)?

2. Get a list of running processes when the image was captured. Which commands did you use? Are there any hidden processes?

3. What arguments were used to execute the above program, and which command did you use to find it?

4. What variables did the above program have set, and what was the parent process that launched it? How did you retrieve that information?

5. Dump a hidden process (or if there wasn't one, any other running process). What command did you use? How could you determine quickly if it was malicious?

6. Retrieve the command line history (bash, cmd.exe, etc.) from the image. What command did you use? What was the last command run?

7. Get a list of installed kernel modules and list them. What command did you use?

8. What was the networking info of the machine at time of capture (IP address, active connections)? What command did you use?

9. Working with someone who had a different operating system (e.g., if you had Windows, ask someone with Linux or a Mac), take a look at how the other person retrieved information and observe the differences. How would you accommodate multiple platforms in an investigation? Give the image info output for the other student's image you were looking at.

10. What other commands can you run that give you interesting information? (Can you retrieve your browser history, OTR chats, etc.?) Explore the capability of this kind of analysis.

Attachment:- Lab Assignment.rar

Reference no: EM131722813

Questions Cloud

Know about the group seeking citizenship : What is one very important point you would want to know about the group seeking citizenship?
Draw structures for all the stereo-isomers : Draw structures for all the stereo-isomers of 1,2-diaminocyclohexane (You do not need to show chair conformers for this part of the problem).
Write the rate law for the reaction : What is the value of the rate constant (k) for this reaction at this temperature?
Reflect a nonbiased language style : Rewrite each of the following sentences to reflect a nonbiased language style:1.
What are the hash value and the output of the image info : Capture the memory of your system; what are the hash value and the output of the image info command on your image
Most effective in different circumstances : What leadership perspective is most effective in different circumstances? For many leaders, this may be a challenging question to answer.
How mcpherson supports his arguments : how McPherson supports his arguments and the evidence he uses, and explain whether or not you find his arguments convincing.
Define cryptographic technology protocols : Discuss the components involved in cryptographic technology protocols and explain the common cryptographic standards and methods
How has the economic condition of the nation influenced : How has the economic condition of the nation influenced our ideas and policies on immigration? How has immigration policy impacted 2016 presidential election?

Reviews

Write a Review

Other Engineering Questions & Answers

  Characterization technology for nanomaterials

Calculate the reciprocal lattice of the body-centred cubic and Show that the reciprocal of the face-centred cubic (fcc) structure is itself a bcc structure.

  Calculate the gasoline savings

How much gasoline do vehicles with the following fuel efficiencies consume in one year? Calculate the gasoline savings, in gallons per year, created by the following two options. Show all your work, and draw boxes around your answers.

  Design and modelling of adsorption chromatography

Design and modelling of adsorption chromatography based on isotherm data

  Application of mechatronics engineering

Write an essay on Application of Mechatronics Engineering

  Growth chracteristics of the organism

To examine the relationship between fermenter design and operating conditions, oxygen transfer capability and microbial growth.

  Block diagram, system performance and responses

Questions based on Block Diagram, System Performance and Responses.

  Explain the difference in a technical performance measure

good understanding of Mil-Std-499 and Mil-Std-499A

  Electrode impedances

How did this procedure affect the signal observed from the electrode and the electrode impedances?

  Write a report on environmental companies

Write a report on environmental companies

  Scanning electron microscopy

Prepare a schematic diagram below of the major parts of the SEM

  Design a pumping and piping system

creating the pumping and piping system to supply cool water to the condenser

  A repulsive potential energy should be a positive one

Using the data provided on the webvista site in the file marked vdw.txt, try to develop a mathematical equation for the vdW potential we discussed in class, U(x), that best fits the data

Free Assignment Quote

Assured A++ Grade

Get guaranteed satisfaction & time on delivery in every assignment order you paid with us! We ensure premium quality solution document along with free turntin report!

All rights reserved! Copyrights ©2019-2020 ExpertsMind IT Educational Pvt Ltd