Professional Documents
Culture Documents
CF Munotes
CF Munotes
Practical No – 1
Steps:
2. Select the source you want to make an image of and click Next.
munotes.in
02
If you select Logical Drive to select a floppy or CD as a source, you can check the Automate
multiple removable media box to create groups of images. Imager will automatically
increment the case numbers with each image, and if something interrupts the process, you
may assign case number manually.
3. Select the drive or browse to the source of the image you want, and then click Finish.
munotes.in
02
You can compare the stored hashes of your image content by checking the Verify
images after they are created box. If a file doesn’t have a hash, this option will
generate one.
You can list the entire contents of your images with path, creation dates, whether files
were deleted, and other metadata. The list is saved in a tab-separated value format
5. Select the type of image you want to create, and then click Next.
Note: If you are creating an image of a CD or DVD, this step is skipped because all
CD/DVD images are created in the IsoBuster CUE format.
The raw image type is not compressed. If you select the Raw (dd) type, be sure to have
adequate space for the resulting image.
If you select SMART or E01 as the image type, complete the fields in the Evidence Item
Information dialog, and click Next.
Raw (dd): This is the image format most commonly used by modern analysis tools. These
raw file formatted images do not contain headers, metadata, or magic values. The raw format
typically includes padding for any memory ranges that were intentionally skipped (i.e.,
device memory) or that could not be read by the acquisition tool, which helps maintain spatial
integrity (relative offsets among data).
SMART: This file format is designed for Linux file systems. This format keeps the disk
images as pure bitstreams with optional compression. The file consists of a standard 13-byte
header followed by a series of sections. Each section includes its type string, a 64-bit offset to
the next section, its 64-bit size, padding, and a CRC, in addition to actual data or comments,
munotes.in
if applicable.
E01: this format is a proprietary format developed by Guidance Software’s EnCase. This
format compresses the image file. An image with this format starts with case information in
the header and footer, which contains an MD5 hash of the entire bit stream. This case
information contains the date and time of acquisition, examiner’s name, special notes and an
optional password.
AFF: Advance Forensic Format (AFF) was developed by Simson Garfinkel and Basis
Technology. Its latest implementation is AFF4. The goal is to create a disk image format that
02
does not lock the user into a proprietary format that may prevent them from being able to
properly analyze it.
6. In the Image Destination Folder field, type the location path where you want to save the
image file, or click Browse to find to the desired location.
Note: If the destination folder you select is on a drive that does not have sufficient
free space to store the entire image file, FTK Imager prompts for a new destination
folder when all available space has been used in the first location.
7. In the Image Filename field, specify a name for the image file but do not specify a file
extension.
8. In the Image Fragment Size field, specify the maximum size in MB for each fragment of
the image file. The s01 format is limited by design to sizes between 1 MB and 2047 MB (2
GB). Compressed block pointers are 31- bit numbers (the high bit is a compressed flag),
which limits the size of any one segment to two gigabytes.
Tip: If you want to transfer the image file to CD, accept the default fragment size of
650 MB.
12. After the images are successfully created, click Image Summary to view detailed file
information, including MD5 and SHA1 checksums.
Note: This option is available only if you created an image file of a physical or logical
drive.
Now select the source evidence type as physical drive, logical drive or image file. We have
selected image file and click on next.
Select virtual drive image & click on open option. Select the source path and click on finish.
02
Now select Evidence Tree and analyze the virtual disk as physical disk.
Similarly to add raw image select again add evidence item and click on image file and click
on open option.
Click on finish.
Now raw image will be added as physical drive to analyze.
02
Practical No – 2
Steps:
Enable USB Write Block in Windows 10, 8 and 7 using registry
1. Press the Windows key + R to open the Run box. Type regedit and press Enter.
2. This will open the Registry Editor. Navigate to the following key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
3. Right-click on the Control key in the left pane, select New -> Key.
4. Name it as StorageDevicePolicies.
02
5. Select the StorageDevicePolicies key in the left pane, then right-click on any empty space
in the right pane and select New -> DWORD (32-bit) Value. Name it WriteProtect.
7. The new setting takes effect immediately. Every user who tries to copy / move data to USB
devices or format USB drive will get the error message
“The disk is write-protected”.
8. We can only open the file in the USB drive for reading, but it’s not allowed to modify and
save the changes back to USB drive.
So this is how you can enable write protection to all connected USB drives. If you want to
disable write protection at a later time, just open Registry Editor and set the WriteProtect
value to 0.
02
10. Select the USB drive folder by browsing and click next & Finish
You can compare the stored hashes of your image content by checking the Verify
images after they are created box. If a file doesn’t have a hash, this option will
generate one.
You can list the entire contents of your images with path, creation dates, whether files
were deleted, and other metadata. The list is saved in a tab-separated value format
Select the type of image you want to create, and then click Next
munotes.in
02
Practical No – 3
Aim: Forensics Case Study:
- Solve the Case study (image file) provide in lab using Autopsy
Steps:
1. Start Autopsy
5. Select Data Source( here a previously made image file of a USB is selected)
6. Select all ingest modules
02
7.Wait for Data source to process and be added to local database. Click Finish
8. Now Autopsy window will appear and it will analyzing the disk that we have selected
munotes.in
02
9. All files will appear in table tab select any file to see the data.
10. Expand the tree from left side panel to view the files and then expand the deleted files
node
11. To recover the file, go to view node-> Deleted Files node , here select any file and right
click on it than select Extract Files option.
munotes.in
02
munotes.in
02
14. Click on Generate Report from autopsy window and Select the Excel format and click on
next
02
Now Report is Generated So click on close Button, We can see the Report on Report Node.
Double click on the excel file and open it to view the report
02
Practical No – 4
Steps:
1. Open Wireshark and click on Ethernet.
2. Now go on browser and open any unsecured website i.e www.razorba.com and perform
some activity on the website.
3. Now come back to Wireshark and enter http in the search bar.
02
munotes.in
02
Practical No – 5
Aim: Analyze the packets provided in lab and solve the questions using Wireshark:
-What web server software is used by www.snopes.com?
-About what cell phone problem is the client concerned?
-According to Zillow, what instrument will Ryan learn to play?
-How many web servers are running Apache?
-What hosts (IP addresses) think that jokes are more entertaining when they are
explained?
Steps:
What web server software is used by www.snopes.com?
5. Click any of the http packet > right click> Follow> TCP Stream
munotes.in
02
5. Run the saved file and you will get the result.
munotes.in
02
munotes.in
02
4. Beside IPv4 the number 21 shows that there are 21 web servers running on apache.
What hosts (IP addresses) think that jokes are more entertaining when they are
explained?
Practical No – 6
Aim: Using Sysinternals tools for Network Tracking and Process Monitoring:
-Check Sysinternals tools
-Monitor Live Processes
-Capture RAM-Capture
-TCP/UDP packets
-Monitor Hard Disk
-Monitor Virtual Memory
-Monitor Cache Memory
Steps:
1) Check Sysinternals tools
Windows Sysinternals tools are utilities to manage, diagnose, troubleshoot, and monitor a
Microsoft Windows environment
munotes.in
02
Click on capture.
02
munotes.in
02
Practical No – 7
Steps:
1. Open AccessData FTK Imager. Click on File > Create Disk Image.
munotes.in
02
7. Open the Forensic toolkit and click on file > new case.
02
9. Click on next.
munotes.in
02
13. Click on Add Evidence > Acquired Image of Drive > Continue.
munotes.in
02
19. In the left panel you can see all the recovered files.
20.Click on the Deleted file tab-> Right click on any deleted file to export it
02
21.Browse and choose the destination folder to export the deleted file
02
Practical No – 8
Aim: Acquisition of Cell phones and Mobile devices
Steps:
1. Download mobiledit forensic tool in mobile.
2. Open Mobiledit tool in PC.
3. Click on connect.
02
4. Connect your mobile device to the system. Click on phone > next.
6. Open the mobiledit tool in phone and click on the type of connection (i.e Wifi) > Copy the
IP address and enter it in the PC and click next.
02
8. Click on next.
02
munotes.in
02
Practical No – 9
Aim: Email Forensics
- Mail Service Providers
- Email protocols
- Recovering emails
- Analyzing email header
Reputation - Your business email service provider needs to have a good reputation.
Remember, your email address is one of the first pieces of information prospective clients
see.
Storage - When selecting an email service provider, keep in mind the amount of storage
space included with your account. You don't want to run out of space.
Types of Popular Email Service Providers are as follows:
1.Gmail:
One of the most popular and best email service providers, Gmail is used for personal and
business communications alike. According to statistics reported by TechCrunch in 2016, over
a billion people use Gmail.
Gmail has a good reputation and includes many advanced features such as the Undo Send
feature and Email Forwarding. Since this service is owned by search engine giant, Google,
naturally it includes a powerful search utility and filter system.
Google has also added strengthened security measures such as two-step verification and
powerful spam filters to make it less likely that your account is hacked or that you receive
junk messages. Finally, it integrates cleanly with popular productivity tools including Google
Calendar and Google Docs.
2. Outlook
Microsoft's Outlook.com email provider is a strong option if you're looking for the best email
provider. Statistics from Microsoft show that Outlook had over 400 million users in 2016.
This popular email package has the support and resources of tech giant Microsoft behind it.
Outlook.com offers advanced features such as Clutter, which finds emails that are likely of
low priority and separates them from your inbox. Another advanced Outlook.com feature is
the ability to Undelete, or recover an email after you've accidentally discarded a message.
Outlook integrates well with popular software including other Microsoft products.
3.iCloud Mail
iCloud email is a possible email choice if you frequently access your email package from
your Apple mobile device. Apple employs several security features to make sure that your
iCloud account is not compromised including two-step verification or two-factor
authentication. There's also a spam filter.
4. Yahoo Mail
Yahoo! was one of the early Internet companies, dating back to 1994. Yahoo! Mail is popular
with many users. In 2016, it was announced that the company was acquired by Verizon.
Despite the recent changes to Yahoo! ownership, you can still sign up for a Yahoo! Mail
account. Some Yahoo! Mail features you can benefit from if you choose it as your email
provider include:
Auto deletion of Trash messages after 90 days
02
5. AOL Mail
AOL is another early Internet company. In the 1980s the company was known as America
Online. It was purchased by Verizon in 2015. The email component of the organization
remains a popular and strong service that has earned its place on this list of the best email
services.
Key AOL Mail features include advanced spam filters and virus protection. It's also known
for the ability to personalize your email address with the MyAddress feature that lets you
select your own email domain name.
6. Zoho Mail
Although Zoho Mail has several premium levels available, there is also a free level available
that allows you to have up to 25 users. For many small businesses, this will be enough—so
we have included the email service on our list of the best free email providers.
With the free level of Zoho Mail, you are limited to 5 GB of storage per user. It does include
antivirus protection and spam filtering. This email service integrates with other Zoho
productivity tools such as calendar, tasks, and notes.
Email Protocols
E-mail Protocols are set of rules that help the client to properly transmit the information to or
from the mail server
The most commonly used Email protocols on the internet - POP3, IMAP and SMTP. Each
one of them has specific function and way of work.
POP3
Post Office Protocol version 3 (POP3) is a standard mail protocol used to receive emails from
a remote server to a local email client. POP3 allows you to download email messages on your
local computer and read them even when you are offline. Note, that when you use POP3 to
connect to your email account, messages are downloaded locally and removed from the email
server. This means that if you access your account from multiple locations, that may not be
the best option for you. On the other hand, if you use POP3, your messages are stored on
your local computer, which reduces the space your email account uses on your web server.
By default, the POP3 protocol works on two ports:
Port 110 - this is the default POP3 non-encrypted port
Port 995 - this is the port you need to use if you want to connect using POP3 securely
02
IMAP
The Internet Message Access Protocol (IMAP) is a mail protocol used for accessing email on
a remote web server from a local client. IMAP and POP3 are the two most commonly used
Internet mail protocols for retrieving emails. Both protocols are supported by all modern
email clients and web servers.
While the POP3 protocol assumes that your email is being accessed only from one
application, IMAP allows simultaneous access by multiple clients. This is why IMAP is more
suitable for you if you're going to access your email from different locations or if your
messages are managed by multiple users.
By default, the IMAP protocol works on two ports:
Port 143 - this is the default IMAP non-encrypted port
Port 993 - this is the port you need to use if you want to connect using IMAP securely
SMTP
SMTP stands for Simple Mail Transfer Protocol. It was first proposed in 1982. It is a standard
protocol used for sending e-mail efficiently and reliably over the internet. Simple Mail
Transfer Protocol (SMTP) is the standard protocol for sending emails across the Internet.
By default, the SMTP protocol works on three ports:
Port 25 - this is the default SMTP non-encrypted port
Port 2525 - this port is opened on all SiteGround servers in case port 25 is filtered (by your
ISP for example) and you want to send non-encrypted emails with SMTP
Port 465 - this is the port used if you want to send messages using SMTP securely
2. When the AccessData FTK Startup dialog box opens, click Start a new case, and then click
OK.
3. In the New Case dialog box, type your name for the investigator name, and type the case
number and case name. Click Browse, navigate to and click your work folder, click OK, and
then click Next.
4. In the Case Information dialog box, enter your investigator information, and then click
Next.
5. Click Next until you reach the Refine Case - Default dialog box, shown in Figure below.
6. Click the Email Emphasis button, and then click Next.
7. Click Next until you reach the Add Evidence to Case dialog box, and then click the Add
Evidence button.
8. In the Add Evidence to Case dialog box, click the Individual File option button (see Figure
below), and then click Continue.
9. In the Select File dialog box, navigate to your work folder, click the Jim_shu’s.pst file, and
then click Open.
10. In the Evidence Information dialog box, click OK.
02
02
munotes.in
02
02
11. When the Add Evidence to Case dialog box opens, click Next. In the Case summary
dialog box, click Finish.
12. When FTK finishes processing the file, in the main FTK window, click the E-mail
Messages button, and then click the Full Path column header to sort the records (see Figure
below).
02
1. Click the E-Mail tab. In the tree view, click to expand all folders, and then click the
Deleted Items folder
02
2. Right-click Message0010 in the File List pane and click Export File. In the Export Files
dialog box, click OK
02
3. Open the Export folder to view the Email Files, Open the HTML file in browser
.
02
1. Right Click the file type and Rename it to HTML and open in browser to view header
information
02
Practical No – 10
Aim: Web Browser Forensics
-Web Browser working
-Forensics activities on browser
-Cache / Cookies analysis
-Last Internet activity
Steps:
1. Open BrowserHistoryExaminer.
munotes.in
02
11. To Create Reports. Click on file > Report and save the report as pdf or html page.
munotes.in
02
munotes.in