CVF 1065 Introduction to Computer Forensics & Investigations - FAT File System Case Practice Lab for

downloaded from

Scholarfriends

https://scholarfriends.com Downloaded by: writerforacademic@gmail.com | https://scholarfriends.com/singlePaper/314709/cvf-1065-introduction-to-computer-forensicsinvestigations-fat-file-system-case-practice-lab-for Distribution of this document is illegal.

Week 6 Practical Assignment CVF 1065 Introduction to Computer Forensics & Investigations FAT File System Case Practice Lab for FAT (100 Points)

CASE INFORMATION You are a forensic examiner for a regional counter-terrorism unit. An agent brings you a floppy disk they seized during a search warrant earlier this morning at a residence belonging to a suspected Animal Liberation Front member, Brian Hovan. When the agents entered the house, Brian was seen frantically using his laptop and taking out a floppy disk from his disk drive and throwing it across the room into a wall. Agents said he threw it so hard it almost broke, but still was intact. The screen that was up on the laptop had a Windows Explorer up for the A: drive with several Shakespeare pictures and text files visible. No other files were visible.

Agents told you that they have been receiving lots of “chatter” recently from informants in the Animal Liberation Front about a major planned attack somewhere on the West Coast. Agents said the exact location is still unknown but they feel the attack is imminent. You are requested to perform a forensic examination on the seized disk and report all findings to the field agents.

NOTE: The image file "FATLAB1.img" is to be used for this exercise. FTK Imager should be used to conduct the examination. This program is available on D2L. The answers to these questions should be included below each question and this entire finished assignment submitted to the Chapter 6 drop box.

Make sure to put your name on your sheet!

File (Compressed) FATLAB1.zip File (Decompressed)

835dcc3faae9747a36ba922208d18c21 FATLAB1.dd b0c0ec6a34e747ab63a4eed50a8d460d

Instructions: Open the FATLAB1.img and confirm its MD5 hash: b0c0ec6a34e747ab63a4eed50a8d460d and include a screen shot of your verification hash. The answer the following questions:

PART 1 – DEVICE INFORMATION – 4 Points Each 1. What file system is used on this image? Fat12

1

This study source was downloaded by 100000861003072 from CourseHero.com on 04-24-2023 10:43:22 GMT -05:00

https://www.coursehero.com/file/29462931/Week-6-Practical-Assignment-CVF1065-02-Jack-Bullock-NEW2017-docx/

2. What type of media do you suspect was used? .txt and .jpg 3. What is the Volume Label?

“SECRET” 4. What is the Volume Serial Number?

7C55-A06A 5. How many bytes per sector are there on this image? What is the Sector Count?

Bytes per sector: 512 Sector Count: 2880 6. How many copies of the FAT are there?

2

PART 2 - SOLVING THE MYSTERY – 4 Points Each 7. What is the symbol of the mystery group? (include a screenshot of their symbol)

8. Name the file that has a created date and time stamp of 03-24-2010 at 3:19:21.

Contacts 9. Name the folders you located and if they are deleted or not.

Located “Contacts” and “Dam”. Both were deleted.

10. What is the creation date and time for the file ROMEO_~1.JPG? The only file I can find that has Romeo in its title is “Romeo_and_juliet long file name picture.jpg”. The creation date is 10/27/2008 4:43:32 PM. 11. What’s the locker number at the Amtrak Station?

I can’t find any file that has anything to do with an Amtrak Station or a locker…

2

This study source was downloaded by 100000861003072 from CourseHero.com on 04-24-2023 10:43:22 GMT -05:00

https://www.coursehero.com/file/29462931/Week-6-Practical-Assignment-CVF1065-02-Jack-Bullock-NEW2017-docx/

12. What are the first 6 bytes of the file header to the !dam6-a.jpg?

FF D8 FF E0 00 10 13. How many bytes (file size) is the file KINGLEAR.JPG? 18,158

14. What is the MD5 hash value for the file HAMLET.JPG? dcf9e0eac081f07e8378a1af208b6aa2 15. The conspirators are planning on planting a device. Where do they plan on planting it?

Generators at the Hover Dam. 16. What are the real names and phone numbers for Luke Skywalker, Hans Solo, Yoda and ALF? Luke Skywalker - Brian Hovan 912-435-9837 Hans Solo - Ted Markstis 912-345-8447 Yoda - Quin Bellows 912-459-2039 ALF Cell 912-938-0049

17. Who in the group could possibly be a “snitch” according to what you found?

Yoda (Quin Bellows) 18. Where is this incident planned to take place?

Hover Dam 19. How do you know this? (referring to question 16) Our Trip.doc told of the whole plan including where and how it was going to go down along with Yoda possibly being a snitch.

20. What is being planned according to the evidence you found? Detail the pieces of evidence you found to come to this conclusion. Remember, the investigators need all the information you find put together for them. THIS SHOULD BE 1-2 PARAGRAPHS IN LENGTH. (19 Points)

3

This study source was downloaded by 100000861003072 from CourseHero.com on 04-24-2023 10:43:22 GMT -05:00

https://www.coursehero.com/file/29462931/Week-6-Practical-Assignment-CVF1065-02-Jack-Bullock-NEW2017-docx/

A terroristic attack on the Hover Dam. This is supported because of the evidence found on the floppy disk. Such as the pictures of the dam, their logo, the map to the dam, and the explosives. We also have all the suspects names and phone numbers corresponding to their code names. The final and largest piece of evidence found was the ‘Our Trip.doc which tells us that they plan on planting the explosives on the generators to cause the most damage to the dam. It also tells us that they plan on meeting at the View Park in the Lake Mead Nation Recreation Area at 2pm on the day they carry out their plan. It also mention that Luke as been seeing a lot of guys in suits around him lately and that Yoda may have been talking to much.

4

This study source was downloaded by 100000861003072 from CourseHero.com on 04-24-2023 10:43:22 GMT -05:00

https://www.coursehero.com/file/29462931/Week-6-Practical-Assignment-CVF1065-02-Jack-Bullock-NEW2017-docx/ Powered by TCPDF (www.tcpdf.org)