Acquisition and Introduction to Autopsy

The following questions all work by manipulating an USB drive which is virtually connected to your VIRTUAL computer. Press the button below to connect the USB drive to your VIRTUAL PC. You do not need a real usb drive, and this has nothing to do with your own computer, as this only relates to your virtual computer. To disconnect the USB stick, go to the end of this section and click the appropriate button.

Press the button below to mount the USB Drive.

Before we start acquisition we should create hash signature of the usb drive (/dev/loop100) The purpose of it is to verify that the content of the forensic image is exactly the same as the usb.

Create MD5 and SHA256 hash signature of the USB drive.
MD5 hash signature:
SHA256 hash signature:

Guymager is a forensic imaging tool with a graphical interface. The forensic imager was designed to support different image file formats, to be most user-friendly and to run fast. It has a high speed multi-threaded engine using parallel compression for best performance on multi-processor and hyper-threading machines.

Features include:

• Fast due to multi-threaded, pipelined design and multi-threaded data compression
• Easy user interface available in different languages
• Generates flat (dd), EWF (E01) and AFF images, supports disk cloning
• Extended acquisition info file

Using VNC, go to MAIN MENU > Forensic Tools > Guymager

In the case of Guymager, the usb device should appear as /dev/loop100. If it does not go to the Devices menu and select "add special device", and then in the box named "File name:" below the file browser window type "/dev/loop100" and then Open to add it.

Now select /dev/loop100 and right click on it and select "Acquire image".

Figure 1: Acquire Image

Fill in the information as shown and press "Start".

Figure 2: Select Image Format

Look into the usbsuspect.info file and verify the acquisition. Check that the hashes shown match the hashes you have generated earlier.

In order for autopsy to be able to access this file, the user "caine" needs to own the file. Guymager runs as root, so it is currently owned by root. You should run:

  sudo chown caine.caine /home/caine/usbsuspect.*
  

Now that you have acquired the image of the USB drive, you will want to analyse the image. You will use Autopsy 4 to analyse the image and show what Autopsy can offer. This is a chance for you to understand the basics of the software allowing you to know where you are able to find the data you need when conducting analyses.

Open Autopsy. Go to MAIN MENU > Forensic Tools > Autopsy 4. Choose "New Case" from the popup menu.

It will prompt up asking for a "Case Name". Give this the case name of Lab1 (case sensitive). "Base Directory" is where your case will be saved - choose HOME directory /home/caine. Leave everything else as it is. Click "Next".

Figure 3: Case Information

As this is your first case, make the case number 001. As the examiner, fill your full name in and then click "Finish". Autopsy will start creating a database of your image. This may take a couple of minutes.

Figure 4: Operational Information

Once created, it will ask you to select your data source. Click "Disk Image and VM file" to add your disk image.

Figure 5: Data Source

Figure 6: Select Data Source

Choose the modules that you want to ingest. For this lab Select All. Click on Keyword Search and select all available keyword lists. Click "Next", then "Finish".

Figure 7: Modules

Running all the ingest modules will take a few minutes. In the bottom right, watch the progress.

While you're waiting, Have a look at the Autopsy Quick start guide at: Autopsy User Guide. It gives you a brief explanation of the ingest modules and some example uses cases.

Once the ingestion is completed, you will see the interface as shown below. On the lefthand side is the "Tree View". It shows the saved results from the automated ingested modules you have selected. The "Result View" is on the top right, it shows the details after selecting something from the "Tree View". There will be options to choose to show different formats. On the bottom right there is the "Content View". It shows files in different formats and there are tabs to choose to view the file in different ways. To show data in this area, a file must be selected in the "Result View".

Figure 8: Autopsy View

Take some time to explore the different results in the tree and see what you can find.

For example, you should be able to see what files the suspect has deleted, and, in some cases, you will be able to extract the file and view it if you want. If you navigate to "Extracted Content", it will show you web contents which the suspect has been browsing. Have a look at each one and click into a URL. It will show you a lot of information. Look at the highlighted area, explore this area yourself. For example, look at "YouTube".

Figure x: Autopsy View

Figure x: Autopsy View

Answer the following questions. This is a treasure hunt - it may take you a while to find the information, but while doing this you will become familiar with Autopsy. Remember to note how you found the answer. After you're done, check your answers with your tutors. If you're really stuck, get help.

1. How many deleted files were found by Autopsy?

2. There is one file with an "extension mismatch". What is the filename and path? (exclude image name and leading slash)

3. How many files contain EXIF metadata?

4. How many different cameras were they taken with? 6 - (Iphone 8, Minolta Dimage A2, HTC Desire 620, Nikon D2H, Samsung Galaxy S6, Cannon 1100d) 4 - (HTC Desire 620, Nikon D2H, Samsung Galaxy S6, Cannon 1100d) 3 - (Minolta Dimage A2, HTC Desire 620, Nikon D2H)

5. Find the photo which shows part of a keyboard. What is the filename, and when and where was the photo taken (latitude/longitude and address/description)? Test.jpg. 2017-01-31 14:51:45 55.932510361111106, -3.2146179444444445 35-41 Colinton Road, Edinburgh Achmelvich.jpg. 2018-06-04 13:15:10 54.597286, -5.930120, University Rd, Belfast BT7 1NN japan_koyTo.jpg. 2018-06-04 16:26:32 35.689487, 139.691711, 4 Chome Kamisunacho, Tachikawa, Tokyo 190-0032, Japan

6. Given the identified location, in which public building might the photo have been taken? Queen's University Belfast ENU Merchiston Campus Chome Kamisunacho

7. What browser did the suspect use? Oracle Firefox Chrome

8. What program was downloaded from the internet and where was it stored? Dropbox C:\Users\Kelvin\Downloads Steam C:\Users\Kelvin\Documents Atom C:\Users\Kelvin\Desktop

9. When did the user search for "how to stay off grid"?(FORMAT:YYYY-MM-DD 00:00:00 BST)

10. Following this web search, the user accessed a related website. What is its URL?

11. Which email address was used for webmail? How many unread messages were in the inbox when it was first accessed? johnreebus1923@gmail.com 1 messages (goes down to 0 later) carloscroos8080@gmail.com 3 messages (goes down to 2 later) bobandalice1503@gmail.com 0 Unread