Lab Notes Sheet:
Part I - List Steps taken
Incorporate screen shots and information from your notes into your final report.
4. Write down the files in the projects folder:
6. Write down the IP address displayed for the Student First VM
7. Take a screen shot of the output from using the $ losetup-1 command
8. Take a screen shot of the results from using $ gnome-disks command
11. Take a screen shot of the results from using $ sudo mount command
Write down the complete path displayer in your Terminal Window
Type: $ mount | grep /dev/loop
Write down your results. What does this give us? Same result?
13. Take screenshot of the files in the downloads directory after using the $ ls command
14. Take a screenshot of your hash value. Does your hash value match the instruction hash value?
Part II
3. Take a screenshot of your hash value after making the forensic copy. Does your hash value match the instruction hash value?
Part III of Exercise II - No screenshot required
Part IV -
5. Take a screenshot of the desktop of you lab VM showing the files that were created
6. Record the hash values contained in the text file memecapture.ad1 text file.
Part V -
7. Provide screenshots of the results of your commands.
8. Provide screenshots of the results of your commands.
Report Writing and Instructions -
The grade for your digital forensics imaging task report, will be determined by the number and quality of tasks you perform according the project instructions, documentation of screen shots, answers to questions presented within the project, additional announcement instructions provided by your instructor, incorporation of applicable checklists used in the course, the structure and organization of your report format minimally incorporating suggested in report writing examples, templates or outlines provided in the course as follows :
T1 - Imaging Project Report Template
Note: Use I, II, III, IV and VI for your imaging lab report
Cover Page
Title: Digital Forensics Examiners Report
Project No.
Name:
I. Introduction - How you received the case, etc.
II. Task Summary
III. File Details
IV. Steps Taken
V. Exhibits- Not Applicable
VI. Chain of Custody -
VII. Opinions - Not Applicable
Attached to your report will be a separate sheet of brief Notes listing the following:
1. list dates and times for your work
2. list your answers to project questions
3. list tasks performed/completed in the project
4. list observations
5. note discoveries
6. document relevant analysis, etc.
Note: Your notes will be used to the summary, steps taken, notable items, analysis, opinions and exhibits referenced in you imaging project report or case report.
Take a screenshot showing the icon disappears after the disk volume is unmounted.
Your Forensic Examiners Report should be written using the following format:
REPORT WRITING FORMAT -
Digital Forensics Examiners Report - Imaging Project Only
I. Introduction - 1st paragraph
(State how you got the case and tasks you were requested to perform or examine
a. Who or where you obtained case file information from
b. Describe the purpose of you task or examination (e.g. to image a hard drive for digital forensics examination; search for evidence of illegal activity, etc.)
II. Examination Summary - 1-3 paragraphs
(Brief Summary/Overview of the requested task(s) you completed in and imaging only request; or in a case investigation briefly summarize the most important evidence that you found in relationship to the case investigation)
III. File Details (Important Files Are Highlighted) -
* bullet point most important files you worked with in an imaging only task In Case Investigation
* bullet point most important files you worked with (Note/List top 5 files, or top 10 files, etc. you found that are important to the case)
* label photos or evidence details w/ a short caption e.g. this photo contains an image of ... ;or e.g. photo ace.jpg contains an image of a wrench
IV. Steps Taken (Explain How Examination Was Conducted)
Example:
A forensic image of the hard disk was made using FTK Imager
A checksum was performed on the hard disk and an MD 5 hash was generated
The hard drive was examined using Linux Commands, Encase 6.0.
A Forensics Examiners report was completed for the hard disk examination, to image the drive
V. Exhibits (List Exhibits by File Type Documents, Images, RAR etc.)
Exhibits 1-5 contain recovered text file documents obtained from the hard disk
Exhibits 6-10 contain recovered image files obtained from the hard disk
Exhibit 11 contains email messages obtained from the hard disk
VI. Chain of Custody (Document where & how media obtained & processed)
"The Modern hard disk No. LRDP102839 was received by Fed Ex Shipping No. 67201732 and stored in the locked evidence bin/drawer #6.Chain of custody form was completed.
A forensic image of the original hard disk forensic was made and the original was returned to evidence bin/drawer #1 for safekeeping.
An examination was conducted on the forensic hard disk image working copies.
The original Modern hard disk No. AD42783 was returned to the Daylight Company by FED Ex Shipping No. XYT42071 after completion of the examination.
All files and exhibits and the examination report are contained in " Daylight Examination Folder" on a CD labeled Daylight Examination Case No. 7632019.
VII. Opinions (State your opinion based upon what you found and why it appears to be important for the client purposes, to the investigation or the task assigned)
It is my opinion that .... e.g. the recovered photos of broken glass on the showroom floor is consistent with unauthorized access after normal business hours, or; is inconsistent with a malware intrusion, or; is consistent with the user's placement of the unlicensed software on the desktop, or: the bike photos appear to be what the investigator is looking for but additional follow up may be needed to determine the actual bike owner's identity, and whether the type, color and model are consistent with the description of the missing bike in the theft case.