Introduction to Single Purpose Forensic Tools

GIAC Certified Forensic Examiner Objectives:

Fundamental Digital Forensics

  • The candidate will demonstrate an understanding of forensic methodology, key forensic concepts, identifying types of evidence on current Windows operating systems and be familiar with the structure and composition of modern Windows file systems.

Foundations of Digital Forensics Acquisitions

  • The candidate will demonstrate an understanding of the methodologies and tools used to collect and process digital forensic evidence.

Overview

This lab is part of a series of lab exercises intended to support courseware for Forensics training. The development of this document is funded by the Department of Labor (DOL) Trade Adjustment Assistance Community College and Career Training (TAACCCT) Grant No. TC-22525-11-60-A-48.

Hashing is the process of taking in a stream of plain text and transforming the data into a hashed text using a hashing algorithm. You can use the hash to make sure that a message was not modified during transmission. That hash can make sure that the disk image was not tampered with. Hashed images are used in forensics investigations. Hashing is also used on files, passwords, and other pieces of data.

In this lab, you are going to image a disk and create a hash of that disk, verify integrity using file hashing tools, use Foremost to carve and recover deleted files from a disk and use a hex editor to review files.

OUTCOMES:

In this lab, you will learn to:

  1. Use file hashing tools to verify integrity
  2. Mount a partition with deleted files and folders
  3. Use Foremost to carve files
  4. Use a HEX editor
Courses

Key terms and descriptions

Foremost
Foremost is a file carving utility that allows you to carve files that were "deleted" out of a disk image or a mounted partition. Foremost was created by Jesse Kornblum and is available for download from this link: http://foremost.sourceforge.net/
Hexadecimal
A numbering system where numbers 0–9 and letters A–F are used. Also known as base 16, hexadecimal is commonly used in computer forensics and networking.
HEX Editor
A Graphical User Interface (GUI) or command line tool that can be utilized to analyze the hexadecimal code of files. File headers have hexadecimal signatures that are unique to a particular type of file. For example, a JPEG file has a file signature of JFIF.
md5sum
A command that is used from the terminal to verify an MD5 hash. Message Digest 5 is a 128-bit hashing algorithm that aids forensic examiners by “proving” that the copy of the media they are working on is "equivalent" to the original.
sha1sum
A command that is used from the terminal to verify a sha1 hash. Secure Hash Algorithm is a 160-bit hashing algorithm that aids forensic examiners by “proving” that the copy of the media they are working on is "equivalent" to the original.