Practical Lab

[Link] Forensics Investigation Process and Recognizing File Systems & Hard Drives
(Using DiskGenius)
Aim

To perform a computer forensic investigation by identifying storage devices, creating a disk image,
recognizing file systems, and analyzing hard drives using forensic tools such as DiskGenius in Kali Linux.

Implementation Procedure

Step 1: Identify Storage Devices

First identify the available hard drives and partitions.

lsblk

This command lists all connected storage devices such as HDD, SSD, and USB drives.

Step 2: Create a Forensic Disk Image

To avoid modifying the original data, create a forensic image of the disk.

sudo dd if=/dev/sdb of=/home/kali/[Link] bs=4M status=progress

Step 3: Generate Hash Value for Integrity

Hashing ensures that the evidence is not modified.

sha256sum [Link]

The generated hash value is stored for verification.

Step 4: Recognize File System

Check the file system type of the storage device.

file -s /dev/sdb1

Example outputs may include: NTFS,FAT32,EXT4

Step 5: Mount Disk Image (Read Only)

Mount the disk image safely for analysis.

sudo mount -o ro,loop [Link] /mnt/forensic

Now investigators can analyze files inside /mnt/forensic.

Step 6: Recover Deleted Files

Use forensic tools to recover deleted data.

foremost -i [Link] -o recovered_files

Recovered files will be stored in the recovered_files directory.

Detect File Systems
[Link] of Information Gathering and Regeneration, Implementation of Recovering
Deleted Files and Partitions (Using Cute Recovery Free Tool)
Aim

To perform information gathering and recover deleted files and partitions from a storage device using Cute
Recovery Free Tool.

Implementation Procedure

Step 1: Connect the Storage Device

Insert the USB drive or hard disk containing deleted files into the system.

Check the device using:

lsblk

This command lists all available disks and partitions.

Step 2: Launch Cute Recovery Tool

Open Cute Recovery Free Tool from the system.

Steps:

1. Start the Cute Recovery software.

2. Select the disk or partition where files were deleted.

3. Click Scan to analyze the storage device.

The tool scans the disk sectors to locate deleted data.

Step 3: Scan the Disk

The software performs a deep scan to identify lost files and deleted partitions.

During scanning it detects:

• Deleted files

• Lost partitions

• Corrupted file systems

Step 4: Preview Recoverable Files

After scanning, the tool displays a list of recoverable files such as:

• Documents

• Images

• Videos

• System files

Users can preview files before recovery.

Step 5: Recover Deleted Files

Select the required files and click Recover.

Choose a different storage location to save recovered data to avoid overwriting existing data.

Step 6: Partition Recovery

If partitions are deleted:

1. Select Partition Recovery option.

2. Scan the disk.

3. The tool detects lost partitions.

4. Select the partition and restore it.

Example Command for Information Gathering

sudo fdisk -l

This command displays disk partitions and helps identify missing or damaged partitions.
[Link] Forensics using Open-Source Intelligence (Using Maltego)

Aim

To perform Web Forensics using Open-Source Intelligence (OSINT) to gather information about websites,
domains, and related entities using the Maltego tool.

Implementation Procedure

Step 1: Install Maltego

In Kali Linux install Maltego using:

sudo apt update

sudo apt install maltego

Step 2: Launch Maltego

Open Maltego from the terminal:

maltego

Login with a Maltego account and open a new graph.

Step 3: Add a Target Domain

1. Drag the Domain Entity from the entity palette.

2. Enter the target domain name (example: [Link]).

3. Right-click the domain to run transforms.

Step 4: Run OSINT Transforms

Run different transforms to collect information.

Examples:

• To DNS Name → DNS Records

• To Website → IP Address

• To Domain → WHOIS Information

These transforms collect publicly available data from the internet.

Step 5: Analyze Collected Information

Maltego displays relationships between entities such as:

• Domains

• IP addresses

• Email addresses

• DNS servers

• Social media accounts

Step 6: Investigate and Document Findings

The investigator analyzes the results to identify:

• Website ownership

• Associated servers

• Related domains

• Possible suspicious connections

The collected information can be exported for forensic reports.

[Link] Forensics (Manual and Using Tools – Using Examiner Browser History)

Aim

To perform Web Forensics by manually analyzing and examining browser history using forensic tools to
identify user activities on a system.

Implementation Procedure

Step 1: Identify Browser History Location

Locate where browser history files are stored in the system.

Example for Google Chrome (Linux):

cd ~/.config/google-chrome/Default/

Step 2: View Browser History Manually

Use commands to examine browser history.

Example:

sqlite3 History

To view visited URLs:

SELECT url, title, last_visit_time FROM urls;

This displays the websites visited by the user.

Step 3: Use Examiner Browser History Tool

Open the Browser History Examiner tool.

Steps:

1. Launch the tool.

2. Select the browser profile folder.

3. Load the History database file.

4. The tool scans and extracts browsing activity.

Step 4: Analyze User Activity

The tool provides information such as:

• Visited websites

• Downloaded files

• Search keywords

• Visit timestamps

• Browser sessions

This helps investigators understand user behavior.

Step 5: Generate Report

The extracted data can be exported as:

• HTML report

• CSV file

• Forensic report

This report can be used as digital evidence.

[Link] Case Investigation using Autopsy

Aim

To perform digital forensic investigation on a storage device using Autopsy to identify and analyze digital
evidence.

Implementation Procedure

Step 1: Install Autopsy

Install Autopsy in Kali Linux using the terminal.

sudo apt update

sudo apt install autopsy

Step 2: Start Autopsy

Run the Autopsy tool.

autopsy

The terminal will display a local host address.

Open the link in the browser.

Example:

[Link]

Step 3: Create a New Case

1. Click Create New Case

2. Enter:

o Case Name

o Description

o Investigator Name

3. Click Next to continue.

Step 4: Add Data Source

1. Select Add Data Source

2. Choose Disk Image or VM File

3. Browse and select the forensic image file (example: [Link]).

4. Click Next.

Step 5: Configure Ingest Modules

Enable analysis modules such as:

• File Type Identification ,Keyword Search ,Hash Lookup ,Web Artifact Analysis ,Email Parser

These modules automatically scan and analyze the data.

Step 6: Analyze Evidence

Autopsy displays the extracted information including:

• Deleted files ,Web history ,Email data ,Images and documents ,File metadata

Investigators examine these artifacts to identify suspicious activity.

Step 7: Generate Report

After analysis:

1. Select Generate Report

2. Choose report format (HTML / PDF).

3. Export the report containing all findings.

[Link] Memory Forensic using Access Data FTK Imager

Aim

To perform volatile memory forensics by acquiring and analyzing RAM data using the AccessData FTK
Imager tool.

Implementation Procedure

Step 1: Install FTK Imager

Download and install AccessData FTK Imager on the system.

Launch the application after installation.

Step 2: Start Memory Acquisition

1. Open FTK Imager.

2. Click File → Capture Memory.

3. The Memory Capture window will appear.

Step 3: Configure Memory Capture

In the memory capture window:

• Select the destination path where the memory image will be stored.

• Choose the file name for the memory dump.

Example:

memory_dump.mem

Step 4: Capture Volatile Memory

Click Capture Memory.

The tool will acquire the RAM contents of the system, including:

• Running processes

• Network connections

• Encryption keys

• Temporary data stored in memory

Step 5: Analyze Memory Image

After acquisition:

1. Open FTK Imager.

2. Select File → Add Evidence Item.

3. Choose Image File.

4. Load the captured memory image (.mem file).

Step 6: Examine Volatile Data

Investigators analyze the memory image to identify:

• Active processes

• Open files

• Network sessions

• Suspicious programs

This helps detect malware or unauthorized activities.

[Link] of Tracking & Investigating Email (Using OSForensics)

Aim

To track and investigate an email by analyzing email headers and related artifacts using the OSForensics
tool.

Implementation Procedure

Step 1: Install and Launch OSForensics

1. Download and install OSForensics.

2. Open the application from the system.

Step 2: Open the Email Investigation Tool

1. In OSForensics, select Email Investigation.

2. Choose Email Header Analyzer.

This tool helps analyze the routing information of the email.

Step 3: Obtain Email Header

Open the email in a mail client (such as Gmail or Outlook).

Steps:

1. Open the email message.

2. Click Show Original / View Source.

3. Copy the complete email header.

Example header information contains:

• Sender email address

• Receiver email address

• Mail servers used

• Date and time

Step 4: Analyze Email Header

Paste the copied email header into the OSForensics Email Header Analyzer.

Click Analyze.

The tool extracts important information such as:

• Sender IP address

• Mail server details

• Routing path of the email

• Possible spoofing indicators

Step 5: Track Email Source

Investigators examine the Received fields in the header to trace the origin of the email.

Example:

Received: from [Link] ([Link])

This indicates the server and IP address from which the email was sent.

Step 6: Document Findings

The investigator records the findings such as:

• Sender IP address

• Email server path

• Suspicious header fields

• Evidence of spoofing (if any)

This information can be used as digital forensic evidence.

[Link] and Security Investigation (COMODO or Network Firewall Analyzer)

Aim

To investigate network security events and monitor traffic using a Firewall tool (COMODO Firewall or
Network Firewall Analyzer) to detect suspicious activities and unauthorized access.

Implementation Procedure

Step 1: Install Firewall Tool

Download and install COMODO Firewall or Network Firewall Analyzer on the system.

Launch the firewall application after installation.

Step 2: Enable Firewall Protection

1. Open the firewall tool.

2. Enable Firewall Protection Mode.

3. Set the security level to Safe Mode or Custom Mode.

The firewall starts monitoring incoming and outgoing network traffic.

Step 3: Monitor Network Traffic

Open the Network Activity / Firewall Logs section.

The firewall displays information such as:

• Source IP address

• Destination IP address

• Port numbers

• Protocol type (TCP / UDP)

• Allowed or blocked connections

Step 4: Analyze Suspicious Connections

Check the firewall logs to identify:

• Unknown IP addresses

• Repeated connection attempts

• Unauthorized port access

• Suspicious applications requesting internet access

Example log entry:

Source IP: [Link]

Destination IP: [Link]
Port: 80
Action: Blocked
Step 5: Configure Firewall Rules

Create security rules to block or allow traffic.

Steps:

1. Go to Firewall Rules.

2. Select Add Rule.

3. Specify:

o Application or IP address

o Port number

o Action (Allow / Block)

This helps prevent unauthorized access.

Step 6: Generate Security Report

Export firewall logs or generate a security report showing detected threats and blocked connections.

These reports are useful for security analysis and investigation.

[Link] and Steg-analysis (Using Steganography V2.0)

Aim

To perform Steganography and Steg-analysis by hiding secret data inside an image and extracting it using
Steganography V2.0 tool.

Implementation Procedure

Step 1: Launch Steganography Tool

1. Install and open Steganography V2.0.

2. The application provides options for Encode (Hide Data) and Decode (Extract Data).

Step 2: Select Cover Image

1. Click Browse Image.

2. Select the image file that will be used to hide the secret message.

Example:

cover_image.jpg

This image will act as the carrier file.

Step 3: Hide Secret Message

1. Enter the secret message or file to be hidden.

2. Provide a password (optional) for security.

3. Click Encode / Hide Data.

Output example:

stego_image.png

Step 4: Save the Stego Image

The generated stego image contains the hidden message.

To a normal viewer, the image appears unchanged.

Step 5: Perform Steg-analysis

To retrieve the hidden message:

1. Open Steganography V2.0.

2. Select Decode / Extract Data.

3. Load the stego image.

4. Enter the password (if used).

5. Click Extract.

The hidden message or file will be displayed.

[Link] Analysis using Exif Reader Tools

Aim

To perform metadata analysis of image files using Exif Reader Tools to extract hidden information such as
camera details, date, location, and file properties.

Implementation Procedure

Step 1: Install ExifTool

Install the Exif metadata analysis tool in Kali Linux.

sudo apt update

sudo apt install exiftool

Step 2: Select an Image File

Choose an image file for metadata analysis.

Example:

sample_image.jpg

Step 3: Extract Metadata

Use the following command to display metadata information.

exiftool sample_image.jpg

This command extracts hidden metadata stored inside the image.

Step 4: Analyze Metadata Information

The output will display information such as:

• File Name

• File Size

• Image Resolution

• Camera Model

• Date and Time of Capture

• GPS Location (if available)

• Software used for editing

Example output:

Camera Model : Canon EOS 80D

Date/Time Original : 2024:02:15 10:35:20
GPS Latitude : 17.3850 N
GPS Longitude : 78.4867 E
Step 5: Investigate Evidence

Investigators analyze metadata to determine:

• When the image was taken

• Which device captured the image

• Whether the image was modified

• Location where the image was captured

This information is useful in digital forensic investigations.

[Link] Duplication and Modification Analysis (Using Folder Size 9 Software)

Aim

To analyze duplicate files and file modifications in a system using Folder Size 9 software.

Implementation Procedure

Step 1: Install Folder Size 9

Download and install Folder Size 9 software on the system.

Launch the application after installation.

Step 2: Select Target Folder

1. Open Folder Size 9.

2. Click Scan Folder.

3. Select the directory or drive to be analyzed.

Example:

C:\Users\Documents

The software scans the selected folder.

Step 3: Analyze Folder Size and Files

After scanning, the tool displays:

• List of folders and files

• File sizes

• File count

• Disk space usage

This helps identify large files and duplicate data.

Step 4: Detect Duplicate Files

Sort the files based on:

• File name

• File size

• File path

Files with identical size and name may indicate duplicate files.

Investigators can verify duplicates by comparing file properties.

Step 5: Analyze File Modification Details

Right-click a file and view Properties to examine:

• Creation date

• Last modified date

• File size changes

• File location

This helps identify recent modifications or suspicious file changes.

Step 6: Generate Analysis Report

The results can be exported as a report containing:

• Folder size statistics

• Duplicate file details

• Modified file information

This report is useful for forensic investigation and storage management.

[Link] Data Recovery using [Link]

Aim

To recover deleted or lost data from a mobile device using the [Link] Data Recovery tool.

Implementation Procedure

Step 1: Install [Link]

Download and install [Link] – Data Recovery software on the computer.

Launch the application after installation.

Step 2: Connect Mobile Device

1. Connect the mobile phone to the computer using a USB cable.

2. Enable USB Debugging on the mobile device.

Steps to enable USB Debugging:

• Go to Settings → About Phone

• Tap Build Number multiple times to enable Developer Options

• Enable USB Debugging

Step 3: Select Data Recovery Option

1. Open [Link] software.

2. Select Data Recovery module.

3. Choose the device type (Android or iOS).

Step 4: Scan the Mobile Device

Select the type of data to recover, such as:

• Contacts, Messages ,Photos ,Videos ,Call logs ,Documents

Click Start Scan.

The tool scans the mobile storage for deleted or lost data.

Step 5: Preview Recoverable Data

After scanning, the software displays the list of recoverable files.

Users can preview items such as:

• Images ,Messages ,Contacts ,Videos

Step 6: Recover Data

Select the required files and click Recover.

Choose a location on the computer to save the recovered data.

[Link] Forensics using Volatility (Volatility Workbench)

Aim

To perform memory forensic analysis by examining a memory dump using the Volatility Framework
(Volatility Workbench) to identify running processes and suspicious activities.

Implementation Procedure

Step 1: Install Volatility

Install the Volatility framework in the system.

sudo apt update

sudo apt install volatility

Step 2: Identify Memory Profile

Determine the operating system profile of the memory image.

volatility -f memory_dump.mem imageinfo

This command provides details such as:

• Suggested profile

• Operating system

• Kernel version

Example output:

Suggested Profile(s): Win7SP1x64

Step 3: List Running Processes

Display the list of processes running at the time the memory image was captured.

volatility -f memory_dump.mem --profile=Win7SP1x64 pslist

This shows:

• Process ID (PID) ,Process name ,Parent process ,Creation time

Step 4: Analyze Network Connections

Check active network connections.

volatility -f memory_dump.mem --profile=Win7SP1x64 netscan

This reveals:

• Local IP address

• Remote IP address

• Ports

• Associated processes
Step 5: Detect Suspicious Processes

To detect hidden or malicious processes:

volatility -f memory_dump.mem --profile=Win7SP1x64 pstree

This displays the process hierarchy, helping investigators identify abnormal processes.

Step 6: Extract Files from Memory

Files present in memory can be extracted using:

volatility -f memory_dump.mem --profile=Win7SP1x64 filescan

[Link] Memory Forensic using Belkasoft Live RAM Capturer

Aim

To capture and analyze volatile memory (RAM) of a system using Belkasoft Live RAM Capturer for forensic
investigation.

Implementation Procedure

Step 1: Download and Launch the Tool

Download Belkasoft Live RAM Capturer and run the application on the target system.

The tool is portable and does not require installation.

Step 2: Select Memory Capture Option

Open the application and click Capture Memory to begin the process.

The tool prepares to capture the entire RAM content of the system.

Step 3: Choose Destination Location

Select a folder where the memory dump file will be stored.

Example output file:

memory_dump.mem

Step 4: Start RAM Capture

Click Start to capture the volatile memory.

The tool collects RAM data such as:

• Running processes

• Active programs

• Network connections

• Encryption keys

• Temporary system data

Step 5: Save Memory Dump

After completion, the captured memory is saved as a .mem file.

This file can be analyzed using forensic tools like Volatility.

Step 6: Analyze Captured Memory

Load the memory dump into a memory analysis tool to investigate:

• Suspicious processes

• Malware activity

• Open files and network sessions

[Link] Registry, Event and Log Analysis

Aim

To analyze the Windows Registry, system events, and log files to investigate system activities and detect
suspicious behavior.

Implementation Procedure

Step 1: Access Windows Registry

Open the Registry Editor.

Steps:

1. Press Windows + R

2. Type:

regedit

3. Click OK

The Windows Registry contains configuration data related to the operating system, applications, and users.

Step 2: Examine Important Registry Keys

Investigate important registry locations such as:

HKEY_LOCAL_MACHINE\Software

HKEY_CURRENT_USER\Software

HKEY_LOCAL_MACHINE\System

These keys contain information about installed programs, system configuration, and startup applications.

Step 3: Analyze Startup Programs

Check registry entries related to startup programs.

Location:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

This key shows programs that automatically start when the system boots.

Step 4: Open Event Viewer

To analyze system events:

1. Press Windows + R

2. Type:

eventvwr

3. Press Enter

Event Viewer displays system logs.

Step 5: Examine Event Logs

Important event logs include:

• Application Logs – application related events

• Security Logs – login attempts and security events

• System Logs – system errors and hardware events

Investigators check logs for suspicious activities such as unauthorized login attempts.

Step 6: Analyze Log Details

Each log entry contains:

• Event ID

• Date and Time

• Source of the event

• Description of the activity

Example:

Event ID: 4624

Description: Successful Login

This information helps investigators track system activity.

[Link] Vulnerability Assessment and Incident Response Planning

Aim

To perform vulnerability assessment on a system and develop an incident response plan to detect,
analyze, and mitigate security threats.

Implementation Procedure

Step 1: Install Vulnerability Scanner

Install a vulnerability scanning tool such as OpenVAS.

sudo apt update

sudo apt install openvas

Step 2: Setup the Scanner

Initialize the vulnerability scanner.

sudo gvm-setup

After setup, start the scanner services.

sudo gvm-start

Step 3: Access Web Interface

Open the browser and access the scanner interface.

Example:

[Link]

Login using the administrator credentials generated during setup.

Step 4: Create Scan Target

1. Go to Configuration → Targets.

2. Add the IP address of the target system.

3. Save the target configuration.

Example target:

[Link]

Step 5: Start Vulnerability Scan

1. Go to Scans → Tasks.

2. Create a new scan task.

3. Select the target system.

4. Click Start Scan.

The scanner identifies vulnerabilities such as:

 • Open ports

• Weak configurations

• Outdated software

• Security misconfigurations

Step 6: Analyze Scan Results

After the scan completes, review the vulnerability report.

The report shows:

• Vulnerability name

• Severity level (Low / Medium / High / Critical)

• Affected system

• Recommended fixes

Step 7: Incident Response Planning

Develop an incident response plan with the following stages:

1. Preparation – establish security policies and tools.

2. Identification – detect security incidents.

3. Containment – isolate affected systems.

4. Eradication – remove threats or malware.

5. Recovery – restore system operations.

6. Documentation – record incident details and lessons learned.

[Link] of a Mock Chain of Custody Document and Evidence Collection Plan

Aim

To create a mock chain of custody document and prepare an evidence collection plan to maintain the
integrity of digital evidence during a forensic investigation.

Implementation Procedure

Step 1: Identify Digital Evidence

Identify the digital devices or files that may contain evidence.

Examples include:

• Hard disk ,USB drive ,Mobile device ,Log files ,Disk images

Example evidence item:

USB Drive (32GB)

Step 2: Prepare Evidence Collection Plan

Define the steps required to collect digital evidence safely.

Plan includes:

1. Identifying evidence sources

2. Securing the device

3. Creating forensic images

4. Preserving the original data

5. Documenting the collection process

Example command for disk imaging:

dd if=/dev/sdb of=[Link]

Step 3: Create Chain of Custody Document

The Chain of Custody (CoC) records every person who handled the evidence.

Typical fields include:

• Case ID

• Evidence ID

• Description of evidence

• Date and time collected

• Person collecting the evidence

• Location of storage

•
Example record:

Case ID: 2026-DF-01

Evidence ID: E001
Description: USB Drive 32GB
Collected By: Investigator A
Date: 10-03-2026
Location: Digital Forensic Lab

Step 4: Record Evidence Transfer

Whenever evidence is transferred, record the details.

Example:

Transferred From: Investigator A

Transferred To: Analyst B
Date: 11-03-2026
Purpose: Evidence Analysis

This ensures accountability and evidence integrity.

Step 5: Secure Evidence Storage

Store evidence in a secure evidence locker or forensic lab with restricted access.

Label the evidence properly to prevent tampering.