SEC 435 Digital Forensics Foundations

Lab 2 - Data File Structures

Fall Semester 2024

[Link]

[Link]

Deliverable Lab Report

Lab Equipment Software:

● WinHex
● OS Forensics

Document Contents 1. Hands-On Project 5-1

2. Hands-On Project 5-2
3. Hands-On Project 5-3
4. Hands-On Project 5-4
5. Lab Report
6. Grading Rubric

Hands-On Project 5-1:

In this project, you compare two files created in Microsoft Office to determine
whether the files are different at the hexadecimal level. Keep a log of what you find.

Procedure:

1. Start Word, and in a new document, type This is a test.

2. Save the file as [Link] in your work folder, using Word Document
(*.docx) as the file type. Exit Word.
3. Start Excel, and in a new workbook, enter a few random numbers. Save the file in
your work folder as [Link] , using Excel Workbook (*.xlsx) as the file
type.
4. Exit Excel, and start WinHex (running it as an Administrator).
5. Click File, Open from the menu. In the Open dialog box, navigate to your work
folder and double-click [Link].
6. Notice the file hexadecimal header 50 4B 03 04 14 00 06 00 starting at offset 0.
Click Edit, Copy All from the menu, and then click Editor Display.
 7. Start Notepad, and in a new document, press Ctrl+V to paste the copied data.
Leave this window open.
8. Click File, Open from the WinHex menu. In the Open dialog box, navigate to your
work folder and double-click [Link].
9. Repeat Step 6.
[Link] the data you just copied under the Word document header information you
pasted previously.
11. In the Notepad window, add your observations about the two files’ header
data. Save this file as [Link] and turn it in to your instructor. Exit WinHex.

Hands-On Project 5-2:

In this project, you explore the MFT and learn how to locate date and time values in the
metadata of a file you create. These steps help you identify previously deleted
fragments of MFT records that you might find in unallocated disk space or in residual
data in [Link].

Procedure:

1. Start Notepad, and create a text file with one or more of the following lines: a. A
countryman between two lawyers is like a fish between two cats. b. A slip of
the foot you may soon recover, but a slip of the tongue you may never get
over.
c. An investment in knowledge always pays the best interest.
d. Drive thy business or it will drive thee.
2. Save the file in your work folder as [Link] , and exit Notepad. (If your work
folder isn’t on the C drive, make sure you save the file on your C drive to have it
entered in the $MFT files you copy later.)
 3. Next, review the material in “MFT and File Attributes,” paying particular attention
to attributes 0x10 and 0x30 for file dates and times. The following charts show
the offset byte count starting at position FILE of the file’s MFT record for the date
and time stamps:

Next, you examine the metadata of the [Link] file stored in the $MFT file. Follow
these steps:

1. Start WinHex with the Run as administrator option. If you see an evaluation
warning message, click OK.
2. As a safety precaution, click Options, Edit Mode from the menu. In the Select
Mode (globally) dialog box, click Read-only Mode (=write protected), as shown in
Figure 5-39, and then click OK.
3. Click Tools, Open Disk from the menu. In the View Disk dialog box, click the C:
drive (or the drive where you saved [Link]), as shown in Figure 5-40, and
then click OK. If you’re prompted to take a new snapshot, click Take new one.
Depending on the size and quantity of data on your disk, it might take several
minutes for WinHex to traverse all the files and paths on your disk drive.

4. Click Options, Data Interpreter from the menu. In the Data Interpreter Options
dialog box, click the Windows FILETIME (64 bit) check box, shown in Figure 5-
41, and then click OK. The Data Interpreter should then have FILETIME as an
additional display item.
5. Now you need to navigate to your work folder (C:\Work\Chap05\Projects) in
WinHex. In the upper-right pane of WinHex, scroll down until you see your work
folder. Double-click each folder in the path (see Figure 5-42), and then click the
[Link] file.
6. Drag from the beginning of the record, on the letter F in FILE, and then down and
to the right while you monitor the hexadecimal counter in the lower-right corner.
(Note: 50 hexadecimal bytes is the “position” for the first date and time stamp for this
record, as described in the previous charts for 0x10 $Standard Information.) When
the counter reaches 50 (see Figure 5-43), release the mouse button.
7. Move the cursor one position to the next byte (down one line and to the left), and
record the date and time of the Data Interpreter’s FILETIME values. 8. Reposition
the mouse cursor on the remaining offsets listed in the previous charts, and record
their values.
9. When you’re finished, exit WinHex and hand in the date and time values you
 recorded.

Hands-On Project 5-3:

In this project, you use WinHex to become familiar with different file

types. Procedure:

1. Locate or create Microsoft Excel(.xlsx), Microsoft Word (.docx), .gif, .jpg,

and .mp3 files. If you’re creating a Word document or an Excel spreadsheet,
save it as a Word or Excel file.
2. Start WinHex.
3. Open each file type in WinHex. Record the hexadecimal codes for each file in a
text editor, such as Notepad or WordPad. For example, for the Word document,
record Word Header: 50 4B 03 04.
4. Save the file, and then print it to give to your instructor.
Hands-On Project 5-4:
This project is a continuation of the in-chapter activity carried in class using
OSForensics. The paralegal has asked you to see whether any passwords are listed in
the images of Denise Robinson’s computer.

Procedure:

1. Start OSForensics. If prompted to allow the program to make changes to your

computer, click OK or Yes. In the OSForensics message box, click Continue
Using Trial Version.
2. Copy the [Link] file to your work folder. Mount the [Link] file as
described in the in-chapter activity.
3. In the main window, click Manage Case in the navigation bar on the left, if
necessary. In the Select Case pane on the right, double-click InChap05 if a green
checkmark isn’t displayed next to it.
4. In the navigation bar on the left, click Passwords. In the pane on the right, click
the Find Browser Passwords tab, if necessary. Click the Scan Drive button, and
then click the drive letter for the [Link] mounted virtual drive.
5. In the navigation bar on the left, click Retrieve Passwords. In the pane on the
right, right-click the first item and click Export List to Case. In the Title text box,
type Denise Robinson’s additional e-mail and password, and then click OK.
Repeat this step for all browser passwords that were recovered.
6. In the Passwords window, click the Windows Login Passwords tab. Click the
Scan Drive button, and then click the drive letter for the [Link] mounted
virtual drive.
7. Click Retrieve Hashes, and then click Save to File. In the Save to dialog box,
navigate to your work folder, type Denise-Robinson-WinPasswords in the File
name text box, and then click Save.
8. In the navigation bar on the left, click Manage Case. In the Manage Current Case
pane on the right, click the Add Attachment button. Navigate to and click the
Denise-Robinson-Win-Passwords file, and click Open. In the Export Title text
box, type Denise-Robinson-WinPasswords, and then click Add.
9. In the navigation bar at the top, click Generate Report. In the Export Report
dialog box, click OK. If you get a warning message that the report already exists,
click Yes to overwrite the previous report.
[Link] OSForensics, and print the report displayed in your Web browser. Turn the
report in to your instructor.
Lab Report

After completing this lab work, you will write a report. The report should be a comprehensive
document which include the following items:
a. a title page with the names and IDs of all team members,
b. an executive summary of the entire report,
c. for each hands-on project,
i. the purpose and critical analysis,
ii. at least 3-5 representative screenshots with meaningful explanations, and iii.
answers of all the questions included in the exercises, if any,
d. a conclusion,
e. your team’s reflection, and
f. a list of references used (in APA/IEEE style).

The report should be easy to read and comprehend, well-structured, properly formatted with no
spelling and grammatical mistakes. You may work in groups of 2-3 members and submit one
PDF or Word file of the lab report per group on Blackboard.
Grading Rubric
Criteria Weight Description

Experimental 30 The right tools selected, installed and adequately

design & applied and achieved precisely the anticipated goal
methodology (answering all the questions) with clear intuition and
understanding.

Findings, 25 The experimental results are adequately presented

analysis and with in-depth insights and critically analyzed with full
discussion understanding that is easy to follow and comprehend.

Technical writing: spelling, grammar

Template
compliance
25 No spelling major spelling and grammatical
errors. Selection of words, phrases and sentences
is optimal without any duplication and unnecessary
information.
Some spelling and grammatical errors which do
not impair meaning.

20 Report fulfills all the requirements including

template compliance (including guidelines given in
lab manual or given in class) and is well-structured
essay, well formatted and well compiled with
cohesion and clarity that is easy to read and
understand without any difficulty or reading
external resources.