K. J.
Somaiya School of Engineering, Mumbai-77
Department of Computer Engineering
Batch: Roll No.:
Tutorial No.1
Title:
Objective: This module provides foundational knowledge of digital forensics,
emphasizing core tools,investigative methodologies, and their application in real-
world scenarios.
______________________________________________________________________
Expected Outcome of Experiment:
Students will be able to understand digital forensic principles, utilize basic forensic
tools, follow standard investigation procedures, and apply forensic techniques to
analyze digital evidence in real-world cyber incident investigations while adhering to
legal and ethical guidelines.
_____________________________________________________________________
Case Studies on Historical Cyber Security breaches.
1. Sony Pictures Hack (2014) – [Link]
2. Microsoft Corporate Email Breach (Jan 2024) -
[Link]
nation-state-actor-midnight-
blizzard/#:~:text=The%20Microsoft%20security%20team%20detected,in%20Microso
ft%20products%20or%20services.
3. AIIMS Delhi Ransomware Attack (2022)
[Link]
______________________________________________________________________
Steps for Experimenting with Digital Evidence Gathering
1. Identification
Department of Computer Engineering DBMS Sem-III July-Nov 2026 1
K. J. Somaiya School of Engineering, Mumbai-77
Department of Computer Engineering
Objective: Determine all potential sources of digital evidence, such as computers,
mobile
devices, servers, cloud storage, and IoT devices.
Tools: Network scanners (e.g., Nmap), asset inventory systems, and manual
inspections.
2. Preservation
Objective: Safeguard the identified digital evidence to prevent alteration or loss.
Methods:
Isolate devices from networks to prevent remote access.
Use write blockers to prevent data modification during acquisition.
Document the chain of custody meticulously.
3. Acquisition
Objective: Create exact copies (forensic images) of digital media for analysis.
Tools:
FTK Imager: For creating forensic images.
EnCase: For comprehensive data acquisition.
CAINE Linux: A live Linux distribution with pre-installed forensic tools.
Verification: Use hashing algorithms (e.g., MD5, SHA-1) to verify the
integrity of
the acquired images.
4. Analysis
Objective: Examine the acquired data to uncover relevant evidence.
Tools:
Autopsy: A graphical interface for The Sleuth Kit, useful for analyzing disk
images.
The Sleuth Kit: A collection of command-line tools for forensic analysis.
Wireshark: For analyzing network traffic captures.
RegRipper: For extracting and analyzing Windows Registry data.
Focus Areas: Look for deleted files, logs, emails, browser history, and other
artifacts pertinent to the investigation.
5. Documentation
Objective: Maintain detailed records of all procedures, findings, and tools used
during the
investigation.
Best Practices:
Record timestamps, actions taken, and observations.
Ensure that documentation is clear and comprehensible for legal
proceedings.
6. Presentation
Department of Computer Engineering DBMS Sem-III July-Nov 2026 2
K. J. Somaiya School of Engineering, Mumbai-77
Department of Computer Engineering
Objective: Prepare and present the findings in a manner suitable for legal or
organizational review.
Considerations:
Use visual aids (e.g., charts, timelines) to illustrate findings.
Be prepared to explain methodologies and tools used during the
investigation.
Creating a Sample Evidence File in FTK Imager
1. Launch FTK Imager
2. Create a Disk Image
Go to File → Create Disk Image
Choose the source: Physical Drive, Logical Drive, Image File, or Folder
3. Select Destination Type
Choose Raw (dd) or E01 format.
4. Enter Case Info
Optional, but useful for documentation (case number, examiner,
description).
5. Choose Destination Path & Filename
Define where and under what name to save the image.
6. Start Imaging
FTK Imager will create a bit-for-bit copy of the source.
Department of Computer Engineering CSF (Tut)/Sem-V (Hon) – July-Nov 2025
Sample Evidence File for Practice
You can also download publicly available digital forensics images for practice:
Sources for Free Sample Evidence Files:
Digital Corpora
Contains images like "M57 Patents," memory dumps, USB drive images.
CFReDS (NIST)
Provides challenge images designed for forensic testing.
Forensics Wiki Sample Images
A curated list of sample forensic images for testing tools.
Processing of the Evidence File:
To load it in FTK Imager:
1. Open FTK Imager.
2. Go to File → Add Evidence Item.
3. Choose the correct source type (e.g., Image File).
Department of Computer Engineering DBMS Sem-III July-Nov 2026 3
K. J. Somaiya School of Engineering, Mumbai-77
Department of Computer Engineering
4. Browse and select your .E01, .dd, or .img file.
5. FTK Imager will mount and display the file structure for analysis.
Overview of Autopsy
Type: GUI-based front-end to The Sleuth Kit (TSK)
Use Case: Analyze disk images, recover deleted files, examine file systems,
timelines,
web artifacts, emails, etc.
Platform: Windows (primarily), Linux (with effort)
License: Open-source (Apache License 2.0)
Department of Computer Engineering CSF (Tut)/Sem-V (Hon) – July-Nov 2025
Steps to Use Autopsy for Evidence Analysis
1. Install Autopsy
Download from the official website.
Install on a Windows machine (recommended for easiest setup).
2. Obtain or Create an Evidence File
Use tools like FTK Imager to create .dd, .E01, or .img files.
Alternatively, download practice images from:
[Link]
[Link]
3. Create a New Case in Autopsy
Open Autopsy and click "Create New Case".
Enter:
Case Name
Base Directory
Investigator Name
4. Add Data Source (Evidence File)
Choose "Disk Image or VM File"
Supported formats: .img, .dd, .E01, .vmdk, .vhd, etc.
Autopsy will run file system and content ingestion modules.
5. Analyze the Evidence
Autopsy automatically extracts various artifacts like:
File system structure
Deleted files and folders
Web history and cache
Emails and attachments
Registry hives (for Windows)
Department of Computer Engineering DBMS Sem-III July-Nov 2026 4
K. J. Somaiya School of Engineering, Mumbai-77
Department of Computer Engineering
Timeline of activity
Keyword search and hash lookup
6. Generate Report
Autopsy lets you generate HTML or Excel reports.
Include relevant findings for legal or academic review.
Conclusion:
Department of Computer Engineering DBMS Sem-III July-Nov 2026 5