0% found this document useful (0 votes)
31 views3 pages

Digital Forensics Challenge Template

This digital forensics challenge involves analyzing four pieces of digital evidence from a series of stuffed animal kidnappings to help solve the case. Participants will use tools like Wireshark, Exiftool, and FTK Imager to extract metadata, files from packet captures, deleted files, and fragmented files to find the evidence needed to bust an illegal stuffed animal trafficking ring. The challenge teaches digital forensics techniques and is aimed at intermediate students with some relevant tool experience, taking 60-90 minutes to complete.

Uploaded by

aayisha banu
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
31 views3 pages

Digital Forensics Challenge Template

This digital forensics challenge involves analyzing four pieces of digital evidence from a series of stuffed animal kidnappings to help solve the case. Participants will use tools like Wireshark, Exiftool, and FTK Imager to extract metadata, files from packet captures, deleted files, and fragmented files to find the evidence needed to bust an illegal stuffed animal trafficking ring. The challenge teaches digital forensics techniques and is aimed at intermediate students with some relevant tool experience, taking 60-90 minutes to complete.

Uploaded by

aayisha banu
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Template for the PIVOT Open Lab/Challenge Project:

Version 0.9

Lab / Challenge Developers,

We have an eager audience of participants ready to try out your new lab/challenge - they just
need a little info to get started. Please provide some basic details of your work by filling out
this brief template.

Keep in mind that we encourage creativity and new ideas, so if your lab or challenge does not
fit some of the questions below, that’s OK! Just let us know as much as possible about the
special thing you’ve built. If you have any questions, please contact ????.

Title of Lab / Challenge: Digital Forensics Challenge - Save the Animals

Location on Web: [Link]


id=0B5wo_1rRmpqVZ3Myc2xtNFBkT0k&usp=sharing

The Basic Facts

Who? Author’s Name: Mandy Galante


Author’s Organization: Red Bank Regional High School

What? Short description of the Lab/Challenge


Analyze evidence to help the Toy Story Police Department (TSPD) investigation of a series of
kidnappings. Baby stuffed animals are being kidnapped from their homes and sold on the
international stuffed slave market. The TSPD has found 4 pieces of digital evidence and your
job is to analyze the acquired data and find enough evidence so that Sheriff Woody can bust
this evil stuffed slave market.

Why? Skills that can be learned from this Lab/Challenge


Digital Forensics techniques = (1) Analyze file metadata (2) Extract info and files from a
packet capture (3) Retrieving deleted files (4) File carving fragmented files (5) Retrieving
info from Browser files (6) Extract info about a Windows computer from a Registry File

Pre-Req? Skills that are needed going into this Lab/Challenge


Some familiarity with some or all of these tools: Wireshark, Exiftool, FTK Imager or Autopsy,
RegRipper, Scalpel or Foremost.

Difficulty Level ? (circle one) Introductory - Moderate - Advanced

How long? to Complete Instruction: no teaching materials included

to Complete Lab / Challenge: 60 to 90 minutes


A little more detail

How does it work?


- Type of Hands-on Lab / Challenge
o Step-by-Step Lab
o Capture the Flag
o Solve the Puzzle
o Other. Please describe: __________________________________

- Scoring mechanism:
o No scoring (lab only)
o Shortest time wins
o Point-based system
o Other. Please describe: Success/Failure at finding all the evidence

How many?
- Is the Challenge / Lab for individuals or teams? individual or work in pairs
- If groups, what is the ideal team size? ______ people per team
- How much is "too much" - is there a maximum scale of number of participants for the
challenge, given performance or other characteristics? Yes/No
Maximum number ________ people

How will I learn? - Instructional Method (check one or more)


 Video
 Article / Presentation
 None – the challenge explains itself
 Other. Please describe: Exercise is targeted at providing practice for those who have
previous experience with the tools suggested for each task BUT also possible to figure
out how to use the tools through online research.

Checklist

What you get:


- Assets provided in this Lab / Challenge. (Please list all, such as pcap files, VM images,
evidence files, etc.):
[Link] folder FlashEvidencce.001 SAM Evidence_Pcap.pcapng

What you need #1:


- Infrastructure Requirements needed to run the Lab / Challenge (Please list all, including
required devices such as PCs, tablets, local networking configuration, Internet connectivity,
bypass of firewall or proxy restrictions, etc.)

Computer and an internet connection


What you need #2:
- Assets needed in Advance for the Lab / Challenge (Please list all, such as virtual machines,
operating system installs, application installations, etc.):

Access to a virtual machine that has preloaded forensic software tools - examples are Kali
Linux or SANS SIFT Workstation 3.0
[Link]

Wrapping it up

Can you give us a longer narrative that tells us what makes the Lab / Challenge fun,
interesting, and targets the development of useful information security skills?

This challenge offers the chance to apply knowledge of several tools to solve a puzzle. The
challenge does not have a "right or wrong" way to find the answers so the competitor is
pushed past the typical following of instructional steps to figure out their own methods. But
the good news is that there is enough support info so that the competitor will not end up
flailing or getting lost. Recommend this exercise be done with an instructor present who has
the answer sheet so that the competitor can be assisted with hints.

If you have had a chance to look at the existing challenges, can you suggest where your
Lab/Challenge fits into that Roadmap or Sequence?

Common questions

Powered by AI

The challenge ensures participants do not become flustered or disoriented by providing enough support information, having the option for an instructor to give hints, and facilitating tools figured out through online research. This structured support helps prevent participants from feeling lost .

Participants are expected to have some familiarity with tools such as Wireshark, Exiftool, FTK Imager or Autopsy, RegRipper, Scalpel or Foremost before attempting the challenge .

The purpose of providing assets like pcap files and VM images is to give participants the necessary data and environment to practice real-world digital forensic techniques. These assets enable participants to analyze evidence, apply forensic tools, and test their skills in a controlled, realistic setting .

There are no direct teaching materials provided; however, the challenge itself acts as a practical exercise targeted at those with previous experience with suggested tools. It also allows learning through online research and seeks to provide practice opportunities without explicit instruction .

Participants can develop skills in digital forensics techniques such as analyzing file metadata, extracting information and files from a packet capture, retrieving deleted files, file carving fragmented files, retrieving information from browser files, and extracting information about a Windows computer from a Registry file .

The challenge accommodates varying levels of expertise by targeting those with previous experience with suggested tools like Wireshark and Exiftool, while also allowing participants to figure out how to use these tools through online research. However, having an instructor present with an answer sheet can guide participants, ensuring they do not become lost .

The challenge fits into the educational roadmap as a practical, hands-on experience that enhances participants' problem-solving skills and digital forensic knowledge through realistic scenarios. It is suitable for those building on fundamental forensic skills as part of a broader information security education sequence .

A computer and an internet connection are necessary infrastructure requirements for participants to successfully engage with the Digital Forensics Challenge .

Having an instructor present is beneficial as they can provide guidance, offer hints if participants struggle with the tasks, and ensure they progress through the challenge effectively by helping them navigate any difficulties encountered .

The challenge encourages creative problem-solving by not having a 'right or wrong' way to find answers, thus pushing participants to figure out their methods beyond typical instructional steps. Although hints are available, the open-ended nature requires participants to apply their critical thinking and creativity to solve the puzzle .

You might also like