M.
Sc Digital Forensics and Information Security
Lab Assignment
Incident Response Management
Subject Code: CTMSDFIS S1 P2
Submitted By: Submitted To:
Muktansh Saxena Dr. Indrajeet Singh
250246002006
Index
[Link] Practical No. Title Page No.
1 Practical 1 Network Scan
using Nessus
2 Practical 2 Credentials
capturing using
Wireshark
3 Practical 3 FTK Imager and
Autopsy
4 Practical 4 Ram analysis
using volatility
5 Practical 5 Browser
analysis using
Autopsy
6 Practical 6 Wazuh
installation and
configuration
Practical 1
Network Scan using Nessus
Objective
The objective of this practical is to perform a basic network vulnerability
assessment using Nessus in order to identify potential security vulnerabilities,
misconfigurations and informational issues present on a target system. The
scan helps in understanding the security posture of the network by detecting
open services, protocol usage, SSL/TLS configurations and known vulnerabilities
along with their respective severity levels.
Methodology
In this practical, Nessus was opened through its web interface and a Basic
Network Scan template was selected. The target IP address [Link] was
entered, and default scan settings were used. The scan was then started and
Nessus analyzed the target by checking network services, open ports and
security configurations. After the scan was completed, the results were
reviewed and categorized based on their severity.
Nessus starting interface
Nessus options for different functions
We are doing a basic network scan
Specified the target IP address and the template
Opened the template and started the scan
Scan completed with the list of vulnerabilites
Network scan report with severity of each vulnerability
Conclusion
The basic network scan was completed successfully and revealed several
vulnerabilities and informational findings on the target system. Most of the
findings were informational with a few low and medium severity issues. This
practical demonstrated how Nessus can be used to perform a basic network
vulnerability scan and identify potential security issues.
Practical 2
Credentials capturing using Wireshark
Objective
The objective of this practical is to use Wireshark to capture network packets
and understand how user login credentials can be intercepted when they are
transmitted over an unsecured network. This practical helps in learning the
risks associated with using HTTP instead of secure communication methods.
Methodology
In this practical, Wireshark was launched and the Ethernet network interface
was selected for capturing packets. Packet capturing was started to monitor all
network traffic. A vulnerable test website (Vulnweb) was used to enter a
username and password for login. While the credentials were being
transmitted, Wireshark captured the packets in real time. After the login
process was completed, an HTTP filter was applied to the captured packets to
view only relevant traffic. The filtered packets were then analyzed, and the
entered username and password were successfully identified in plain text.
Opened wireshark and chose our ethernet interface
Packet capturing started
Using vulnweb website as a test website to enter login details
Entered out username and password in the vulnerable test website
Used the http filter to get specific filtered results
Found the username and password entered on the vulnweb website
Conclusion
The practical was successfully completed and showed that login credentials
sent over HTTP can be easily captured and viewed using Wireshark. This
experiment demonstrates the importance of using secure protocols such as
HTTPS to protect sensitive information from being exposed on the network.
Practical 3
FTK Imager and Autopsy
Objective
The objective of this practical exercise is to perform a complete digital forensic
process on both a logical and a physical drive using FTK Imager and Autopsy.
The task involves creating forensic images of selected storage media, analyzing
the acquired images for file system artifacts, and demonstrating the recovery of
deleted data. The exercise aims to develop practical skills in forensic imaging,
evidence preservation, integrity verification through hashing, and data
recovery using standard digital forensics tools.
Methodology
A controlled test environment was created using a sample folder on the system
and a USB drive. Selected files were deleted to simulate data loss. FTK Imager
was then used to create forensic images of both the logical folder and the
physical USB drive in E01 format, with MD5 and SHA-1 hashes generated for
integrity verification. The acquired images were analyzed in Autopsy by adding
them as data sources and enabling relevant ingest modules. Deleted files were
identified, examined, and successfully recovered using Autopsy’s extraction
feature. All steps were documented with observations and screenshots.
FTK Imager installation complete –
Autopsy installation complete –
1st – Logical imaging of a disk partition
All the files listed in the drive
We then deleted few files from the disk
Recycle Bin
We delete the files from the recycle bin too
Check logical drive option in FTK imager
Select the drive to make image of
Enter the evidence details
Match the hashes after the imaging is done
Image stored in the designated folder in E01 format
Now we enter the case details in autopsy
Select the disk image
Select all the modules we want to analyze
Finally we get the analysis results including the files we deleted before making
the image of the disk
2nd – Physical Imaging
Files listed in the USB drive
We then deleted some files before making an image
We choose the physical drive this time
We choose the USB drive from the drop down list
Enter the evidence details
Creation of Image of the USB drive
All the hashes match
Results of the imaging in E01 format
Adding the case in autopsy
Data source to the result files
Analyzing data source
Analysis found all the deleted files
Conclusion
The forensic investigation successfully demonstrated the process of digital
evidence acquisition, preservation, and analysis using FTK Imager and Autopsy.
Both logical and physical drives were imaged without data alteration, and the
integrity of each image was verified through hash values. Autopsy effectively
identified and recovered deleted files from both data sources, confirming that
deleted data remnants remain recoverable unless securely overwritten.
Practical 4
Ram analysis using volatility
Objective
The objective of this practical is to acquire the system’s RAM and analyze it
using the Volatility framework in order to study active processes, their
relationships, and execution details stored in volatile memory.
Methodology
In this practical, the DumpIt tool was installed and executed on the target
system to capture the contents of physical memory. The RAM acquisition
process was initiated and completed successfully and the memory dump file
was saved for further examination. Volatility was then installed on the analysis
system and used to analyze the captured RAM image. Various Volatility plugins
were executed including process listing to identify all running processes,
process tree analysis to understand parent–child relationships between
processes and command-line analysis to view the arguments used to start each
process.
Installed dumpit and executed it
Ram acquisition started
Ram capture completed and saved
Installed volatility for RAM analysis
List of all running processes present in the captured memory dump
Displays running processes in a parent–child hierarchical structure
Showing the command-line arguments used to start each running process
Conclusion
The RAM analysis using Volatility was successfully carried out and provided
valuable information about the system’s runtime activity. This practical
demonstrated how volatile memory contains important forensic evidence such
as running processes and execution details, highlighting the importance of
RAM analysis in digital forensic investigations.
Practical 5
Browser analysis using Autopsy
Objective
The objective of this practical is to perform browser forensic analysis using
Autopsy by examining the Google Chrome ‘User Data’ folder in order to
identify browsing activity, downloaded files, cached data, and other artifacts
stored by the browser.
Methodology
In this practical, the Google Chrome ‘User Data’ folder was copied to a USB
device and a forensic image of the folder was created. A new case was then
generated in Autopsy and the disk image file was selected as the data source.
The path of the stored image was specified and relevant analysis modules were
chosen to perform browser analysis. Autopsy was then started to process the
data. During analysis, various browser artifacts were examined including web
cache, web downloads, browser databases, HTML files, web categories and
EXIF metadata from downloaded images. After completion of the analysis,
Autopsy generated a detailed forensic report.
Copied the ‘User data’ folder in a USB and made an image of it
Generating a new case in autopsy
Selecting the disk file to input our image
Specifying the path where our image is stored
Choosing the modules for autopsy to perform analysis
Autopsy analysis started
Web Cache – Temporary browser storage
Web Downloads – Downloaded files history
Databases (Browser Databases) – Stored browser data
HTML Files – Saved web page files
Web Categories (Analysis Results) – Website classification results
EXIF Metadata (Indirect Browser Evidence) – Image metadata information
Autopsy generated report
Conclusion
The browser analysis using Autopsy was completed successfully and provided
useful insights into Google Chrome browsing activity. The practical
demonstrated how browser artifacts such as cache files, download history,
databases and metadata can be extracted and analyzed, highlighting the
importance of browser forensics in digital investigations.
Practical 6
Wazuh installation and configuration
Objective
The objective of this practical is to install and configure the Wazuh security
monitoring platform and integrate a Windows agent to monitor system activity,
security events and compliance status.
Methodology
In this practical, Wazuh was installed on a virtual machine using VirtualBox.
After installation, the Wazuh dashboard was accessed by logging into the web
interface. The Wazuh manager, indexer and dashboard services were started
and the system IP address was verified to ensure the dashboard was accessible.
The Wazuh interface was then explored to understand its features. For agent
integration, the Wazuh agent MSI file was downloaded on a Windows system
and installed using PowerShell. The Wazuh service was started on the agent
system, allowing it to connect to the Wazuh manager. Once connected, the
agent appeared on the Wazuh dashboard and began sending system and
security data.
Wazuh installation in virtualbox
Logged into wazuh
Started wazuh manager, dashboard and indexer
Listed the IP address and checked the status of wazuh dashboard
Wazuh interface
Wazuh dashboard
Agent integration
Download the Wazuh agent MSI and install it
Wazuh agent MSI file is being downloaded and installed
Starting wazuh service
Wazuh dashboard with agent integrated
Added agent is being actively monitored
Conclusion
The Wazuh installation and configuration were completed successfully. The
Wazuh agent was properly integrated and actively monitored through the
dashboard. This practical demonstrated how Wazuh can be used for centralized
security monitoring, agent management and real-time visibility into endpoint
activity.