LORDS UNIVERSAL COLLEGE

TYBSC CS SEM V – CYBER FORENSIC

INDEX

Sr Date Practical Page No. Signature

No.
1 Creating a Forensic Image using FTK Imager/Encase Imager
02/08/2024 : 3
• Creating Forensic Image
• Check Integrity of Data
• Analyze Forensic Image

2 Data Acquisition:
09/08/2024 • Perform data acquisition using: 14
• USB Write Blocker + Encase Imager
• SATA Write Blocker + Encase Imager
• Falcon Imaging Device

3
16/08/2024 Analyze the memory dump of a running computer system. 19
• Extract volatile data, such as open processes,
network connections, and registry information.

4 Capturing and analyzing network packets using Wireshark

23/08/2024 (Fundamentals) : 24
• Identification the live network
• Capture Packets
• Analyze the captured packets

5 Using Sysinternals tools for Network Tracking and Process

30/08/2024 Monitoring: 42
• Check Sysinternals tools
• Monitor Live Processes
• Capture RAM
• Capture TCP/UDP packets
• Monitor Hard Disk
• Monitor Virtual Memory
• Monitor Cache Memory

1
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

6 Recovering and Inspecting deleted files

06/09/2024 • Check for Deleted Files 54
• Recover the Deleted Files
• Analyzing and Inspecting the recovered files
• Perform this using recovery option in ENCASE and
also Perform manually through command line

7 Steganography Detection
13/09/2024 • Detect hidden information or files within digital 65
images using steganography analysis tools.
• Extract and examine the hidden content.

8 Mobile Device Forensics

20/09/2024 • Perform a forensic analysis of a mobile device, such 73
as a smartphone or tablet.
• Retrieve call logs, text messages, and other relevant
data for investigative purposes.

9 Email Forensics
27/09/2024 • Analyze email headers and content to trace the origin 89
of suspicious emails.
• Identify potential email forgeries or tampering.

10 Web Browser Forensics

04/10/2024 • Analyze browser artifacts, including history files, 104
bookmarks, and download records.
• Analyze cache and cookies data to reconstruct user-
browsing history and identify visited websites or
online activities.
• Extract the relevant log or timestamp file, analyze its
contents and interpret the timestamp data to
determine the user's last internet activity and
associated details.

2
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

PRACTICAL NO. 1
Aim: Creating a Forensic Image using FTK Imager/Encase Imager:

Writeup:

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

3
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

In this Practical we are going to use the FTK Imager to create Images of the evidences:-

• Creating Forensic Image

• Check Integrity of Data
• Analyze Forensic Image

Go to File  Create Disk Image

4
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Select the source evidence type

Here we are going to select the physical drive and proceed

Then we browse the location of the Pen drive and click Finish

5
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Now we add the location to create images

In this we are going to select the raw (dd) format

6
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

And now we fill the details required for the case

Create a folder to save the images to store in the system disk as the pen drive size cannot be stored in the same
drive

Then paste that location to save the images and click Finish

7
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Then Click on Start and wait until the imaging is done

8
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Now it will verify

9
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

This is the Hash Value CheckSum given if it matches the original values then the evidence is original if not
the evidence is been misplaced

We take the image summary

10
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Now we are going to view the images in the FTK Imager

Go to File  Add Evidence Item

Then select the type of the evidence here it is Image File

11
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Give the directory of the images created using the FTK Imager and click Finish

Here we can see the data shown by the FTK Imager

12
LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

13
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

PRACTICAL NO. 2
Aim: Performing data acquisition using various tools.
Writeup:
_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

14
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Perform data acquisition using:

• USB Write Blocker + Encase Imager

• SATA Write Blocker + Encase Imager
• Falcon Imaging Device

USB Writer Blocker + Encase Imager

Hardware and Paid Softwares

https://www.getfastforensics.com/write-blockers https://www.amazon.com/usb-write-

blocker/s?k=usb+write+blocker&language=en_US&currency=INR

http://www.orionforensics.com/forensics-tools/orion-usb-write-blocker/ For Open Source Software

https://sourceforge.net/projects/usbwriteblockerforwindows8/

Encase Imager
Encase is a forensic suite produced by Guidance Software (now part of OpenText) that is popular
with commercial providers. A standard license comes in at around $3500 around ₹289242

Overview PDF for the Encase Imager

https://www.opentext.com/assets/documents/en-US/pdf/opentext-po-
encaseforensic-en.pdf https://www.forensicstore.com/product/encase-forensic-v8-06/
YouTube link to see the working of the Encase Imager https://www.youtube.com/watch?v=obmRoD3ChSc

15
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Here is an Overview of the Encase Imager https://www.hackingarticles.in/forensic-imaging-encase/

SATA Write Blocker + Encase Imager

16
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Overview of Write Blockers https://linuxhint.com/best_hardware_write_blockers/

https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-tool-testing-program-

cftt/cftttechnical/hardware Setup of the Write Blocker https://www.youtube.com/watch?v=Kmm8iaa76rQ

Falcon Imaging Device

About Info of the Falcon Imaging Device

https://www.logicube.com/shop/forensic-falcon-neo/

http://www.edasfox.com/product/forensic-falcon-neo/

https://www.secureindia.in/?page_id=1068 Prices of the Falcon Imaging

Device https://www.indiamart.com/proddetail/forensic-falcon-

2850471543448.html

Documentation and Videos for Demonstration of the Working of the Flacon Imaging Device

https://www.forensicfocus.com/articles/how-to-create-a-logical-image-on-falcon-neo/

https://www.forensicfocus.com/articles/how-to-image-to-a-network-repository-with-logicubes-
forensicfalcon-neo/ https://www.forensicfocus.com/articles/how-to-use-the-file-browser-feature-in-
logicubes-forensic-

17
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

falconneo/ https://www.youtube.com/watch?v=YSLSi1QpjUs

https://www.youtube.com/watch?v=rZLndjf1hPs

18
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

PRACTICAL NO. 3
Aim: Analyzing the memory dump of a running computer system.
Writeup:
_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

19
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Extract volatile data, such as open processes, network connections, and registry information.

Practical:
Open Process

Go to Sysinternal Suite  ProcMon Right Click on it and Open As Administrator

20
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Network Connections
Go to SysinternalSuite  TCPview

21
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Registry Information

Click on Search Bar on the Taskbar  Type Regedit  Click on Registry Editor

22
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

View the desired registries to be analyzed

23
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

PRACTICAL NO. 4
Aim: Capturing and analyzing network packets using WireShark (Fundamentals):
Writeup:
_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

24
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

• Identification the live network

• Capture Packets
• Analyze the captured packets

In this practical only identification, capturing and analysis is done.

We will also solve some cases to understand the practical clearly.

Identifying the Live Networks

We are using WireShark, an application used to identify, capture and analyze the network traffics.

Capturing Network

We are now going to capture a network of Ethernet

25
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

As soon as you single-click on your network interface’s name, you can see how the packets are working in
real time. WireShark will capture all the packets going in and out of our systems.

Analyze the Captured Packets

Color Coding Different packets are seen highlighted in various different colors. This is WireShark’s way of
displaying traffic to help you easily identify the types of it.

Default colors are:

▪ Light Purple color for TCP traffic

▪ Light Blue color for UDP traffic
▪ Black color identifies packets with errors

Example these packets are delivered in an unordered manner.

Click on View  Colorize Conversation  New Coloring Rule

26
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Here we can see the Default Colors given for every Packet Capturing

Now we analyze data using filters provided in the WireShark application

27
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Write the following commands in the given area to apply filter

Display filter command

1. Display packets based on specific IP-address

 ip.addr == 192.0.2.1

2. Display packets which are coming from specific IP-address

 ip.src == 192.168.10.28

28
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

3. Display packets which are having specific IP-address destination

 ip.dst == 192.168.10.28

4. Display packets which are using http protocol

 http

29
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

5. Display packets which are using http request

 http.request

6. Display packets which are using TCP protocol  tcp

30
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

7. Display packets having no error connecting to server

 http.response.code==200

8. Display packets having port number 80, 443

 tcp.port==80 || udp.port==443

31
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

9. Display packets which that contains keyword facebook

 tcp contains facebook

32
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Now we are going to perform a Case Study

AIM:

Analyze the packets provided in lab and solve the questions using Wireshark
1. What web server software issued by go.microsoft.com?
Analysis –

The domain name be found from host header so we will set host header column where we will see all domain
name. Select any HTTP request and expand the Hypertext Transfer Protocol then right click on Host header
and then Apply as Column

First find the requests from HTTP and click on and request then on the lower table of details Select on
HyperText Transfer Protocol  Host and Right Click on that and Select Apply as Filter

33
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Now we can see the Host

Right click on the selected packet and then select Follow  TCP stream

34
LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

35
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

2. About what cell phone problem is the client concerned?

Analysis –

Client talking about cell so we search for cell keyword in whole packets. We will use regular express for
searching the cell keyword. Apply frame matches “()”

In the search frame type frame matches “microsoft”

After applying the filter now, we will start to check every HTTP request. We noticed in the first HTTP request
microsoft keyword is in URL and it was about Microsoft Edge connection.

3. According to http, what data will TCP show?

36
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Analysis –

As we did in the last challenge, we will apply a regular express filter for the Google keyword. Apply frame
matched “http” .

Select the packet and expand the Hypertext Transfer Protocol tab right click on Transmission Control
Protocol Go to Protocol Preferences and check Allow subdissector to resemble TCP stream with HTTP
spanning bodies.

Now Go to file and select Export Objects  HTTP. It will save all objects from the packet.

37
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Click on save all.

After checking it seems only the packets transfer were to connect the machine to the internet.

4. How many web servers are running Microsoft?

38
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Analysis –

The web server name can be retrieved from HTTP response header. So will apply filter http.response and
we can see all http response packets.

Now we will set the server header as column select any packet and right click on it then select Apply as
Column.

Now can see the server column where all server name is showing.

39
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Now we have to check how many Apache packets are there we can’t count manually for each packet so we
will apply another filter http.server contains “Microsoft”

After applying filter Go to Statistics  Endpoints

40
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

It will show all connections.

Check the limit to display filter then it will show the actual Microsoft connections. Now there are showing
223 connections but will exclude 4.150.240.254 because it is client’s IP not a server IP so there are actual 222
Microsoft servers.

CONCLUSION:

We have successfully analyzed the packets provided and solved the questions using WireShark

41
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

PRACTICAL NO. 5
Aim: Use of Sysinternals tools for Network Tracking and Process Monitoring:
Writeup:
_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

42
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

• Check Sysinternals tools

• Monitor Live Processes
• Capture RAM
• Capture TCP/UDP packets
• Monitor Hard Disk
• Monitor Virtual Memory
• Monitor Cache Memory

Lets Check If the Sysinternal Suite is Available on the System

Check SysInternals Tools

STEPS

Google  sysinternal tools

If Available Then Skip the Installation Part Let’s Install the Sysinternal

Suite for Windows We can download the zip file from the given link

https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-

suite

Then Extract the file to the desired directory

43
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Monitor Live Processes

Process Monitor is an advanced monitoring tool for Windows that show real-time file system. Registry and
process/thread activity. It combines the features of two legacy SysInternals utilities, Filemon and Regmon,
and adds an extensive list of enhancements including rich non-destructive filtering, comprehensive event
properties such as session IDs and user names, reliable process information, full thread stacks with integrated
symbol support for each operation, simultaneous logging to a file, and much more.

STEPS

Sysinternal  procmon

44
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Then allow the permissions and then Select all the processes to be viewed

Then Click on Apply and then OK Then see the displayed Processes

45
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Capture RAM
RAMMap is an advanced physical memory usage analysis utility for Windows Vista and higher. It presents
usage information in different ways on its several different tabs:

 Use Counts: usage summary by type and paging list

 Processes: process working set sizes
 Priority Summary: prioritized standby list sizes
 Physical Pages: per-page use for all physical memory
 Physical Ranges: physical memory addresses
 File Summary: file data in RAM by file
 File Details: individual physical pages by file

STEPS

Sysinternal  RAMMap

46
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Then allow the permissions and view the mapping

Capture TCP/UDP packets

TCPView is Windows program that will show you detailed listening’s of all TCP and UDP endpoints on your
system, including the local and remote addresses and the state of TCP connections.

Using TCPView:

When you start TCPView it will enumerate all the active TCP and UDP endpoints, resolving all IP address to
their domain name versions. You can use a toolbar button on menu item to toggle the display of resolves
names.

Using Tcpvcon

Tcpvcon using is similar to that of the built-in Windows netstat utility

47
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Usage

Tcpvcon [-a] [-c] [-n] [process name or PID]

STEPS

Download TCPView

48
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Monitor Hard Disk

DiskMon is an application that logs and displays all hard disk activity on a Windows system

STEPS

Download DiskMon  Run as Administrator

49
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Monitor Virtual Memory

VMMap is a process virtual and physical memory analysis. It shows a breakdown of a process’s committed
virtual memory types as well as the amount of physical memory working set assigned by the operating system
to those types.

STEPS

Sysinternal  VMMap

50
LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

51
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Monitor Cache Memory

CacheSet is an applet that allows you to manipulate the working the set parameters of the system file cahce.
Unlike CacheMan, CacheSet runs on all versions and will work without modifications on new Service Pack
releases.

Give all the permissions and Click on Agree

Click on apply

52
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

After applying the changes

53
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

PRACTICAL NO. 6
Aim: Recovering and Inspecting deleted files
Writeup:

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

54
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

• Check for Deleted Files

• Recover the Deleted Files
• Analyzing and Inspecting the recovered files
• Perform this using recovery option in ENCASE and also Perform manually through

command line

In this Practical we are going to use the Autopsy, an application used to check, recover, analyze and inspect
the deleted files using the Image evidence created

Open Autopsy and Click on New Case

Give a case name and browse the destination to save the autopsy file

55
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Then give the case number and the details as per the case number when performing the FTK Imager Practical
1

Select on Disk Image or VM File and Click Next

56
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Give the destination of the image and click next

Select the ingest module and click next

57
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

See the acknowledgement and click finish

Now we check the files recovered

58
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

We see the Deleted Files

Now We Extract/Recover some deleted files

Set a directory for the recovered files

59
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Now we Generate a Report of the Autopsy done

60
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Select a type to store the data and click next. Here we are going to generate the report in Excel.

Now select all results this will generate all the reports and click finish. The other option only generate the
report for tagged one only.

61
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Click on close and open the excel from the directory it is stored

62
LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

63
LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

64
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

PRACTICAL NO. 7
Aim: Using Steganography Tools [S-Tools]
Writeup:
_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

65
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

• Detect hidden information or files within digital images using steganography analysis tools.

• Extract and examine the hidden content.

In this Practical we are going to use the SteganPEG to check the hidden files in the given Image

Create a folder to keep the image and message file and store the txt file and image

Open the SteganPEG and give a password and browse the path of the image

66
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

First we are going to add some files in the captured image

Save the stegged image

67
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Open the saved image with the assigned password and view the image with hidden files

68
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Now we are going to do the stegging process using Command Prompt and viewing the Image using the
WinRAR

Make a zip file of the text file

Go to Command Prompt and Type the Syntax

69
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

C:\Users\bmm\Desktop\New Folder>copy/b stegprac.jpg + stegpractxt.rar

Then create a shortcut for WinRAR on the desktop

Then open the image using the shortcut

Right Click on the image  Open with  Choose another app

Select Choose another app  choose an app on your pc

70
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Then Desktop  Shortcut created of WinRAR and Select Just Once

71
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

View the Extracted File

72
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

PRACTICAL NO. 8
Aim: Mobile Device Forensics
Writeup:
_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

73
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

• Perform a forensic analysis of a mobile device, such as a smartphone or tablet.

• Retrieve call logs, text messages, and other relevant data for investigative purposes.

In this Practical we are going to perform the mobile forensic using the MOBILedit Forensic toolkit

We are going to download the MOBILedit toolkit

Got to the link https://www.mobiledit.com/connection-kit

Then Click on Online Store then Scroll down to the Products

The Price is given below. It is around $1000

74
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Then we go to the software

The price is given below. It starts from $99 to few Thousands of Dollars

75
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Now we are going to start the Practical

Click on connect and Select the type of forensic device to work with. Here we are going with Phone

76
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Click Next and Select the type of Connection with the Mobile Phone. Here we are going to Select Cable
Connection and click Next

77
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Click Next and let it Scan the Device, If Found click Next, If Not Found Perform these steps and Retry

”Go to Phone Settings and open Developer Option and Enable it, and then Allow
USB Debugging”

Then connect it with a connector for efficient data recovery

78
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

We got a device connected

This is the device we are going to use and click on next

79
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Fill the details and browse a directory to store the logs

Then Click on Next then Select the Acquisition we want Here we are going to acquire all the data from
the device

80
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Click on Yes and Wait for the Acquisition to be completed

81
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Open the Case and Organize and decide the Format in which we need the Acquisition

82
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Fill in the details of the Investigator

Select the type of format to display the data. Here we are going to display it in Excel.

83
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

A Success Message will be Prompted

Now we are going to view and analyze the data acquired form the Performed Acquisition

84
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

We have performed of Two Mobile Devices

The First One is the Oppo Reno 2

Second One is the One+ 9

Display of the First Device Oppo Reno 2

Here we can see the Phonebook of the device

85
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

And here we can see the Call Logs

And here we can see the messages on the device

86
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Display of the Second Device One+ 9

Here we can see the Files  Internal Storage  DCIM  Camera

Here we can see the Files  Internal Storage  Pictures

87
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Now we are going to Generate and Analyze the Report

This is the data.log file we created before we started the Acquisition

88
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

PRACTICAL NO. 9
Aim: Email Forensics

Writeup:
_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

89
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

• Analyze email headers and content to trace the origin of suspicious emails.

• Identify potential email forgeries or tampering

Here we are going to use the AccessData FTK

FTK can filter or find files specific to e-mail clients and servers.
You can configure these filters when you enter search parameters.
Because of Jim’s responses to a poor performance review, the CEO of Superior Bicycles,Martha Dax, suspects
he might have obtained sensitive information about the company’s business model that he’s leaking to a
competitor.
Martha asked her CIO, to have an IT employee copy the Outlook .pst file from Jim Shu’s old computer to a
USB drive.
To process this investigation, we need to examine the Jim_shu’s.pst file, locate the message, and export it for
further analysis of its header to see how Jim might have received it.

Recovering Email

Start AccessData FTK and click Start a new case, then click OK.
Click Next until you reach the Refine Case - Default dialog box Click the Email Emphasis button, and
then click Next

Create a new File

90
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Fill the details of the Examiner

Click on all the options and Click Next

91
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Select all the options

Now we have reached the Email Emphasis section

92
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Click Next until you reach the Add Evidence to Case dialog box, and then click the Add Evidence button.
In the Add Evidence to Case dialog box, click the Individual File option button, and then click Continue.

93
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

In the Select File dialog box, navigate to your work folder, click the Jim_shu’s.pst file, and then click
Open.

94
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Give some data

Complete the steps and Click on Next

95
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Click on finish and see the data

96
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

When the Add Evidence to Case dialog box opens, click Next. In the Case summary dialog box, click Finish.
When FTK finishes processing the file, in the main FTK window, click the Email Messages button, and then
click the Full Path column header to sort the records.

97
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

For email recovery follow following steps: Click the E-Mail tab. In the tree view, click to expand all folders,
and then click the Deleted Items folder.

98
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Select any message say Message0001 right click and select option Launch Detached Viewer and you can see
detail of deleted message.

99
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

For analyzing header follow following steps: Click the E-Mail tab. In the tree view, click to expand all folders,
and then click the Inbox folder. In the File List pane at the upper right, click Message0003; as shown in the
pane at the bottom, it’s from Sam and is addressed to [email protected].

100
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Right-click on any message say Message0003 in the File List pane and click Export File. In the Export Files
dialog box, click OK.

101
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

FTK saves exported files in the HTML format with no extension.

Right-click the Message0003 file and click Rename. Type Message0003.html and press Enter

102
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Double-click Message0003.html to view it in a Web browser.

103
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

PRACTICAL NO. 10
Aim: Using Web Browser Forensics
Writeup:
_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

_____________________________________________________________________

104
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

• Analyze browser artifacts, including history files, bookmarks, and download records.
• Analyze cache and cookies data to reconstruct user-browsing history and identify visited websites or
online activities.
• Extract the relevant log or timestamp file, analyze its contents and interpret the timestamp data to
determine the user's last internet activity and associated details.
We are going to use the Browser History Examiner Run it as Administrator..

It is a Paid Software but has a free–trail to get a total of 25 records from all the browsers in the device

Click on Continue Trail

105
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Click OK

This is the Interface of the Application

Go to File  Capture History

106
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

We are going to capture from this device only Select on that and click Next

Select the Browser we want the history and give a directory to save those history extracted files

107
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Here we can see the websites visited

108
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Here we can see the bookmarks

Here we can see the browser settings

Here we can see the cached files

109
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Here we can see the cached images

Here we can the cached webpages

Here we can see the cookies stored

110
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Here we can see the emails used for logins

Here we can see the favicons

Here we can see the searches

111
 LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

Here we see the thumbnails

Here we can see the websites visits

112
LORDS UNIVERSAL COLLEGE
TYBSC CS SEM V – CYBER FORENSIC

113