SEC-435-LAB 3

Course: SEC-435-901 Digital Forensics

Hands on project 8-1
In this assessment I have learned about how to use one of very famous digital
forensic tool “Autopsy” this tool has a huge area to investigate for digital
footprints. Here, I have performed experiment to extract different type of image
file from .dd file with non-jpeg extensions and perform action like searching
through the image and marking the tags. Furthermore, autopsy report generation
was also the part of this report.
1. Start Autopsy and create case

Figure 1 create new case

Figure-2 setting case number and examiner

From the above mentioned figures, this is how we can start and create a new
case in autopsy, and how we can add additional information like case number
and examiner details.

2. Adding data source

Figure-3 adding data source

 Figure-4 select configuration modules

3. Keyword search

Figure-5 adding keyword to search

From above figure we can see there are different searching criteria are defined
so for this task I have select substring match it will search thoroughly and will
find every file that contains the mention content.

4. Comment or tag the file

 Figure-6 tag the image

5. Create report

Figure-7 generating report

Figure-8 final report

Once all the steps done the last step is always to maintain report so here we
have plenty of report option available, you can see from above figure-8 the
html results generated report.
Hands on project 8-2
This project is linked with previous task the same tool “autopsy” will use in this
task as well and in this task the file to examine is different from the task 1 and in
this task we will use the different search parameter or filter to find the results
although rest of other things will remain same like tagging the findings and
generating the report.
1. Start autopsy and create new case
 Figure-09 creating new case

2. Select data source

Figure-10 select data source

3. Keyword search
 Figure-11 search keyword with exact match

As compare to task 1 here the search filter is selected as Exact match so only
files with exact keyword match in their meta data will came up as result.

4. Comment the searched file

 Figure-12 comment as similar file with matching criteria

5. Additional mark

Figure-13 mark additional similar files

6. Generate report
Figure- 14 generate report

Figure-15 generated report

Hands on project 8-3
In the third activity 8-3 I asked to use IrfanView, a tool use to open graphic files
and save them in a compressed graphic format different from the original one. So,
I have added bitmap image files and save them with modified extension as per
task requirements and then perform a deep comparison between generated files
to check the quality of file after and before converting to different file format.
1. Start Irfanview and open file

Figure-16 Start Irfanview and open file

2. Save image as jpg

 Figure- 17 save the bmp image as jpg

3. Save jpg as bmp in same location

Figure- 18 spider2.bmp file

4. Compare the files

Here, you can see that 2nd file is created from spider.jpg to spider2.bmp after
open these three files in Irfanview there no as such difference came up except
size, the jpg file is relatively less in size as 63KB where are bmp files are
6076KB each.
 5. Open flower.gif file

Figure-19 open flower gif file

6 & 7. Save gif as jpg and check difference

Yes, there is major difference is size and in jpg content of image get static as in gif
image flower was blossom.

8. Open carton.bmp file

 Figure- 20 open cartoon.bmp file

9, 10 & 11. Save catoon.bmp as catoon.gif and then cartoon.gif as

catoon2.bmp, then open all and compare

Figure-21 open and compare

There is not difference seen as quality, size everything still same.

Hands on project 8-4
In this project 8-4 tool named as S-tool is used to practice steganography methods
like hiding content in image file, so by using this tool in this project I have hide
Findme.txt file to an associate image file and then save that file to appropriate
directory with defined passphrases set.
1. Start s-tool

Figure-22 start s-tool

2. Open RUSHMORE.bmp file

 Figure-23 open RUSHMORE.bmp file

3 & 4. Hide txt file in bmp file & fill pass phrase

Figure-24 Hide txt file in bmp file & fill pass phrase

5 & 6. Save hidden file and exit s-tool

 Figure-25 save hidden data file

Hands on project 8-5

In this project along with the same tool that used in project 8-4 a DOS terminal is
also used. Here, instead of hiding a text file in image file I have hide the rft file
with the same methodology as from previous task but additionally, along with this
activity a brief comparisons report was also generated from DOS- windows
terminal.
1. Open mission.bmp file
 Figure- 26 open mission.bmp file

2 & 3. Drag rtf file and fill phrase

Figure-27 Drag rtf file and fill phrase

 4. Save hidden data file and exit s-tool

Figure-28 Save hidden data file

Compare file from DOS

1 & 2. Open CMD and move to task path

Figure-29 Open CMD and move to task path

 3. compare the file

Figure-30 creates compare txt file

4. View Mission-compare.txt file and exit

Figure-31 View Mission-compare.txt file