DIGITAL FORENSICS Aashirwad Verma 2K22CSUN01220

CSTI-4

Q1: Using Volatility, analyze the memory dump of a compromised system and describe the process
you would follow to identify malicious processes, suspicious network connections, and any
injected code or rootkits present in the memory image by these commands:

1. Imageinfo

2. Pslist

3. Psscan
4. Pstree

5. Psxview
6. Cmdscan

7. Consoles

8. Procdump

Q2) Imagine you have data of a compromised system, and you suspect that important data
was stored in files that were deleted by the attacker. Using a file carving tool describe the
steps you would take to recover these deleted files from the memory dump. Also, discuss
the potential limitations or challenges you might encounter during the file carving process
and how you would address them to maximize data recovery success.
1. L0_Audio.dd
2

2. L0_Archive.dd
4

3. L0_Graphic.dd
3
4. L1_Video.dd

5. L2_Documents.dd
The potential challenges encounter during the file carving process:-
• Unknown File Sizes: If the precise size of a file is unknown, you may need to calculate it from
different header
fields.

• File Fragmentation: Recovering fragmented files may be challenging, especially for larger files
that are split into
smaller clusters due to filesystem fragmentation
• File Format Variability: Not all file types have well-known headers and footers, which may
require using
maximum file size options for carving
• Lack of Metadata: If there is no filesystem metadata available, data carving becomes the only
way to recover
files, which can be more complex and less successful
To maximize data recovery success, we can:-
• Use multiple file carving tools to cover a wider range of file types and increase the chances of
recovery
• Understand the filesystem structure and fragmentation to better predict the success of
recovering larger files
• Regularly update and fine-tune the file carving tool's configuration to improve its ability to
identify and extract
deleted files