Digital Forensics

Mid-Term Practical

Max Mark: 20 Time: 01:20

CO1: To impart understanding of basic Digital Forensics, Locard's exchange

principle and storage types.

CO2: To impart understanding of Digital Evidence Acquisition Essentials, Evidence

Acquisition Basics, Acquisition Types and Methods and Digital Forensics analysis.

Scenario:

Alex's computer fell prey to Cridex, a stealthy malware. Seeking aid from digital
forensics expert Dr. Harper, Alex posed urgent questions. Dr. Harper unveiled the
malware's sophisticated entry via a phishing exploit and its sinister abilities: data theft
and remote access. Tracing its origin, Dr. Harper uncovered the attackers' trail,
despite their cunning tactics. Collaboratively, they purged Cridex and fortified
defenses, imparting vital lessons in cybersecurity vigilance. Through their partnership,
Alex emerged empowered, armed with knowledge to defend against future threats in
the ever-evolving digital landscape.

Q: Run the following commands using volatility:

 Process scan
 Process tree
 DLL List
 Handle Plugins
 LDR Modules
 Process xview
 Connscan
 Memory Dump
 Executable Dump
 Dll Dump

Scenario:

Dr. Harper meticulously scrutinizes Charlie's pendrive, uncovering encrypted files,

suspicious executables, and traces of deleted data. Through forensic analysis, she
reconstructs his digital activities, tracing potential security breaches or malware
infections. Each byte of data holds a clue, guiding her towards the truth behind
Charlie's digital footprint. With expertise and precision, Dr. Harper unravels the
mysteries concealed within the pendrive, providing invaluable insights for the
investigation.

Q1: How many email address are available and write all the emails addresses.
Q2: What is the name of the .EXE file which Charlie had downloaded?
Q3: How many file got deleted?
Q4: How many encrypted files are their in the image ?
Q5: How many suspicious items ?