Bristol Community College

Computer Information Systems Department

CIT-255 - Digital Forensics

Forensic Images for hands-on exercises

NIST NSRL Hash Set

• NSRL-266m-computer-Autopsy.zip
  
  Instructions

  The NSRL-266m-computer-Autopsy.zip package contains an index of the NIST NSRL (nsrl.nist.gov), including minimal, Android, and IOS hash sets. You can use this in Autopsy to ignore files that are known.

  To use this index in Autopsy:
  
  Open the hash database options via Tools -> Options -> Hash Database.
  
  If you already have an NSRL database, then select it and press "Delete Database".
  
  To add this database index, choose "Import Database" and choose the ".idx" file included in this ZIP file.
  
  An example file would be NSRLFile-240m.txt-md5.idx.
  
  The number in the name will change depending on the version of the database (it is released on a quarterly basis).
  
  Verify that Autopsy detected it as an NSRL database and that "Enable for Ingest" is enabled.

Autopsy Hands-on Training

• Download device1_laptop.e01
  • NOTE: The actual "device1_laptop.e01" link is referring to
  • https://bristolccedu-my.sharepoint.com/:u:/g/personal/ikholodov11_bristolcc_edu/EVh_yc5jLhBCjUgUYdogeK0Bi1jXwRawWkXCT6xKzEeSIg?e=Nbn5gP
  • which is a "sharepoint" file on Microsoft OneDrive Personal Cloud Storage.
  • Instead of attempting to download, you need to click on this link first.
  • This opens a web page with large "device1_laptop.e01" icon in the middle. It also says this file has no preview. NOTE: sometimes it takes a few seconds for this page to display all options, be patient and wait a few seconds.
  • There are two options: in the upper left corner of the page there is a "Download" button. Also, there is another "Download" button at the bottom of the page. Both can be used to download the actual file.
• Download device2_mediacard.e01
• Handout: Autopsy Hands-on Training

Photo Forensics: Exif, File Carving, Tagging, Hashing, Image Gallery

• Download Adroit24Binstall.zip
• The file contains demo version of Adroit Photo Forensics software.
  You don't need to install it.
  It includes sample forensic image apf_demo_image.img for practical excersises Exif info and file carving.
  MD5 verification hash: 08458ef39ea88636d0fd29f0cadf7de6
  SHA1 verification hash: 34ec33cfe9436470425bb413e6717c2da14a7693
•  
• Related handouts:
  Autopsy Organizing Data Into a Case (File Carving)
  Autopsy Hash Lookup Ingest Module
  Autopsy Miscellaneous Modules (Exif)
  Autopsy Image Gallery Interface
  Adroit Photo Forensics (software demo version).

Windows Registry Analysis

• Download precious.zip and extract precious.001 file.
  MD5 verification hash: 8e54fc1a861c072ca5c54ba8fb0cbc77
  SHA1 verification hash: 582c4968ed321a4e22da7fa1e5723dd0c684afab

Discarded floppy (Klaus Koptstadt)

• Download dd_images.zip and use mod1-3.dd file.
• Handout for Klaus Koptstadt Investigation

Beryl Tjakami Investigation

• Download Beryls_Thumbdrive.zip
• Handout for Beryl Tjakami Investigation

Candace Doe Investigation

• Download CandaceDoeFloppy.zip
• Handout for Candace Doe Investigation and Forensic Media Examination Report

Assignment a10, Clyde Barrow Investigation

• Download DD image: CBARROW.zip
• Clyde Barrow HDD acquisition hashes:

       MD5:   0b0faa556abe4d57c23ee2a230ccb838
      SHA1:   847f4ca1261eda079d9889f6f823f7eeaef44026
  

Assignment a20, Clyde Barrow and Bonnie Parker Investigation

• Download DD image: BPARKER.zip (size 595 MB).
• Bonnie Parker HDD acquisition hashes:

       MD5:   91b859efd572df88cdbc6f68aa15c6be    
      SHA1:   a60e915356518259f27dbc72c83a4d386da49f7f