Forensic Mission 1

[limdis]

Requirements:
Knowledge of hard disk architecture, file carving utility.

Forensic data recovery is the goal of this mission. There are many different ways to extract the deleted data and you may need to try more than one method before you recover all the necessary files needed in order to complete the mission. You may discuss different tools and provide assistance on how to properly utilize them; but do not post specific 'how to' details on the challenge itself.



Want to see something specific or have ideas for new challenges? Post them here

Do not post spoilers!

[agorasecurity]

I've liked this challenge.
I've used DFF and find some stuff on the file, anyhow I think I have to find some extra files and I haven't found them yet (but I think I have an idea of what the name and format of that file is, anyhow I'm not sure).
What tools have you used? What do you recommend?

[Goatboy]

This can be done using open source command-line tools, which is how I prefer to do forensics. scalpel and foremost are nice for general file carving, and photorec is good for, go figure, photos.

[limdis]

I haven't used DFF before but I will check it out. Some tools used with a default setting will not keep corrupted files in the carving results, which can make or break a forensic recovery if you miss it later. Depending on what you are using you can change that. Keep at it agorasecurity!

[Blakrover]

Just wanted to say thanks for this challenge, had a load of fun doing this!

[slaingod]

I had a good bit of fun working this one. I had been testing the new Kali Linux distro release and actually had a harder time trying to do this using DFF and Scalpel. I found using free Windows apps worked much faster. I used OSFMount and Recuva. I think as "limdis" stated, I had some issues with DFF being able to recover or display some of the files. But I don't have much experience with DFF. So don't take that to heart, I may just need to RTFM.

It was fun, but it seemed like a data recovery mission. Not really a forensics mission. We were not looking for who tried to erase her drive. We only were recovering data for the end user.

I believe the techniques are very similar, definitely. So this is a very good mission for practicing forensics techniques. I would like to see missions that are related to the investigation of a wide variety of "computer crimes".

I think this might be fun to try to design missions for this.

-Slaingod

[-Ninjex-]

I had been testing the new Kali Linux distro release and actually had a harder time trying to do this using DFF and Scalpel.

I had no issues using scalpel to complete this challenge. So for all who read that tad bit, don't be discouraged to dive into it

[fashizzlepop]

It was fun, but it seemed like a data recovery mission. Not really a forensics mission. We were not looking for who tried to erase her drive. We only were recovering data for the end user.

Definitely on our scope for further Forensic missions. Don't worry.

[slaingod]

I had been testing the new Kali Linux distro release and actually had a harder time trying to do this using DFF and Scalpel.

I had no issues using scalpel to complete this challenge. So for all who read that tad bit, don't be discouraged to dive into it

I actually went back and tried this with SIFT, that was put together by SANS Institute. I Had no issues with DFF or Scalpel. The Kali Linux version was missing libraries for DFF. As for Scapel, I removed and reinstalled it and had no more issues with it either.


-Slaingod

-- Tue Jan 28, 2014 3:33 pm --

It was fun, but it seemed like a data recovery mission. Not really a forensics mission. We were not looking for who tried to erase her drive. We only were recovering data for the end user.

Definitely on our scope for further Forensic missions. Don't worry.

I found on the SANS DFIR website <http://digital-forensics.sans.org/community/challenges>, they have a digital forensics challenge or "mission". Maybe this is something that can help for ideas for more forensics missions. Hope this can help!

[gsingh2011]

Is RAR cracking required? That's what I'm stuck on right now.