Forensic Report

CHAPTER 8 Recovering Graphics Files 373

Hands-On Projects

Create the C:\Work\Chap08\Projects folder on your system before starting these projects. If necessary, copy all data files from the downloads section for this chapter (on the student companion site for this book) to your work folder.

Hands-On Project 8-1 In this project, you use Autopsy for Windows to locate and extract JPEG files with altered extensions. Some of these files are embedded in files with non-JPEG extensions. Find the C08frag.dd file in your work folder, and then follow these steps:

1. Start Autopsy for Windows, and click the Create New Case button. In the New Case Information window, type C08frag in the Case Name text box, and click Next. Enter C08Frag for the case number and your name as the examiner, and then click Finish.

2. In Add Data Source window, click Disk Image or VM file in the Select Type of Data Source to Add section, if necessary, and then click Next. In the Select Data Source window, click the Browse button. In the Open dialog box, navigate to your work folder, and click C08frag.dd. Click Open, and then click Next. Accept all the default selections in the Configure Ingest Modules window, and click Next and then Finish.

3. Click the Keyword Search down arrow at the upper right. Type jfif in the text box, click the Substring Match option, and then click Search.

4. Click each file in the search results that doesn’t have a .jpg extension. Then examine the contents of each file to find any occurrences of a JFIF label. Right-click a file with a JFIF label, point to Tag Files, and click Tag and Comment. In the Comment text box, type Recovered hidden .jpg file, and then click OK. Repeat this procedure for each file with a JFIF label.

5. Click Generate Report. Click the Results - HTML option button for the report format, and then click Next. Click All Results, and then click Finish. Click the report link, and examine your report in the browser window that opens.

6. Exit Autopsy for Windows, saving your project when prompted.

Hands-On Project 8-2 In this project, you continue examining the files found by IT staff at Superior Bicycles. In the in-chapter activity, you recovered three files containing zzzz for the first 4 bytes of altered JPEG files. These altered files had different extensions to hide the fact that they’re graphics files.

Find the C08carve.dd file in your work folder. This image file is a new drive acquisition the IT staff made. The CEO wants to know whether any similar files on this drive match the files you recovered from the first USB drive. Because you know that the files you recovered earlier have zzzz for the first 4 bytes, you can use it as your search string to see whether similar files are on this drive.

1. Start Autopsy for Windows, and click the Create New Case button. In the New Case Information window, type C08carve in the Case Name text box, and click Next. In the

68944_ch08_hr_339-376.indd 373 3/15/18 2:37 PM

Copyright 2019 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.

Nelson, B., Phillips, A., & Steuart, C. (2018). Guide to computer forensics and investigations. Retrieved from http://ebookcentral.proquest.com Created from csuau on 2020-05-06 16:55:22.

C op

yr ig

ht ©

2 01

8. C

en ga

ge L

ea rn

in g

U S

. A ll

rig ht

s re

se rv

ed .

CHAPTER 8 Recovering Graphics Files 374

Additional Information window, type the date in the Case Number text box and your name in the Examiner text box. Click Finish.

2. In the Select Data Source window, click the Browse button, navigate to your work folder, click c08carve.dd, and then click Open. Then click Next.

3. Next, click the Keyword Search down arrow. In the text box, type zzzz, click the Exact Match option button, and then click Search.

4. Click each file in the search results to display its contents. If the file contains zzzz at the beginning of the sector, right-click the file, point to Tag Files, and click Tag and Comment. In the Comment text box, type Similar file, and then click OK.

5. Click the gametour5.exe file. Ctrl+click to select gametour1.exe, gametour2.exe, gametour3.exe, gametour4.exe, and gametour6.exe. Right-click the selection, point to Tag Files, and click Tag and Comment. In the Comment text box, type Additional similar files, and then click OK.

6. Click Generate Report. Click the Results - HTML option button, and then click Next. Click All Results, and then click Finish. Examine the results in the browser window, and then exit Autopsy.

Hands-On Project 8-3 In this project, you use IrfanView to open graphics files and save them in a compressed graphics format different from the original format. You should note any changes in image quality after converting files to a different format. Download IrfanView from www.irfanview.com and install it, and then follow these steps:

1. Start IrfanView. Click File, Open from the menu. In the Open dialog box, navigate to your work folder, and then double-click SPIDER.bmp to open the file.

2. Click File, Save as from the menu. Change the file type to JPG and save the file as Spider.jpg in the same location.

3. Save Spider.jpg as Spider2.bmp in the same location. 4. Open these three graphics files in new sessions of IrfanView and compare the files.

Document any changes you notice. 5. Open FLOWER.gif from your work folder, and save it as Flower.jpg in the same

location.

Tip

If your screen is cluttered with too many open IrfanView windows, close a few that you’re no longer working with.

6. Save Flower.jpg as Flower2.gif in the same location. 7. Open these three graphics files in new sessions of IrfanView, and document any

changes you see when comparing the files.

68944_ch08_hr_339-376.indd 374 3/15/18 2:37 PM

Copyright 2019 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.

Nelson, B., Phillips, A., & Steuart, C. (2018). Guide to computer forensics and investigations. Retrieved from http://ebookcentral.proquest.com Created from csuau on 2020-05-06 16:55:22.

C op

yr ig

ht ©

2 01

8. C

en ga

ge L

ea rn

in g

U S

. A ll

rig ht

s re

se rv

ed .

CHAPTER 8 Recovering Graphics Files 375

8. Open Cartoon.bmp from your work folder, and save it as Cartoon.gif in the same location.

9. Save Cartoon.gif as Cartoon2.bmp in the same location. 10. Open these three graphics files in new sessions of IrfanView, and document any

changes you see when comparing the files. 11. Exit all instances of IrfanView. Summarize your conclusions in a brief report and submit

it to your instructor.

Hands-On Project 8-4 In this project, you use S-Tools4 to create a steganography file for hiding an image. Download S-Tools4 from http://packetstormsecurity.com/files/21688/s-tools4.zip.html or www.4shared.com/ zip/q764vcPu/s-tools4.htm, install the program, and then follow these steps:

1. In File Explorer, navigate to where you installed S-Tools4, and start the program by double-clicking S-Tools.exe. If necessary, click Run, and then click Continue, if necessary.

2. Drag RUSHMORE.bmp from your work folder to the S-Tools window. 3. To hide text in the RUSHMORE.bmp file, drag Findme.txt from your work folder to the

RUSHMORE.bmp image. 4. In the Hiding dialog box, type FREEDOM in the Passphrase and Verify passphrase text

boxes, and then click OK. A hidden data window opens in the S-Tools window. 5. Right-click the hidden data window and click Save as. Save the image as Steg.bmp in

your work folder. 6. Close the Steg.bmp and RUSHMORE.bmp windows, but leave S-Tools open for the next

project.

Hands-On Project 8-5 In this project, you use S-Tools4 to create a secret message in a bitmap file and compare this steganography file with the original file by using the DOS comp command. You need S-Tools4 and the Mission.bmp and USDECINP.rtf files in your work folder. First, follow these steps to create a steganography file:

1. If you have exited S-Tools4, start it by double-clicking S-Tools.exe in File Explorer. 2. Drag Mission.bmp from your work folder to the S-Tools window. 3. Next, drag USDECINP.rtf from your work folder to the Mission.bmp image. 4. Type hop08-5 in the Passphrase and Verify passphrase text boxes, and then click OK.

A hidden data window opens in the S-Tools window. 5. Right-click the hidden data window and click Save as. Save the image as

Mission-steg.bmp in your work folder. Exit S-Tools.

Next, you use the DOS comp command to compare these two files and redirect the output to a text file for further analysis:

1. To open a command prompt window in Windows, click the Search icon, type cmd, and then press Enter. (In earlier Windows versions, you can click Start, type cmd in the “Search for programs and files” text box, and then press Enter.)

68944_ch08_hr_339-376.indd 375 3/15/18 2:37 PM

Copyright 2019 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it.

Nelson, B., Phillips, A., & Steuart, C. (2018). Guide to computer forensics and investigations. Retrieved from http://ebookcentral.proquest.com Created from csuau on 2020-05-06 16:55:22.

C op

yr ig

ht ©

2 01

8. C

en ga

ge L

ea rn

in g

U S

. A ll

rig ht

s re

se rv

ed .