Question

Rules of Engagement: The work must be performed in a Windows OS command line tools only (except for FTK Image to mount the image, and WinHex or other hex tool, to view headers). No PowerShell. If the hashing tool you use has recursion, you may not use the recursive functionality. Hand in a brief report as if you were the investigator. This report should go over any research you did, tasks performed, commands used, evidence found, if any, location of evidence, and conclusions drawn. You may collaborate with other students on completing the lab. The report will be an individual effort. If you collaborated with another student on completing the lab, include that information in your report. Scenario: You are employed as a private contractor for the Department of Defense. You have been assigned to examine a drive image that belongs to an employee of the Acme Widget company. The MD5 hash for the drive image is ac7570675c11442e0235cf8a7116b7ef. Acme Widget has been supplying parts for the Zumwalt class destroyer, and it is believed the employee may have copied classified files to his computer. The file that is thought to have been copied is a detailed photo of the USS Zumwalt. The MD5 hash for this file is E1E64F2175991722EF80AF7764AF9A75. The suspect may have taken steps to hide the file, so the name and extension on the file may not be accurate. Determine if the file is on the image provided. Hints: DOS / CMD For Loops Ping sweep loop example for /L %n in (250,1,255) do ping 10.127.127.%n Don't use /L in your loop Read for /? Need a list of files dir /s /b Find can help you find things in a file. Use /I option to make it case insensitive. <command 1> | <command 2> Output of command 1 becomes input of command 2 [command] > output.txt Redirects standard output of command to output.txt. If the file exists, it overwrites it. [command] >> output.txt Redirects standard output of command to output.txt. If the file exists, it appends to it.

          Rules of Engagement: The work must be performed in a Windows OS command line tools only (except for FTK Image to mount the image, and WinHex or other hex tool, to view headers). No PowerShell. If the hashing tool you use has recursion, you may not use the recursive functionality. Hand in a brief report as if you were the investigator. This report should go over any research you did, tasks performed, commands used, evidence found, if any, location of evidence, and conclusions drawn. You may collaborate with other students on completing the lab. The report will be an individual effort. If you collaborated with another student on completing the lab, include that information in your report.

Scenario: You are employed as a private contractor for the Department of Defense. You have been assigned to examine a drive image that belongs to an employee of the Acme Widget company. The MD5 hash for the drive image is ac7570675c11442e0235cf8a7116b7ef. Acme Widget has been supplying parts for the Zumwalt class destroyer, and it is believed the employee may have copied classified files to his computer. The file that is thought to have been copied is a detailed photo of the USS Zumwalt. The MD5 hash for this file is E1E64F2175991722EF80AF7764AF9A75. The suspect may have taken steps to hide the file, so the name and extension on the file may not be accurate. Determine if the file is on the image provided.

Hints:
DOS / CMD For Loops
Ping sweep loop example
for /L %n in (250,1,255) do ping 10.127.127.%n
Don't use /L in your loop
Read for /?
Need a list of files
dir /s /b
Find can help you find things in a file. Use /I option to make it case insensitive.
<command 1> | <command 2>
Output of command 1 becomes input of command 2
[command] > output.txt
Redirects standard output of command to output.txt. If the file exists, it overwrites it.
[command] >> output.txt
Redirects standard output of command to output.txt. If the file exists, it appends to it.

Added by John J.

Question

Please give Ace some feedback