Digital forensics hands on and case projects

7-1 case project

Research and compare forensics tools that can examine Mac, iPod, and iPhone devices. Create a table listing the features they have in common, differences in functions, and price. Write a short paper stating which one you would choose if you were an investigator for a small firm, and explain why.

7-2 case project

This chapter introduced Autopsy for Windows, which is freeware. Compare it with OSForensics and another free tool of your choice. Describe how each tool performs in Linux based on research you do using blogs, user groups, and user manuals.”

8-5 hands on project

In this project, you use S-Tools4 to create a secret message in a bitmap file and compare this steganography file with the original file by using the DOS comp command. You need S-Tools4 and the Mission.bmp and USDECINP.rtf files in your work folder. First, follow these steps to create a steganography file:

1.
If you have exited S-Tools4, start it by double-clicking S-Tools.exe in File Explorer.

2.
Drag Mission.bmp from your work folder to the S-Tools window.

3.
Next, drag USDECINP.rtf from your work folder to the Mission.bmp image.

4.
Type hop08-5 in the Passphrase and Verify passphrase text boxes, and then click OK. A hidden data window opens in the S-Tools window.

5.
Right-click the hidden data window and click Save as. Save the image as Mission-steg.bmp in your work folder. Exit S-Tools.

Next, you use the DOS comp command to compare these two files and redirect the output to a text file for further analysis:

1.
”
“To open a command prompt window in Windows, click the Search icon, type cmd, and then press Enter. (In earlier Windows versions, you can click Start, type cmd in the “Search for programs and files” text box, and then press Enter.)

2.
Change to your work folder by typing cd Work Chap08Projects (substituting the path to your work folder) and pressing Enter.

3.
Type comp Mission.bmp Mission-steg.bmp > Mission-compare.txt and press Enter, and then at the Compare more files (Y/N) ? prompt, type n and press Enter.

4.
In File Explorer, navigate to your work folder, and open the Mission-compare.txt file to see what discrepancies were found. When you’re finished, close the file, and exit the command prompt window by typing exit and pressing Enter.

5.
To complete this project, write a one-page report on the number of mismatches and the deviation in each mismatch between the two files. In addition, state your observations of the differences in the two files, such as hexadecimal values and their patterns.