Proj X2: Static Acquisition (15 pts.)
What You Need for This Project
- VMware Player
- Any other tools you choose to use
Getting the Evidence File
Download the evidence file here:
Proj X2 Evidence File
Save the ProjX2-sparse.zip file on your desktop.
Calculate the MD5 hash of the file and verify that it matches the value shown in the image below.
DO NOT TURN IN THIS IMAGE
Extracting the Virtual Hard Disk
You are not done! This file contains a virtual hard disk, and
your task is to create a static image of that disk.
Unzip the file to extract the virtual hard disk inside.
Imaging the Evidence Drive
Mount the evidence drive in an appropriate virtual machine.
Use any technique you like to make a correct forensic image of the drive.
Calculate the MD5 hash of your forensic image.
Checking Your Answer
The correct MD5 hash ends in 74f
Saving a Screen Image
Make sure your screen shows the MD5 of the image, from whatever tool you chose to use.
YOU MUST SUBMIT AN IMAGE OF THE WHOLE DESKTOP TO GET FULL CREDIT!
Turning in your Project
Email the image to me as an email attachment. Send it to: firstname.lastname@example.org with a subject line of "Proj X2 From Your Name", replacing Your Name with your own first and last name. Send a Cc to yourself.
Last Modified: 4-13-14 1:44 pm