Proj X2: Static Acquisition (15 pts.)

What You Need for This Project

Getting the Evidence File

Download the evidence file here:

Proj X2 Evidence File

Save the ProjX2-sparse.zip file on your desktop.

Calculate the MD5 hash of the file and verify that it matches the value shown in the image below.

DO NOT TURN IN THIS IMAGE

Extracting the Virtual Hard Disk

You are not done! This file contains a virtual hard disk, and your task is to create a static image of that disk.

Unzip the file to extract the virtual hard disk inside.

Imaging the Evidence Drive

Mount the evidence drive in an appropriate virtual machine. Use any technique you like to make a correct forensic image of the drive. Calculate the MD5 hash of your forensic image.

Checking Your Answer

The correct MD5 hash ends in 74f

Saving a Screen Image

Make sure your screen shows the MD5 of the image, from whatever tool you chose to use.

YOU MUST SUBMIT AN IMAGE OF THE WHOLE DESKTOP TO GET FULL CREDIT!

Turning in your Project

Email the image to me as an email attachment. Send it to: cnit.121@gmail.com with a subject line of "Proj X2 From Your Name", replacing Your Name with your own first and last name. Send a Cc to yourself.

Last Modified: 4-13-14 1:44 pm