Digital Forensics Lab Report
Lab 1: To Calculate MD5/SHA1/CRC-32/SHA-256/SHA-512/SHA-384 Hash
of Files
Objective
To compute different cryptographic hash values of files using standard hashing algorithms
(MD5, SHA-1, CRC-32, SHA-256, SHA-512, and SHA-384).
Concepts
- Hashing ensures integrity verification of files.
- Different algorithms provide different levels of collision resistance and security.
- Common tools: md5sum, sha1sum, sha256sum, openssl, or forensic tools like
FTK/Autopsy.
Procedure
- Select a file (e.g., test.txt).
- Use command-line tools or forensic software to generate hash values (md5sum, sha1sum,
sha256sum, etc.).
- Record all hash values for verification.
Output
Example Hashes:
MD5: d41d8cd98f00b204e9800998ecf8427e
SHA-1: da39a3ee5e6b4b0d3255bfef95601890afd80709
CRC-32: 00000000
SHA-256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA-512: cf83e1357eefb8bd...
SHA-384: 38b060a751ac9638...
Conclusion
Different hashing algorithms produce unique fixed-length outputs for the same input. These
hashes help verify file integrity and detect tampering.
Lab 2: To Examine a Partition at Physical Level of OS
Objective
To explore and analyze partition details at the physical storage level.
Concepts
- Disk partitions store system and user data.
- Forensic tools allow viewing raw sectors and partition tables.
- Important metadata includes MBR, GPT, boot sector, and file system structures.
Procedure
- Use tools like fdisk -l, parted, or forensic tools (FTK Imager, Autopsy).
- View raw hex data of partitions using a hex editor (e.g., WinHex, HxD).
- Identify partition type, size, and file system format.
Output
Partition details with start sector, size, type, and raw data view.
Conclusion
Examining partitions at the physical level provides low-level insight into file system
structure and helps detect hidden or deleted data.
Lab 3: Capturing an Image using Forensic Acquisition Tool
Objective
To perform forensic acquisition of a storage device.
Concepts
- Acquisition involves creating a bit-by-bit copy (image) of the storage media.
- Ensures data integrity and prevents modification of original evidence.
- Tools: FTK Imager, Autopsy, EnCase, dd command.
Procedure
- Connect suspect storage device in read-only mode.
- Use FTK Imager (or dd) to create .E01 or .dd image.
- Verify image integrity using hash values (MD5/SHA).
Output
Image file generated (e.g., disk_image.E01) with verified hash values.
Conclusion
Forensic acquisition preserves original data in an admissible format for court use.
Lab 4: To Analyze Images from Forensic Acquisition Tools
Objective
To analyze disk images acquired during forensic investigation.
Concepts
- Analysis includes searching for files, deleted data, registry entries, and logs.
- Tools: Autopsy, FTK, EnCase.
Procedure
- Load the forensic image into Autopsy or FTK.
- Browse partitions, file system, and recover deleted files.
- Extract metadata, timestamps, and user activities.
Output
Recovered files, logs, and detailed analysis screenshots.
Conclusion
Disk image analysis reveals hidden or deleted evidence that is crucial for investigations.
Lab 5: To Generate a Forensic Case Report Submitted to Court
Objective
To prepare a professional forensic report for legal submission.
Concepts
- Reports must be clear, accurate, and legally valid.
- Includes case details, acquisition method, findings, and conclusion.
Procedure
- Document case information (Case ID, Investigator, Date).
- Include acquisition details (tools, hashes, procedures).
- Present findings (recovered files, metadata, timeline).
- Conclude with investigator’s observations.
Output
Sample Report Headings:
- Case Information
- Tools Used
- Evidence Description
- Analysis Results
- Conclusion & Recommendations
Conclusion
A structured forensic report provides reliable evidence presentation in court.
Lab 6: To Trace Files from Packet Captures from Computer Network
Objective
To analyze packet capture files (.pcap) and extract transferred files.
Concepts
- Packet capture tools (Wireshark, tcpdump) record network traffic.
- Forensic analysis allows reconstruction of transmitted files.
Procedure
- Open .pcap file in Wireshark.
- Apply filters (e.g., http, ftp, tcp.stream eq).
- Export reconstructed files from captured sessions.
Output
Recovered files (e.g., images, documents) extracted from network traffic.
Conclusion
Packet analysis helps recover transferred files and detect malicious activities in networks.
