Security Project 2

Working with forensics disk images

Summary: We will be looking at forensic disk images. You will compare files that are visible with a standard disk mount with those that are visible using the photorec tool

Due: March 7th 2014 by 11:55pm


Get the disk Image (Check the moodle page for this project).
These images are in Encase expert witness format

  1. Use PhotoRec to get a directory tree of all of the files on the disk image (deleted or not)
  2. Mount the disk image normally. 
    1. Directions for mac users (a bit complex)
    2. windows users can get a 14 day trial for mountimage
    3. Here are some directions for debian/ubuntu/linux mint
      1. note that for linux you need to have the libewf library installed to use directly on the .E01 file - otherwise you will have to convert the E01 file to a .dd file.
  3. Write a python program to make a text file with all of the non-deleted files from the disk.
  4. Use your python program on the directory created by photorec to get a text file with the file list from the photorec run
  5. compare the two lists, either with a diff tool or with a second python program.
  6. Write up a short paper with the following information


put your writeup, your python program, and its output text files into a folder named <your name>Project2

zip up that folder and submit the file via moodle.