Autopsy

Introduction

In this case we have to investigate a pen drive and according to the to Police we have to get the..

1.Time of sharing
2. Name of the head of the band.
3. Exchange Place

Tools used

Autopsy

The Sleuth Kit

Open office

Google

Google Chrome

Mozilla Firefox

Virtual-box

Ubuntu 14.04

Preparation of the analysis process

First we have to install a tool with we can investigate. I am going to install AUTOPSY which is very useful and very good tool to investigate.

sudo apt-get install autopsy

 
After, we have to open a new case. After clicking new case now we have to fulfill the options like name of case and investigators names.

 

Add Host.

 

Here we have to write Host name and description,Time zone and Time-skew Adjustment, But I am only going to use write host name and  Time-skew Adjustment.

 
Then click the add host.

 
Add image which we have to investigate.

Here we have to add the location and type of image and Import method.

then click next.

Here we have to calculate the hash value and chose the file system type in this case it is ext.


 
Here we have to confirm that the md5sum is same that we have.



Here comes the main part of case. Where we have to analyze the pen.

1:To find the time of sharing we have to follow these steps.

First click  and then the delete file

After clicking the file we will get the name and time of sharing.

Name : Osvaldo

Time : 02:00

As I am the investigator so I have to save a proof that I founded it so I am exporting the file and after I am going to add a note in which I will add my name and time of access to the file. 7681

Find Image

The first thing that we have to do is search the keyword JFIF from the option of search keyword.

 
As we can see that we got one entry related to this word and it is located at 7681.




So now first we have to write the fragment number which is 7681  and Number of fragments that we are going to use are 12 .we have to click the Data unit and then write the fragment number and number of fragments.




After writing the number click the view and then this window will appear.

Now from this window we have to export the contents. For this we only need to click the Export contents.

After exporting the contents now we have to again write the fragment number which is now 7694.

As we can see that there is no fragment number 7693 related to this file so we are going to search from 7694.

Now we also have to export the contents of these fragments also. When we are done with exporting contents, then go the related directory where we have downloads the files and then open a terminal and write this command

cat name of files * > new filename.jpg

And by doing this we will get the image.

3:To find the exchange place we have to follow these steps.

First click on the script and display the result in ASCII Strings and see the blocks.

After seeing the result write the fragment number which is 527 and Number of fragments that we are going to test are 1.

 
When the result shown then export it.

After exporting now write the fragment number again 527 but this time Number of fragments will be 10 and export the result.

ç

As we can see that the file type is gzip but the result that we have download is in .raw

So we have to change it to .gz

After this open terminal and write these commands

gzip -d vol1Fragments527.gz

gzip -d vol1Fragments536.gz

By doing this we will get the file.

 
But one thing is remaining and is to change the file to place.odt as it show in the file type.

After changing the name when we will open it, it will ask to write the password.

To get the password now take a look back to the strings of image

 

in the last picture we can see a line start from pw=ujl&5632, by seeing pw we can assume that it will be the password , because mostly people use it as in short form .

So as we got the password now write the password and open the file.

And here we can see that we got our answer .