CSCI 130 Introduction to Computer Forensics Fall 2011
MD5/SHA Lab Assignment

Part I:

• Wed: Collection of the data and preparation of the complaint
• Friday: Presentation of the findings and justification of your complaint and confirmation from the "criminal"

"Criminal - Victim" rules

• Matthew is "criminal" for Nicole
• Nicole is "criminal" for Rachel
• Rachel is "criminal" for Joe
• Joe is "criminal" for Zack
• Zack is "criminal" for Erica
• Erica is "criminal" for Veronica
• Veronica is "criminal" for Matthew

Rules and Requirements

• Step 1:
  • Each student will create a folder on the Desktop. Name this folder CSCI130YOURLASTNAME. Assume that this folder is your business computer.

  • Populate the folder with 7-10 files of different formats and different contents

  • Create 2-3 sub-folders (name of your choice) INSIDE this folder and populate each sub-folder with 2-3 files of different content and format

  • Conduct all required PRE-INCIDENT calculations and store all collected information in SECURE place (Important: this folder is NOT a secure space, since "criminal" can modified the file with PRE-INCIDENT information. Use some other forms of storage - send it by e-mail to yourself, or use flash drive, or save it in DIFFERENT folder)

• Step 2:
  • Switch computers with your "criminal"
  • Now "criminals" will perform the sequence of changes on the content of the folder CSCI130YOURLASTNAME and. "Criminals" must to perform 10 changes on 10 files at least
  • "Criminals" will document all the changes they made in separate file. Again make sure you store it in the SECURE place. Don't leave this file on the victim's computer!

    Important

  • After all changes are done, "Criminals" will run MD5/SHA on the "victim's" folder and collect checksums for all files and sub-folders in the "victim's" folder. When you will run MD5/SHA on "victim's" folder, store the resulting information in the files criminalChangesMD5.rtf and criminalChangesSHA1.rtf (or criminalChangesSHA256.rtf).

    Here are the lines to run:

    md5deep -r CSCI130VICTIMLASTNAME > criminalChangesMD5.rtf ENTER

    sha1deep -r CSCI130VICTIMLASTNAME > criminalChangesSHA1.rtf ENTER

    sha256deep -r CSCI130VICTIMLASTNAME > criminalChangesSHA256.rtf ENTER

    Add this information to the documentation of the changes you made.

• Step 3:
  • Return to your computer and find and document all changes that were made.

    Pay attention, when you will run again MD5/SHA on your folder store the resulting information in the file resultChangesMD5.rtf and resultChangesSHA1.rtf (or resultChangesSHA256)

    Here are the lines to run:

    md5deep -r CSCI130YOURLASTNAME > resultChangesMD5.rtf ENTER

    sha1deep -r CSCI130YOURLASTNAME > resultChangesSHA1.rtf ENTER

    sha256deep -r CSCI130YOURLASTNAME > resultChangesSHA256.rtf ENTER

  • Prepare the detailed complaint
  • Present your information and justify your complaint in front of the class on Monday (you can use Power Point or Word)

• Step 4
  • Each "criminal" will confirm that list of violations that victim found