Quiz 1 Prep

Part 1: Based on Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations document.
• Name two steps involved in forensics analysis of a hard drive
• Briefly explain in your own words the imaging process
• What are 3 categories of computers record.
• Give an example of non-hearsay record

Part 2:
• Convert 17894 to HEX and then to BINARY
• Convert 0xFA1 to BINARY
• Assuming you have a following HEX value in the memory

  HEX Value

  Address	Value
  1000	A0
  1001	C6
  1002	10
  1003	11

  1. Assuming, that the system is Big Endian, find the decimal value of the HEX value written above.

  2. Assuming, that the system is Little Endian, find a decimal value of the HEX value written above

• Assuming you have a following HEX value in the memory

  HEX Value

  Address	Value
  1000	0F
  1001	B1
  1002	A2
  1003	20

  1. Assuming, that the system is Big Endian, find the decimal value of the HEX value written above.

  2. Assuming, that the system is Little Endian, find a decimal value of the HEX value written above

  Part 3 Quiz Preparation

  • Assume that two files were collected as evidence on February 5, 2016. The court day for the case was set for Sept 5, 2018. You would need to present the evidence in the court on Sept 5, 2018. List your actions today and back on February 5, 2016 to prove the integrity of the evidence.
  • Question 2: Assuming you have a following HEX value in the memory

    HEX Value

    Address	Value
    1000	AF
    1001	BC
    1002	E6
    1003	48

    Assuming, that the system is Big Endian, find the decimal value of the HEX value written above. WRITE YOUR FINAL ANSWER in the file Little.txt

    Assuming, that the system is Little Endian, find a decimal value of the HEX value written above . WRITE YOUR FINAL ANSWER in the file Big.txt

  • Calculate the MD5sum for Little.txt and Big.txt and save results in the file your_last_nameQuiz2.txt

  • Add your last name to each file (add it as FIRST line in each file). Recalculate MD5. Save results in your_last_nameQuiz2.txt.
    Did you get the same value? Explain your answer. Write your answer in your_last_nameQuiz2.txt

  • Rename (use mv command) Big.txt with BigNew.txt. Recalculate MD5. Save results in your_last_nameQuiz2.txt.
    Did you get the same value? Explain your answer. Write your answer in your_last_nameQuiz2.txt

  • Copy (use cp command) Little.txt to LittleCopy.txt. Recalculate MD5. Save results in your_last_nameQuiz2.txt.
    Did you get the same value? Explain your answer. Write your answer in your_last_nameQuiz2.txt

  • Summarize which actions will make changes in MD5 value and which actions will not. Write your answer in your_last_nameQuiz2.txt

    Submit the following files: BigNew.txt, Little.txt, your_last_nameQuiz2.txt