DIGITAL FORENSICS:Investigation using OSForensics

DIGITAL FORENSICS: Investigation using OSForensics (Part1)

 

Step 1 - Download USB Drive Images

In this task, you will download the USB drive images from a local intranet site.

These USB drive images were collected from digitalcorpora.org web site.
Right-click USB zip file and select Extract All…

Step 2

Click Start charm to access the Start screen.

When Start screen opens, type: OSforensics  On the OSForensics welcome message box, click Continue Using Free Version.

OSForensics

Step 3

In the New Case dialog box, enter your name in the Investigator text box. In the Case Name text box, type CF-DFE-002 USB drive.

CF-DFE-002

Step4

Click the Add Device button to open the “Select device to add” dialog box, and then click the Image File option button. Click the browse button, navigate to the folder you copied images to, and click  work-usb-2009-12-11.E01. Click Open.

Image File

work-usb-2009-12-11.E01

Step 5

Click the  work-usb-2009-12-11.E01 filename at the lower right, and then click the Open button to the left to open the File System Browser window.

Step 6

In the Select a partition in the image dialog box asking which partition to use, leave the default setting use entire image file, and then click OK.

Step 7

Click the File Name Search icon in the File System Browser window or the left pane of the main window. In the Search String text box, type Charlie*. On the far right, click the Search button.

 

File Name Search

Step 8

On the Browse for Folder dialog box, ensure that Devices in case refers to  work-usb-2009-12-11.

Click OK. Back on File Name Search window, click Search.

 

Step 9

After a few moments a list of files found in USB drive is displayed.

Step 10

The files displayed in Thumbnails view.

Click Timeline tab.

Timeline

Create Index

To create an index of files found in the user’s USB drive image, perform the following steps:

Step 11

Click the Create Index button in the left pane. (Note: You might have to click New Index if the window is showing the results from the index of  USB drive.) In the Step  click the Pre-determined File Types option button, click all the file types listed, and then click Next.

Step 12

 click the Add button.

Step 13

On the Add Start Location dialog box, verify that Whole drive option is selected and  work-usb-2009-12-11.E01 is listed.

Click OK.

Add Start Location

Step 14

In the Step 3 of 5 window, in the Index Title text box, type: All File Type
Click Start Indexing.

Index Title

Step 15

When the indexing is finished, click OK in the message box informing you that some errors might have occurred in the indexing process.

 

Step 16

The window that opens shows you the files that were indexed, any errors that occurred, and a summary of what was done. After examining the summary, close the window.

You should now be able to create a case, add it to your inventory, scan the files, and perform indexing, which will be useful later for searching.   

Case Management: Cases are used to group together findings within OSForensics that can be exported or saved for later analysis.

 

ref:

osforensics

hackingarticles

#WindowsForensic #ComputerForensics #dfir #forensics #digitalforensics #computerforensic #investigation #cybercrime #fraud

หมายเหตุ:เนื้อหาในเว็บไซต์นี้มีขึ้นเพื่อวัตถุประสงค์ในการให้ข้อมูลและเพื่อการศึกษาเท่านั้น
* หากมีข้อมูลข้อผิดพลาดประการใด ขออภัยมา ณ ที่นี้ด้วย  รบกวนแจ้ง Admin เพื่อแก้ไขต่อไป
ขอบคุณครับ