Digital Forensics Lab & Shared Cyber Forensic Intelligence Repository

Features of Repository

===================

• Hands-on Digital Forensics Labs: designed for Students and Faculty
• Linux-based lab: All labs are purely based on Kali Linux
• Instructional screenshots: Each lab has PPTs, the associated files, and instructional screenshots
• Comprehensive: Cover many topics in digital forensics
• Free: All tools are open source
• Updated: The project is funded by DOJ, DHS, and NSF. The tmeam will keep updating the repostory
• Two formalized forensic intelligence in JSON files based-on case studies
• Kindly send me an email at wxu at ubalt dot edu if you utilize the course materials or find this repository useful. Your cooperation is greatly appreciated.

Please cite our paper:

W. Xu, L. Deng, and D. Xu, "Towards Designing Shared Digital Forensics Instructional Materials," in Proceeding of the 46st Annual International Computer Software and Applications Conference (COMPSAC 2022), pp. 117-122, July 2022. (Video Presentation)

or in BibTeX

@inproceedings{xu2022forensics,
 title={Towards Designing Shared Digital Forensics Instructional Materials},
 author={Xu, Weifeng and Deng, Lin, and Xu, Dianxiang},
 booktitle={46st Annual International Computer Software and Applications Conference (COMPSAC 2022)},
 volume={1},
 pages={117--122},
 year={2022},
 organization={IEEE}
}

Table of Contents (Newly Added: 1. AI for Forensics - Identifying IPs with a Fine-tuned Language Model, 2. Docker for Digital Forensics, 09/2023)

• Basic Computer Skills for Digital Forensics

  • Number Systems (add Python code for data conversion 1/2023)
  • PC Introduction
  • Windows Command Line Tutorial
  • Linux Command Line Tutorial
  • Advanced Linux Command Line Tutorial

• Basic Networking Skills for Digital Forensics (added 3/17/2023. Use Paython Scapy and netfilterqueue libraries.)

  • HTTP Analysis using Wireshark (text)
  • HTTP Analysis using Wireshark (image)
  • SYN Flood Attack Investigation using tshark
  • SMTP Forensics
  • ARP Poisoning Forensics
  • Firewall
  • DNS Introduction
  • DNS Spoofing Forensics
  • WEP40 Wireless Aircrack

• Computer and Digital Forensics (updated on Oct. 2021)

  • Introduction to Digital Forensics
  • Sleuth Kit Tutorial
  • USB Image Acquisition
  • Evidence Search - A Pattern Match Game (updated on May 2022)
  • Evidence Search - File Metadata
  • Data Carving
  • Steganography
  • Forensic Report Template

• Computer Forensics Case Study

  • Investigating NIST Data Leakage (Windows XP)
  • Investigating P2P Data Leakage (Windows 10)
  • Investigating Illegal Possession of Images ("Networking forensics")
  • Investigating Email Harassment (updated on Feb 2023)
  • Investigating Illegal File Transferring (Memory Forensics)
  • Investigating Hacking Case
  • Investigating Morris Worm Attack (updated on Jan 2023, POSTER)

• Mobile/IoT Forensics Case Study

  • Investigating Android 10 (added on 10/24/2021)
  • Investigating iPhone iOS 13 (updated on 6/18/2022)
  • Investigating Drone (add on 12/07/2021)

• Forensic Intelligence Repository

  • Email forensics
  • Illegal Possession of Images

• AI for Forensics

  • Identifying IP Addresses using a Fine-tuned AI Model

Tool Installation

Method 1: Importing customized Kali VM image

The customized Kali VM = Kali (2021.4) + tools used for completing most of the labs listed above (except p2p Data Leakage case)

• Install Virtualbox
• Import the customized Kali 2021.4. Notes: the default harddisk size is 80G.

Method 2: Installing tools using the customized script (the script ONLY is tested on Kali 2021.4)

The following script will install tools needed for completing most of the labs listed above (except p2p Data Leakage case, which has its own script described in PPTs). Please let us know if you need us to add more tools to the script.

• Install Virtualbox

• Install Kali 2021.4. Notes: Suggest You configure the disk size of Kali VM 80G because the size of each leakage cases image is 30G+

• Run a tool installation script instructions, or you can simply follow the commands below

wget  https://raw.githubusercontent.com/frankwxu/digital-forensics-lab/main/Help/tool-install-zsh.sh
chmod +x tool-install-zsh.sh
./tool-install-zsh.sh

• Installed tools. Note that most of the commands for tools can executed globally. Now you can skip most of tool installation steps in PPTs.

Method 3: Using a Docker container based on Ubuntu 22.04 LTS (added in 09/23, may need more testing, report any issues please)

• The host machine of the Docker container is Ubuntu 22.04 LTS.
• The container is built on top of Ubuntu 22.04 LTS as well.
• All tools are pre-install on the Ubuntu container.
• You can follow the tuturial Docker for Digital Forensic Investgiation

Investigating NIST Data Leakage

==============

The case study is to investigate an image involving intellectual property theft. The study include

• A large and complex case study created by NIST. You can access the Scenario, DD/Encase images. You can also find the solutions on their website.
• 14 hands-on labs/topics in digital forensics

Topics Covered

Investigating P2P Data Leakage

==============

The P2P data leakage case study is to help students to apply various forensic techniques to investigate intellectual property theft involving P2P. The study includes

• A large and complex case involving a uTorrent client. The case is similar to NIST data leakage lab. However, it provides a clearer and more detailed timeline.
• Solid evidence with explanations. Each evidence that is associated with each activity is explained along with the timeline.
• 10 hands-on labs/topics in digital forensics

Topics Covered

Investigating Illegal Possession of Images

=====================

The case study is to investigate the illegal possession of Rhino images. This image was contributed by Dr. Golden G. Richard III, and was originally used in the DFRWS 2005 RODEO CHALLENGE. NIST hosts the USB DD image. A copy of the image is also available in the repository.

Topics Covered

Investigating Email Harassment

=========

The case study is to investigate the harassment email sent by a student to a faculty member. The case is hosted by digitalcorpora.org. You can access the senario description and network traffic from their website. The repository only provides lab instructions.

Topics Covered

Investigating Illegal File Transferring

=========

The case study is to investigate computer memory for reconstructing a timeline of illegal data transferring. The case includes a scenario of transfer sensitive files from a server to a USB.

Topics Covered

Investigating Hacking Case

=========

The case study, including a disk image provided by NIST is to investigate a hacker who intercepts internet traffic within range of Wireless Access Points.

Topics Covered

Investigating Morris Worm Attack

=========

The case study is an investigation of the Morris Worm Attacking. We are using the VM provided by SeedLab. The goal of the lab is to find all evidence related to Morris Worm attacking.

Topics Covered

Investigating Android 10

The image is created by Joshua Hickman and hosted by digitalcorpora.

=========

Investigating iPhone iOS 13.4.1

The image is created by Joshua Hickman and hosted by digitalcorpora.

=========

Investigating Drone DJI

The dataset includes logical files extracted from a DJI controller (mobile device) and a SD card image used by the device. The Drone dataset is created by VTO Labs. The lab covers GPS investigation and cached image retrieval. Note that it is a draft. We will improve the lab later.

=========

Tools

• Commands tested

• Other tools installed via apt install python3-pip, leafpad, terminator, sqlite3, tree, xmlstarlet, libhivex-bin, pasco, libhivex-bin, npm, binwalk, foremost, hashdeep, ewf-tools, nautilus

Contribution

=============

• PI of the project
  • Dr. Frank Xu (Email: fxu at ubalt dot edu)
• Students:
  • Danny Ferreira (iPhone)
  • Harleen Kaur (Partial of Android)
  • Malcolm Hayward (P2P Leakage)
  • Richard (Max) Wheeless (Hacking case)
  • Chimezie Onwuegbuchulem (Docker for Digital Forensics)
  • Etinosa Osawe (AI for Forensics - Identifying IPs with a Fine-tuned Language Model)