Answered step by step
Verified Expert Solution
Question
1 Approved Answer
I don't understand what question #6 want me to do ACTIVITY: USING DD TO COPY AND COMPARE FILES Note: This activity takes place in a
I don't understand what question #6 want me to do
ACTIVITY: USING DD TO COPY AND COMPARE FILES Note: This activity takes place in a Linux system. SOFTWARE If you are not using a Linux machine, you'll need to download SIFT Workstation 3 for this exercise. USB DRIVE For this activity, you will need a USB. GOAL After capturing volatile system information, the next step is to acquire nonvolatile data on the suspect machine. In this activity, we will use the "nux dd utility and several of its options to copy a file, image a drive, and also use hashes to check the integrity of the copies. INSTRUCTIONS 1. Launch Ubuntu and open a terminal. 2. Use the command dd to copy an existing file on your computer. Name the new file copy.dd. 3. Using md5sum, create MD5 hashes of the original file and the copy. 4. Compare the hash of the copy to the hash of the original file; confirm that the hashes are the same. 5. Repeat Steps 3 and 4 using shasum to generate SHA1 hashes. 6. Use dd to copy one block of zero from /dev/zero to a file called zero.dd. (Hint: use the dd option count). 7. Insert the USB drive and connect your USB to SIFT Ubuntu. The USB drive should auto-mount. 8. Run the command mount to find the USB device file name. You will use the device file name in command dd to make a full image of your USB. For example, my USB's device file is /dev/sdc1; it is mounted on /media/sansforensics/B86D-C764. /dev/sdci on /media/sansforensics/B86D-C764 type vfat (rw,nosuid, nodev,uid=1000 gid=1000, shortname=mixed, dmask=0077, utf8=1, showexec, flush, uhelper=udisks2) You can also use the df command to complete this step 9. Use dd to make a full image of your USB flash drive. Name the image usb.dd. 10. Create both MD5 and SHA1 hashes of the USB flash. (Hint: md5sum /dev/sdc1; shasum /dev/sdc1) 11. Create both MD5 and SHA1 hashes of the USB image. (Hint: md5sum usb.dd; shasum usb.dd) 12. Make sure that: The md5 hash of the USB flash matches with the md5 hash of the USB image The shal hash of the USB flash matches with the shal hash of the USB image
Step by Step Solution
There are 3 Steps involved in it
Step: 1
Get Instant Access to Expert-Tailored Solutions
See step-by-step solutions with expert insights and AI powered tools for academic success
Step: 2
Step: 3
Ace Your Homework with AI
Get the answers you need in no time with our AI-driven, step-by-step assistance
Get Started