preview

Nt1310 Unit 5 Research Paper

Better Essays

We installed VMware Workstation (VM) on all four laptops and then installed Windows 7 on VM. Subsequently, we installed DaemonFS [20] a tool that monitors in real time files on the hard disk. We also installed several tools [21] on the machines for viewing history, cache and cookies. Next, we used Paragon Disk Wiper [22] to wipe all external devices and installed PortableApps [23] on them. This utility allows you to run different programs from a flash drive. Subsequently, we installed one portable web browser on each external device and connected them to the suspect laptops. Write-blocker was used to preserve the integrity. We should note that no regular browser was installed. At this point we were ready to do the web browsing activities. Each portable browser was individually launched in private mode followed by the same series of web activities for all four browsers, i.e. email account login, secure account login such as a bank account, sending/receiving email, searching for images and videos, uploading and downloading files and streaming some video. 3.3 Static Media Forensics When we use a portable browser to surf the web, information about the details of web activities will be kept in the local machine hard drive in various logging files including registry keys, cache, cookies, temp, and recent, files Recent executables, logging …show more content…

The type and the amount of data varied slightly among the browsers. For example, Table 6 above shows the timeline and process Id is retrievable with portable Google Chrome. Figure 1 below shows (see read arrow) the date, time and the site that was visited. Among all the browsers in our study Google Chrome portable left the most residual artifacts on the volatile memory of the suspect

Get Access