COMP 2555 Computer Forensics--Project 2

Due: April 24, 2009

Here is a more challenging data carving exercise.

• Download the gzipped file and gunzip,
• Check the MD5 hash (bd09d612fc8b3f92662b98f9456f2ada)
• The data is about 50M with 512 block sectors
• Data contains many full and partial jpegs, zip files, plain text, HTML files, and Microsoft office files.
• The more files you find, the better

Your write up must consist of a general description of your methods and tools. Good write up is essential and counts for 25% of grade for this project. Document what software you used and how you used it, especially if you used it in a particularly clever way or in a way for which it was not originally intended.

List what files you found, a description of the file if applicable (for instance, look at the actual jpeg), on what block sectors the file, with what tool the file was found and an md5 hash of the file. A simple list of the files would suffice.