Digital Forensics Report: Scrambled Bits, USB Image & Data Security

This report delves into the realm of digital forensics, addressing two primary tasks. The first task involves recovering scrambled bits from a text file using the Winhex tool, detailing the process of converting these bits back to plain text through logical and arithmetic shift operations. The second task presents a digital forensics investigation scenario concerning potential intellectual property theft, employing the Autopsy tool to analyze a USB image file and uncover hidden information. Furthermore, the report explores methods for securing sensitive files, including the use of VeraCrypt for encryption and secure storage, alongside strategies for hiding user information to prevent unauthorized access and data breaches. The report emphasizes the importance of multi-layered security measures to protect against both remote and physical threats to digital data.

Running head: DIGITAL FORENSIC
DIGITAL FORENSIC
Name of the Student
Name of the University
Author Note

DIGITAL FORENSIC 1
Abstract:
The purpose of this paper is to discuss the digital forensic. This paper will discuss scrambled
buts, usb image file and will also provide the information bout securing the files.

2DIGITAL FORENSIC
Table of Contents
Task 1:........................................................................................................................................3
Scrambled bit:........................................................................................................................3
Table:..........................................................................................................................................3
Plain text:...................................................................................................................................5
Process:......................................................................................................................................5
Task 2:........................................................................................................................................5
Process:....................................................................................................................................10
Introduction:.............................................................................................................................11
Secure file storage:...................................................................................................................11
VeraCrypt for Windows - Secure File Storage:.......................................................................12
Using file encryption safely:....................................................................................................12
Hiding user information:..........................................................................................................14
Conclusion:..............................................................................................................................15

3DIGITAL FORENSIC
Task 1:
Scrambled bit:
3·7¡ºº0¹4º0¶¹·7º·¬ ;0´:¹ 2¹²±±¶:³9º<¶91¹·616°±229º4º749´´2¶4³34:·¼ 70± 2²¹¹´´:0¶8:74:<2…” !
…2¶´¹2±¹ 9²·7»74·4»64²3°º4³²¶60´²3·0¹932³6·²:°¹9°± :9²·´7´±´¶—
9²²2¡9º°±²0 2±·0»:22·41²³·¶79²´ 2¹0;··4°»0¶10¶72· 2·4:37¶ 2± :9·¶¶·¹179²¶´ 9´ 0·4³0´±·9362:°±
´´;·442:¶1¹
´ 2·4º¹³73μ°³412¹μ±²°¶ 3·4μº94¶0²° 3·9274¶62³3·2μ°·2²4¼º4º90± 99²41º²9°²»4¹69¹72±´° 2±
±275·0²90± 9´¢°º4³·³69·2¹9±´±°¹84º4º92·7²·9±22²0·¹: 92¹2²770º9³·4²372´:2¹°±²
´:90 <·» 2·4μ¹7737¹ <²´:70± 90·;·¹87±¹³72²´:494¹²»70³´º77´º—
Table:
33 b7 37 a1 ba ba 30 b9 34 ba 30 b6 10 b9 b7 37
ba b7 ac 90 3b 30 b4 10 3a b9 90 32 b9 b2 b1 b1
b6 3a b3 39 ba 90 3c b6 39 31 b9 b7 36 31 36 b0
b1 10 32 32 90 39 ba 34 ba 10 37 34 90 39 b4 b4
32 b6 34 b3 10 33 34 90 10 3a b7 bc 90 37 30 b1
90 32 b2 b9 b9 b4 b4 3a 30 b6 38 10 3a 10 37 34
90 3a 3c 32 85 06 94 9d 21 85 06 90 32 b6 b4 b9
32 b1 b9 90 10 39 b2 b7 37 bb 37 34 b7 34 bb 36
34 b2 10 33 b0 ba 34 b3 b2 b6 90 36 10 30 b4 b2
33 b7 30 b9 39 33 10 32 b3 10 36 b7 b2 3a b0 b9
39 b0 b1 90 3a 10 39 b2 b7 b4 10 37 b4 b1 b4 b6
97 39 b2 b2 32 a1 10 10 39 ba b0 b1 b2 30 90 32

4DIGITAL FORENSIC
b1 b7 30 bb 3a 10 32 32 b7 34 31 b2 b3 b7 b6 37
90 39 b2 b4 90 32 b9 30 90 3b b7 b7 34 b0 bb 30
b6 31 30 b6 37 90 16 32 b7 90 32 b7 34 3a 10 33
37 b6 90 32 b1 90 3a 39 b7 b6 b6 b7 b9 31 90 37
39 b2 b6 b4 90 39 b4 90 30 b7 34 b3 30 b4 b1 b7
39 33 10 36 10 32 3a b0 b1 b4 b4 3b b7 34 90 34
32 3a b6 31 b9 b4 90 32 b7 34 ba b9 b3 37 90 33
b5 b0 b3 10 34 31 90 32 b9 b5 b1 b2 b0 b6 90 16
33 b7 34 b5 ba 39 90 16 34 b6 30 b2 b0 90 33 b7
39 90 32 37 34 b6 36 32 b3 10 33 b7 10 32 b5 b0
b7 32 b2 34 bc ba 34 ba 39 30 b1 90 39 90 39 b2
10 34 31 ba b2 10 39 b0 b2 bb 34 b9 36 10 39 b9
37 32 b1 b4 b0 90 32 b1 b1 10 32 37 10 35 b7 30
b2 39 30 b1 90 10 17 39 b4 a2 05 06 b0 ba 34 b3
b7 b3 10 36 39 b7 32 b9 10 39 b1 b4 b1 b0 b9 38
34 ba 34 ba 39 32 b7 37 b2 b7 10 39 b1 10 32 32
b2 30 b7 b9 3a 90 39 32 b9 32 b2 37 37 30 ba 39
b3 b7 34 b2 10 33 37 90 10 32 b4 3a 32 b9 b0 b1
b2 b4 3a 10 39 30 90 3c b7 bb 90 32 b7 34 b5 b9
37 37 90 33 90 37 b9 90 3c b2 b4 3a 37 30 b1 90
39 30 b7 10 10 3b b7 b9 38 37 b1 b9 b3 37 90 32
b2 b4 3a 10 34 90 39 34 b9 b2 bb 37 30 b3 b4 ba
37 37 b4 ba 05 06 97

5DIGITAL FORENSIC
Plain text:
Crime scenes involving digital media range from the fraud cases to homicides. Because
advanced technologies are now available, one of the most common crimes is financial fraud
which include issuing of fake checks, making, stealing and selling fake identity cards such as
drivers licence and bank cards. Digital forensics practitioners need broader understanding of
the case they are working on so they can narrow scope of their investigation.
Process:
For the task Winhex tool has been used for converting the scrambled bits to plain text.
Though the process of the conversion between scrambled bits to plaintext was not so easy.
After doing so much research I have found the technique for solving this problem. By
applying logical shift right, and arithmetic shift right by 1 bit these techniques the problem
has been solved.
Task 2:
Step 1:

6DIGITAL FORENSIC
Step 2:
Step 3:

7DIGITAL FORENSIC
Step 4:
Step 5:

8DIGITAL FORENSIC
Step 6:
Step 7:

9DIGITAL FORENSIC
The table:
0x00000000: EB 3C 90 4D 53 44 4F 53 35 2E 30 00 02 08 08 00 .<.MSDOS5.0.....
0x00000010: 02 00 02 00 50 F8 08 00 3F 00 FF 00 00 08 00 00 ....P...?.......
0x00000020: 00 00 00 00 80 00 29 DE A4 68 6A 4E 4F 20 4E 41 ......)..hjNO NA
0x00000030: 4D 45 20 20 20 20 46 41 54 31 32 20 20 20 33 C9 ME FAT12 3.
0x00000040: 8E D1 BC F0 7B 8E D9 B8 00 20 8E C0 FC BD 00 7C ....{.... .....|
0x00000050: 38 4E 24 7D 24 8B C1 99 E8 3C 01 72 1C 83 EB 3A 8N$}$....<.r...:
0x00000060: 66 A1 1C 7C 26 66 3B 07 26 8A 57 FC 75 06 80 CA f..|&f;.&.W.u...
0x00000070: 02 88 56 02 80 C3 10 73 EB 33 C9 8A 46 10 98 F7 ..V....s.3..F...
0x00000080: 66 16 03 46 1C 13 56 1E 03 46 0E 13 D1 8B 76 11 f..F..V..F....v.
0x00000090: 60 89 46 FC 89 56 FE B8 20 00 F7 E6 8B 5E 0B 03 `.F..V.. ....^..
0x000000a0: C3 48 F7 F3 01 46 FC 11 4E FE 61 BF 00 00 E8 E6 .H...F..N.a.....
0x000000b0: 00 72 39 26 38 2D 74 17 60 B1 0B BE A1 7D F3 A6 .r9&8-t.`....}..
0x000000c0: 61 74 32 4E 74 09 83 C7 20 3B FB 72 E6 EB DC A0 at2Nt... ;.r....

10DIGITAL FORENSIC
0x000000d0: FB 7D B4 7D 8B F0 AC 98 40 74 0C 48 74 13 B4 0E .}.}[e-mail]...
0x000000e0: BB 07 00 CD 10 EB EF A0 FD 7D EB E6 A0 FC 7D EB .........}....}.
0x000000f0: E1 CD 16 CD 19 26 8B 55 1A 52 B0 01 BB 00 00 E8 .....&.U.R......
0x00000100: 3B 00 72 E8 5B 8A 56 24 BE 0B 7C 8B FC C7 46 F0 ;.r.[.V$..|...F.
0x00000110: 3D 7D C7 46 F4 29 7D 8C D9 89 4E F2 89 4E F6 C6 =}.F.)}...N..N..
0x00000120: 06 96 7D CB EA 03 00 00 20 0F B6 C8 66 8B 46 F8 ..}..... ...f.F.
0x00000130: 66 03 46 1C 66 8B D0 66 C1 EA 10 EB 5E 0F B6 C8 f.F.f..f....^...
0x00000140: 4A 4A 8A 46 0D 32 E4 F7 E2 03 46 FC 13 56 FE EB JJ.F.2....F..V..
0x00000150: 4A 52 50 06 53 6A 01 6A 10 91 8B 46 18 96 92 33 JRP.Sj.j...F...3
0x00000160: D2 F7 F6 91 F7 F6 42 87 CA F7 76 1A 8A F2 8A E8 ......B...v.....
0x00000170: C0 CC 02 0A CC B8 01 02 80 7E 02 0E 75 04 B4 42 .........~..u..B
0x00000180: 8B F4 8A 56 24 CD 13 61 61 72 0B 40 75 01 42 03 ...V$..aar.@u.B.
0x00000190: 5E 0B 49 75 06 F8 C3 41 BB 00 00 60 66 6A 00 EB ^.Iu...A...`fj..
0x000001a0: B0 42 4F 4F 54 4D 47 52 20 20 20 20 0D 0A 52 65 .BOOTMGR ..Re
0x000001b0: 6D 6F 76 65 20 64 69 73 6B 73 20 6F 72 20 6F 74 move disks or ot
0x000001c0: 68 65 72 20 6D 65 64 69 61 2E FF 0D 0A 44 69 73 her media....Dis
0x000001d0: 6B 20 65 72 72 6F 72 FF 0D 0A 50 72 65 73 73 20 k error...Press
0x000001e0: 61 6E 79 20 6B 65 79 20 74 6F 20 72 65 73 74 61 any key to resta
0x000001f0: 72 74 0D 0A 00 00 00 00 00 00 00 AC CB D8 55 AA rt............U.
Process:
For this process to retrieve the usb image file firstly the .exe file has been extracted. After
extracting .exe file I got an .dd file.

11DIGITAL FORENSIC
For analysing the hidden image within the .dd file Autopsy tool has been used. All of the
steps are provided as the screenshot.

12DIGITAL FORENSIC
Introduction:
The unapproved access that to the data on the user PC or convenient stockpiling
gadgets can be done remotely, whether the 'interloper' can peruse or alter the user information
over the web; or even physically, on the off chance that he figures out how to get hold of the
user equipment. The user can ensure against either kind of risk by the improvement in the the
physical as well as the system security of the user information, as talked about in How to
shield the user PC from malware as well as the programmers or How to shield the user data
from physical dangers. It is in every case best for having a few layers of guard, be that as it
may, which is the reason the user ought to likewise secure the records themselves. That way,
the user delicate data is probably going to stay safe regardless of whether the user other
security endeavors demonstrate deficient.
There are basically two general ways for dealing with the test of verifying the user
information along these lines. The user can scramble the user documents, making them
unintelligible to anybody yet the user, or the user can conceal them with the expectation that
an interloper will be unfit to locate the user touchy data. There are devices to assist the user
with either approach, including a FOSS application called VeraCrypt, that are able to do both
scramble and conceal the user records.
Secure file storage:
Claudia and Pablo work with a human rights of the NGO in a South American nation.
They have gone through a while gathering declarations from observers for the rights of the
human for the infringement that have been submitted by the military in district of them. In the
event that the subtleties of who gave these declarations were to wind up known, this would
jeopardize both the gallant individuals who affirmed and individuals from the association in

13DIGITAL FORENSIC
that area. This data is at present put away in a what steps the user can take for concealing the
data from the physical or remote gate crashers
spreadsheet on the Windows 7 PC of the NGO's, which is associated with the web. Being
security cognizant, Claudia has made a point for storing a reinforcement of the information
on a CD, that she keeps outside of the workplace.
Encoding the user data is somewhat similar to guarding this in a bolted. Just the individuals
who are having a key or know the blend of the lock's (encryption key or secret phrase, for
this situation) can get to it. The relationship is especially fitting for the VeraCrypt as well as
for the devices like it, which make secure holders called 'encoded volumes' as opposed to just
ensuring one record at any given moment. The user can put an enormous number of records
into a scrambled volume, yet these instruments won't ensure whatever is put away
somewhere else on the user PC or USB memory stick.
VeraCrypt for Windows - Secure File Storage:
While other programming can give comparative quality encryption, VeraCrypt is
containing a few significant highlights to enable the user to structure the user data security
methodology. This offers the likelihood of for all time scrambling the entire plate of the user
PC including every one of the user records, every single transitory document made amid the
user work, all projects the user have introduced as well as all Windows working framework
records. VeraCrypt supports encoded volumes on versatile capacity gadgets. It gives
'deniability' highlights depicted in the Hiding the user touchy data segment underneath.
What's more VeraCrypt is a free as well as a software that is open source.
Using file encryption safely:
Putting away secret information may be a hazard for the user as well as for the general
population the user work with. Encryption lessens this hazard however does not kill it. The

14DIGITAL FORENSIC
initial step to ensuring touchy data is to diminish the amount of it the user keep around.
Except if the user has a valid justification to store a specific document, or a specific class of
data inside a record, the user ought to just erase it (perceive How to pulverize delicate data
for more data about how to do this safely). The second step is to utilize a decent record
encryption instrument, for example, VeraCrypt.
Coming back to the similarity of a bolted safe, there are a couple of things the user
should remember when utilizing VeraCrypt and devices like it. Regardless of how strong the
user safe is, it won't do the user a ton of good in the event that the user leaves the entryway
open. At the point when the user VeraCrypt volume is 'mounted' (at whatever point the user
can get to the substance the user self), the user information might be helpless, so the user
should keep it shut aside from when the user is really perusing or altering the records inside
it.
Detach them when the user leaves the user PC for any period of time. Regardless of whether
the user ordinarily leave the user PC running medium-term, the user has to guarantee that the
user doesn’t leave the user touchy records open to physical or remote gate crashers while the
user is no more.
Detach them before putting the user PC to rest. This applies to both 'suspend' as well
as the 'hibernation' highlights, which are ordinarily utilized with PCs however might be
available on personal computers too.
Detach them previously permitting another person to deal with the user PC. When
taking a PC through a security checkpoint or fringe crossing, it is significant that the user
disengages all encoded volumes and shut the user PC down totally.
Disengage them before embeddings an untrusted USB memory stick or other outer
capacity gadget, including those having a place with companions and partners.

15DIGITAL FORENSIC
In the event that the user keeps a scrambled volume that is on a USB memory stick,
recollect that simply evacuating the gadget may not quickly separate the volume. Regardless
of whether the user have to verify the user records in a rush, the user needs to get off the
volume appropriately, at that point separate the outside drive or memory stick, at that point
evacuate the gadget. The user should need to rehearse until the user locate the speediest
method to do these things.
On the off chance that the user chooses to keep the user VeraCrypt volume on a USB
memory stick, the user can likewise keep a duplicate of the VeraCrypt program with it. This
will enable the user to get to the user information on other individuals' PCs. The standard
principles still apply, be that as it may: in the event that the user doesn’t confide in the
machine to be free of malware, the user most likely shouldn't type in the user passwords or
getting to the user touchy information.
Hiding user information:
One issue that is keeping a safe in the user home or office, to avoid even mentioning
conveying one in the user pocket, is that it will in general be very self-evident. Numerous
individuals have sensible worries about implicating themselves by utilizing encryption.
Because the genuine motivations to scramble information dwarf the ill-conceived ones does
not make this danger any less genuine. Basically, there are actually two reasons why the user
may modest far from utilizing an instrument like VeraCrypt.
Thinking about risk of self information:
Encryption is unlawful in certain nations, which implies that downloading, introducing or
utilizing programming of this sort may be a wrongdoing in its own right. If the police,
military or insight administrations are among those gatherings from whom the user are
looking to ensure the user data, at that point damaging these laws can give an appearance

16DIGITAL FORENSIC
under which the user exercises may be researched or the user association may be oppressed.
Indeed, in any case, dangers like this may have nothing to do with the lawfulness of the
devices being referred to. Whenever that simply being related with encryption programming
would be sufficient to open the user to allegations of crime or undercover work (paying little
heed to what is in reality inside the user encoded volumes), at that point the user should
contemplate whether such devices are suitable for the user circumstance.
Conclusion:
Thus, it can be concluded that the user can attempt to store the majority of the user delicate
data in a protected webmail account, yet this requests a dependable system association and a
generally complex comprehension of PCs and Internet administrations. This procedure
likewise expects that system encryption is less implicating than document encryption as well
as the user can keep away from inadvertently duplicating delicate information onto the user
hard drive as well as leaving it there.
The user may keep delicate data off of the user PC by putting away it on a USB
memory stick or versatile hard drive. In any case, such gadgets are normally much more
powerless than PCs to misfortune and seizure, so bearing touchy, decoded data on them is
generally an exceptionally poorly conceived notion.

17DIGITAL FORENSIC
Bibliography:
Agarwal, A., Gupta, M., Gupta, S., & Gupta, S. C. (2011). Systematic digital forensic
investigation model. International Journal of Computer Science and Security
(IJCSS), 5(1), 118-131.
Carrier, B. (2003). Defining digital forensic examination and analysis tools using abstraction
layers. International Journal of digital evidence, 1(4), 1-12.
Carrier, B. D. (2006). A hypothesis-based approach to digital forensic
investigations (Doctoral dissertation, Purdue University).
Carrier, B., & Spafford, E. H. (2004, July). An event-based digital forensic investigation
framework. In Digital forensic research workshop (pp. 11-13).
Casey, E. (2011). Digital evidence and computer crime: Forensic science, computers, and
the internet. Academic press.
Chung, H., Park, J., Lee, S., & Kang, C. (2012). Digital forensic investigation of cloud
storage services. Digital investigation, 9(2), 81-95.
Martini, B., & Choo, K. K. R. (2012). An integrated conceptual digital forensic framework
for cloud computing. Digital Investigation, 9(2), 71-80.
Pollitt, M. M. (2007, April). An ad hoc review of digital forensic models. In Second
International Workshop on Systematic Approaches to Digital Forensic Engineering
(SADFE'07) (pp. 43-54). IEEE.
Reith, M., Carr, C., & Gunsch, G. (2002). An examination of digital forensic
models. International Journal of Digital Evidence, 1(3), 1-12.
Taylor, R. W., Fritsch, E. J., & Liederbach, J. (2014). Digital crime and digital ter