Digital Forensics Report for Exotic Mountain Tour Service

This project aims to create a digital forensic report for Exotic Mountain Tour Service (EMTS) to investigate the probable intellectual property stolen by Bob Aspen, a contract employee of EMTS. The report analyzes digital forensic tools like Remo Recovery, Winhex, and Stenography to recover deleted files from USB. The Remo recovery tool is used to recover the PDF file, Winhex tool is used to recover the deleted image from USB, and stenography tool is used to recover the hidden text in the image. The report concludes that these tools provide efficient and effective data recovery for an organization.

DIGITAL FORENSICS

Abstract
This project aims to create the digital forensic report for Exotic Mountain Tour Service.
This report is needs to investigate the probable intellectual property stolen by the Bob Aspen
who is working as a contract employee of the EMTS. The EMTS organization has completed
analysis and marketing process on the customer service provided by the Superior Bicycle. The
EMTS current IT infrastructure is does not provide the effective data recovery. So, it needs to
analysis the digital forensic tools to provide the effective data recovery for an organization.
2

Table of Contents
1. Introduction..............................................................................................................................3
1.1 Background.......................................................................................................................3
1.2 Scope.................................................................................................................................3
1.3 Forensic Tools...................................................................................................................3
2. Analysis....................................................................................................................................4
2.1 Remo Recovery tool..........................................................................................................4
2.2 Winhex tool.......................................................................................................................4
2.3 Stenography tool...............................................................................................................6
3. Findings....................................................................................................................................6
3.1 Recover the PDF file using Remo recovery......................................................................6
3.2 Recover the deleted image in the usb Using Winhex.....................................................10
3.3 Recover the hidden text in Image using Stenography tool.............................................18
4. Conclusion..............................................................................................................................21
References......................................................................................................................................22
3

1. Introduction
1.1 Background
This project is to investigate the probable intellectual property which is stolen by the Bob
Aspen who is working as contract employee of the Exotic Mountain Tour services (EMTS). This
organization has completed a very expensive marketing process and analysis on the customer
services and it provided by the superior bicycle LLC Company. This organization has one plan to
do an efficient and effective advertisement for a joint product deal of superior bicycles with their
tour services. The EMTS is used to ensure the promoting effort material under the disclosure
concurrence with superior bicycle. The EMTS chief found a USB drive on the work area was
allocated to Bob aspen and this work decide if the drive you some intriguing the data he
accumulated from the web server executive. This organization has web based email activity
through the organization system and distinguishes the suspicious connection for a organization
channels.
1.2 Scope
Main scope of this project is to create the digital forensic report for provided scenarios. We
will recover the deleted file which ahs suspicious data that are related to the case files from USB.
To recovery a deleted files by using the appropriate digital forensic tools. In provided case study,
we are going to use the Winhex forensic tools to recover the deleted image from USB. The Remo
recovery tool is used to recover the pdf file and stenography tool is used to recovering the hidden
text in the image ("22 Popular Computer Forensics Tools [Updated for 2018]", 2018). So, these
recovery techniques are needs to be analysis before finding the evidence for the provided
scenario.
1.3 Forensic Tools
The forensic tools used in the provided case study. They are listed in below.
 Remo Recovery
 Winhex
 Stenography
4

2. Analysis
2.1 Remo Recovery tool
The Remo recovery tool is used to provide the complete data recovery solutions for an
organization and it also provide the outstanding platform for data recovery in organization. It
capable for retrieving the use lost or deleted data or information and it can be recovering the
wide variety of data on windows (AG, 2018). Generally, this organization faces the issues of lost
documents, files and images and these are recovered and a threat of permanently deletion of data
remains. This tool is needs to regain all the user deleted data are recovered quickly. This tool has
various features and these are used for an organization. The features are listed below.
 It recovering the data from USB, file systems such as ExtFAT, NTFS, FAT32 and
FAT16. These file systems are supported by the Remo recovery tool.
 It easily recovers the deleted and lost data from windows.
 It recovering the files form corrupt partitions, deleted partition and formatted
partitions that is RAID0, RAID 5 and RAIN 1 array.
 It has ability to utilize and recognize the all types of files including the audio, video,
office files, photos and other file types.
 It recovers the all kinds of hard drives like SCSI, IDE and SATA. It has high
capable of recovering the data from memory cards.
 It has smart and strong recovery modules to provide the effective data recovery
compared other tools ("Comparison of hex editors", 2018).
 It helps to undelete the files and folders deleted using the shift + delete.
 This tool is effectively recovering the images of format PSD, JPEG, TIF, BMP,
PNG and etc.
 It has save recovery session options are used to allow used to save the present
recovery session and it provide the efficient data recovery for an organization.
 The recovered data can be saved as desired location of user system.
2.2 Winhex tool
Winhex forensic tools are a universe hex editor and it useful in organization because it is
very helpful for realm of data recovery, computer forensic and low level data editing ("Digital
forensics", 2018). It recovery and editing the following aspects like floppy disks, hard disks,
5

computer RAM, computer flash, memory sticks, any kind of file, DVD, CR-ROM and all drive
types. It support the NTFS, FAT32, FAT16 and FAT12 file system. It is very useful for editing
and inspects the recovered data files, lost data files and all kinds of files fro, the hard drive with
corrupt file system. It is generally very fast. So, many organizations use this tool to provide the
effective data recovery process for an organization. The Winhex tool has various features such as
 Disk cloning
 Support file of any size
 Extensive program help
 Import all the clip board formats
 Editing data structures using templates
 Examine and look at records.
 Join and split records.
 Comparing and analyzing the files
 Convert between the Intel hex, ASCII, binary and more.
 It use the various data recovery techniques
 It has disk editor for floppy disks, CD-ROM, smart media, floppy disks, hard disks
and more.
 It splitting and concatenating and files
 Recapture information.
 Encode records
 Diving and unifying the even and odd words and bytes
 It has scripting and programming interfaces
 Wipe drives.
 Make hashes and checksums.
 It also has the random number generator, instant window switching and printing.
It has centre an all inclusive hexadecimal supervisor and it especially supportive in the
domain of information recuperation, PC legal science, IT security and low level preparing
("Remo Recover 4.0.0.65 Crack + License key Full Version Download", 2018). It utilize and
investigate the wide ranges of documents, erased records and lost information from USB and
hard drives with degenerate document frameworks from advanced camera cards.
6

2.3 Stenography tool
The steganography tool is used to allow user to embed the hidden data inside a carrier file
like audio, video, images and other documents. It modifies the original file to detect the threat. IT
manipulate the data is bitwise manipulation to generate the cyphertext. It tool is used to ensure
the robustness against the modern forensic methods line steganlysis. It also done the data
whitening process, encoding process and stream based cryptography process ("Remo Recover –
Recover data / files from Windows, Mac and Android OS", 2018).
3. Findings
3.1 Recover the PDF file using Remo recovery
The Remo recovery tool is used to recover the PDF file. It also used to recovery the
corrupted PDF and it changes the PDF footer and Header to provide the effective data recovery
from USB ("WinHex", 2018). If any users deleted the organization important PDF files and it
recovered by using the Remo recovery tool because it is most common tool to recovery the
corrupted and Normal PDF file from the USB. It is user friendly tool. So, most of the
organization uses this tool to recovering the deleted and corrupted data. The below project pdf
file is to be corrupted and deleted. So it needs to recover by using Remo recovery tool. It is
shown below.
7

The below screenshots is shows the deleted project PDF file ("WinHex - Free download", 2018).
8

So, it needs to be recovered by using the Remo recovery tool. First, open the Remo recovery
tool. The home of the Remo recovery tool is shown below.
To recovery the deleted PDF file by click the recover files and it display the recover lost file and
deleted files. It is shown below.
9

After, we select the recover deleted file and select the USB. Then, click the next arrow. It is
shown below ("Software for Computer Forensics, Data Recovery, and IT Security", 2018).
10

Finally, it Display the deleted PDF file. It is shown below.
Then, click the recovered PDF to save the PDF file for correct folder.
3.2 Recover the deleted image in the usb Using Winhex
The Winhex recovery tool is used to recovery deleted image from USB. This is very
popular data recovery tool and it very useful this organization. It is used to provide the efficient
11

and effective data recovery operations for an organization. It is easily recovery the deleted
images form USB. It also recovers the corrupted images. This process is shown below. The
below screenshots is display the corrupted images and it needs to be recovered by using the
Winhex recovery tool (AG, 2018).
The below screen shot is used to display the corrupted image.
12

After open the Winhex recovery tool to recovery the corrupted images. Then, click the tools to
choose the open disk and select the deleted corrupted image file location. It is shown below.
13

The corrupted image is deleted from USB. So, choose the USB and click OK button. Then, open
the deleted images folder and it shows the deleted corrupt images. It is shown below.
Here, initialize the USB disk to click the tool and choose the initialize the disk. It is used
to display the recovered images information and it free up disk space to saves the recovered
images in the USB. It is shown below (AG, 2018).
14

Then, right click the recovered file to recovery the deleted corrupted images in Winhex
recovery window. After, select the recovery and copy. It is shown below.
15

After, choose the output path to save the recovered file and it is shown below.
16

Finally, it shows the corrupted file and it also recovering the corrupt file is to normal file. It is
shown below.
17

18

3.3 Recover the hidden text in Image using Stenography tool
The stenography tool is used to recover the hidden text in image. The stenography tool is
used to gives the efficient and effective data recovery for an organization. It needs to be recovery
the hidden text in the image from USB. The stenography is most commonly used tool for
recovery the hidden text in the image. The below image is needs to be recovery the hidden text
by using the stenography tool. It is shown below.
So, open stenography software. The home of stenography tool is shown below.
19

After, click the images and select the stenography analysis. It is shown below.
20

After, open the image and enter the symmetric key. Then it shows the hidden text in images. It is
shown below.
These are forensic analysis tools. These three tools are used to provide the data recovery
and it very useful for an organization. The forensic tools are needs to recovery the deleted and
corrupted file from USB or hard disk. These tools are mostly used forensic tools. These tools are
provides the reliability and scalability of the organization. The data recovery is most important
process in the organization. So, the forensic tools are providing the easy and user friendly data
recovery for an organization ("Remo Recover Free Edition", 2018).
21

4. Conclusion
This project is to create the digital forensic report for an EMTS organization by using the
provided scenario. So, we are recovered the deleted file form USB by using the appropriate
digital forensic tools. These tools are used to accomplish the recover process. In provided
scenarios, to recover the deleted file from USB by using the following tools like stenography,
Remo recovery and win hex tools. The Remo recovery tools are recovered the pdf file from
USB. The stenography tool is recovered the hidden text in image from USB and Winhex tool is
recovered the deleted image in the USB. These tools are analyzed in detail.
22

References
22 Popular Computer Forensics Tools [Updated for 2018]. (2018). Retrieved from
http://resources.infosecinstitute.com/computer-forensics-tools/
AG, X. (2018). WinHex: Hex Editor & Disk Editor, Computer Forensics & Data Recovery
Software. Retrieved from http://www.winhex.com/winhex/
Comparison of hex editors. (2018). Retrieved from
https://en.wikipedia.org/wiki/Comparison_of_hex_editors
Digital forensics. (2018). Retrieved from https://en.wikipedia.org/wiki/Digital_forensics
Remo Recover 4.0.0.65 Crack + License key Full Version Download. (2018). Retrieved from
https://cracksone.com/remo-recover-crack/
Remo Recover – Recover data / files from Windows, Mac and Android OS. (2018). Retrieved
from https://www.remorecover.com/
WinHex. (2018). Retrieved from http://download.cnet.com/WinHex/3000-2352_4-
10057691.html
WinHex - Free download. (2018). Retrieved from http://www.updownload.com/winhex/
AG, X. (2018). WinHex Hex Editor. Retrieved from http://www.winhex.com/winhex/hex-
editor.html
AG, X. (2018). WinHex: Hex Editor & Disk Editor, Computer Forensics & Data Recovery
Software. Retrieved from https://www.x-ways.net/winhex/
Remo Recover Free Edition. (2018). Retrieved from https://download.cnet.com/Remo-Recover-
Free-Edition/3000-2248_4-75914154.html
Software for Computer Forensics, Data Recovery, and IT Security. (2018). Retrieved from
https://www.x-ways.net/
23

24