Comprehensive Digital Forensics Report: EMTS Data Recovery Analysis

This report details a digital forensics investigation conducted for the Exotic Mountain Tour Services (EMTS) organization, focusing on the recovery of suspicious data. The investigation was initiated following a potential intellectual property theft by a contract employee. The report outlines the use of several forensic tools, including Winhex, Pro Discover, and image steganography, to recover corrupted images, hidden text within images, and other deleted files from a USB drive found in the employee's work area. The analysis includes step-by-step processes for data recovery, such as using Winhex to recover scrambled bits and corrupted images, employing steganography to extract hidden text, and utilizing Pro Discover to retrieve deleted files from the USB drive. The report concludes with the successful creation of a digital forensic report, detailing the methods and findings of the data recovery process.

DIGITAL FORENSICS
1

Abstract
This project is needs to successfully create the digital forensic report for EMTS
organization because this organization lost the suspicious data. So, it needs to be recovered by
using the appropriate digital forensic tools. These tools are used to accomplish the data recovery
process for an organization. This organization chief was decided to recovery the deleted data and
it managed by Bob Aspen. The Bob Aspen is working as contract employee of the Exotic
Mountain Tour services (EMTS). This EMTS organization has completed a very expensive
marketing process and analysis on the customer services and it provided by the superior bicycle
LLC Company. In our case study, we are using the Winhex tool to recovery the corrupted images
from USB, recover the all the file from hard drive by using the pro discover forensic tool and
image steganography tool is used to recover the hidden text in the image from USB.

Table of Contents
1. Introduction.........................................................................................................................................4
1.1 Back ground.................................................................................................................................4
1.2 Scope...........................................................................................................................................4
1.3 Forensic tool................................................................................................................................4
2. Analysis...............................................................................................................................................4
2.1 Winhex........................................................................................................................................4
2.2 Steganography.............................................................................................................................5
2.3 Pro Discover Tool........................................................................................................................6
3. Finding and Evidence..........................................................................................................................7
3.1 Recover the deleted image in the usb Using Winhex...................................................................7
3.2 Recover the hidden text in Image using Steganography tool.....................................................14
3.3 Recovery the Files from USB by using Pro Discover Tool........................................................17
4. Conclusion.........................................................................................................................................21
References.................................................................................................................................................22

Task – 1
1. Recover the Scrambled Bits
To recover the scrabbled bits by uses the Winhex forensic tools. The Winhex forensic tool is
used to recovery the data. It provides the effective data recovery. To recovery the scrambled bits
by follows the below steps.
First open the Winhex forensic Tool.
To open the scrambled bits by click the tools to select the start center. After, open the scrambled
bits of text. It is shown below.

After choose the text file and click the open file. It is display the scrambled bits of text file. It is
shown below.

After, execute the scrambled bits. It is shows the text format. It is shown below.

If execution is finished, after open to selecting the hard disk one reads in the entire drive. It is
shown below.

After, click the access to open a serious of options and select the boot sector to allow a access for
FTA1, FAT2, surplus sectors, root directory and free clusters. It is shown below.
After, viewing the boot sector to creating a backup and access the partitions. It is shown below.

Then, modify the hex display information. It is shown below.
Finally, it highlights the block of data being manipulated.

Task – 2
2. Introduction
2.1 Back ground
This project goal is to prepare the digital forensics report for an EMTS organization
because this organization lost the suspicious data and it needs to be recovers. So, creates digital
forensics data recovery process based reports. This organization is investigating the probable
intellectual property which is stolen by the Bob Aspen who is working as contract employee of
the Exotic Mountain Tour services (EMTS). This EMTS organization has completed a very
expensive marketing process and analysis on the customer services and it provided by the
superior bicycle LLC Company. The EMTS chief found a USB drive on the work area was
allocated to Bob aspen and this work decide if the drive you some intriguing the data he
accumulated from the web server executive.
2.2 Scope
Scope of this project is to create the digital forensic report for an organization. This
organization lost the suspicious data and it needs to be recovered by using the appropriate data
recovery techniques (Advances in Digital Forensics 9, 2016). Here, we will use three forensic
tools like pro discover, Winhex and image steganography. The Winhex forensic tool is used to

recover the corrupted images from the hard drive. The Pro discover tool is used to recover the all
the data from the hard drive. The image steganography tool is used to recover the hidden text in
the images from USB. These are will be analysed and discussed in detail.
2.3 Forensic tool
The ENTS using the following forensics tools to recover the suspicious data from USB. These
are,
 Pro Discover Tool
 Winhex Tool
 Image Steganography Tool
These are discussed and analyzed in below.
3. Analysis
3.1 Winhex
The Winhex forensic tool is very helpful for realm of data recovery, low level data editing and
computer forensics (AG, 2018). It is used to recovery and editing the following aspects like CD-
ROM, computer flash, floppy and more. So, many organizations use Winhex tool to provide the
efficient and effective data recovery process for an organization. This tool has many features
such as,
 It has scripting and programming interfaces
 Wipe drives.
 Make hashes and checksums.
 Join and split records.
 Disk cloning
 Examine and look at records.
 Convert between the Intel hex, ASCII, binary and more.
 It uses the various data recovery techniques.
 Recapture information.
 Encode records.
 The Winhex tool also has the printing, instant window switching and random
number generator.
 Diving and unifying the even and odd words and bytes.

 It has disk editor for floppy disks, CD-ROM, smart media, floppy disks, hard
disks and more.
 It splitting and concatenating and files
 Support file of any size
 Extensive program help
 Import all the clip board formats
 Editing data structures using templates
 Comparing and analysing the files
3.2 Steganography
Generally, the steganography tools have different software’s and it is used to hide the
secret text from Images file, HTML file and any kind of files. Here, we are using the Image
steganography tool to hide the secret text from the Image file. The image steganography tool is
also used to hiding the user information in the image file. It can hide the text files inside the
image file ("Best Tools to Perform Steganography", 2018). To perform an image steganography
by select the source in which you want to hide the secret messages and select the files to hidden
the secrets text. Finally, select the output image locations because these tools do the both
encoding and decoding. We are doing the decoding techniques to hidden the text files from the
image.
3.3 Pro Discover Tool
The pro discover tool is the most powerful computer security tool and it used to provide the
powerful search capability is flexible and fast. It is very helpful capability and easy to use for an
organization ("ProDiscover Forensics - Software - Products", 2018). It can recover the deleted
files; dynamically allow a preview and examine slack space. It is used to utilizing the disk at the
sector level in the organization. It handles the organization security concerns. It designed to
NIST disk imaging tool and it insure the high quality. It previews all the files, even if hidden or
deleted without altering the data on disk. It supports the VM ware to run a captured image. It
creates the bit stream copy of disk to be analysed to keep original evidence safe ("Forensic
Toolkit", 2018). It maintains the multi tool compatibility by writing and reading the images. It
has various features such as,
 Integrated thumbnail graphics
 Internet history