티스토리 뷰
Big endian and little endian are different way of reading hex data.
Workshop 4
Task 1
The text file called "suicide1.txt" was found in usb. It says "I just can't go on any longer. Someone has to help me! Sylvia". So the Joshua's girlfriend seems to have difficulty in some problem and thinking suicide. The creation time to the text file is 09/12/2005 9.48. The MD5 hash value of it is "cb3899712da5c2bd5faf405c28bc95d4".
Also, there is file called "Sylvias Assets.xls" and there is huge amount of money. It could be one reason for being murdered. its hash value is "b0b5b6159dd48e22d67b903743a287f9".
The murderer could saw Sylvia's asset and kill her for money.
Also, there is chance to the file was modified in different OS such as UNIX.
Task 2
The result of search keyword "book", Palm OS® Programmer’s Companion, Palm OS® Programmer’s API Reference, Palm OS® Programmer’s Companion, Palm® File Format Specification, Palm OS® Programming Development Tools Guide but there was no evidence of confidential data.
There was a file called "Interview.xls" and it seems to be contains first and second quarter sales figures of company.
'AU Study > CSG2305 Computer Forensics' 카테고리의 다른 글
W7 Mon 10092018 (0) | 2018.09.10 |
---|---|
W6 03092018 Mon (0) | 2018.09.06 |
W5 Mon 27082018 (0) | 2018.08.27 |
W3 Mon 13082018 (0) | 2018.08.15 |
W2 Mon 06082018 (0) | 2018.08.07 |