ECE 4112 Internetwork Security.doc

ECE 4112: Internetwork Security Lab X: Computer Hard Disk Forensics Group Number: _______________ Member Names: _________________________ _________________________ Date Assigned: Data Due: Last Edited: Created By: Juan Madrigal – Blake Brannon Please read the entire lab and any extra materials carefully before starting. Be sure to start early enough so that you will have time to complete the lab. Answer ALL questions and be sure you turn in ALL materials listed in the Turn-in Checklist ON or BEFORE the Date Due. Simple and Advanced Data Deletion and Forensic Analysis of Data Recovery Goal: The goal of this lab is to introduce hard drive forensics and what techniques can be used to retrieve information from a hard disk. You should get an understanding of how data is stored and removed from a drive. You will also see the type of information that can be retrieved from a hard drive and the security issues you should be aware of when disposing (selling, giving) a hard drive. Summary: In this lab you will first look at file deletion using Windows deletion techniques. You will use your USB key to delete a file and via a HEX editor undelete the file by modifying a single character. You will then delete files using the Windows Recycle Bin and recover those files using a simple tool. You will format a drive using the Windows formatting tool and run a tool to recover the files that were supposedly deleted. You will then analyze the data obtained after the format and determine what information we can collect about the drive. You are then introduced to techniques to securely erase data from a disk and other prevention techniques you can use to help prevent undesired data recovery. Since you have a fundamental understanding of how data is contained on a disk, you will look at Encrypted File System technology and how it helps to prevent unwanted data recovery. Background and Theory: Before you begin the lab, a clear understanding of the following should be understoo