“At a basic level, digital data is a series of very small units on storage device that are set to 0 or 1 with the 0 or 1 representing a microscopic physical condition, often a level of electric charge, on the media. Each individual unit is called a bit” (Vincze, 2016)

“Each individual unit is called a bit, and groups of eight bits are called ____ . Each _____ represents a ______ value, and groups of _____ values form numbers, letters, words, and all other manifestations of information stored on computers and their related devices” Fill in the blanks: Byte(s) Hexadecimal

Create a “.txt”, “.doc”, and “.docx” Write “Hello” in all of them Convert “Hello” to its Hexadecimal Equivalent Open the “.txt” file, the “.doc” file, and the “.docx” file in the hexadecimal viewer

Digital Forensics Analysis of Files: Keyword Search (Files that contain a name, an expression) Regular Expressions Search (Files that contain a credit card number, a phone number, a bank account, an ip address) Location of File: Cached file ?

Police sources said the two had a rocky relationship and the Twitter messages they posted - with friends jumping in - only made it worse. Hours before the shooting, Dancy may have taunted Blake with a tweet: "N-----s is lookin for u don't think I won't give up ya address for a price betta chill asap!" Blake's Twitter account is also full of online disses, though only one tweet mentions Dancy by name: "R.I.P. Kwame" on Dec.3.

“[e]ach time a web page is opened, it is sent to your browser’s temporary cache on the computer hard drive. If that page is accessed again and has not been modified, the browser will open the page from the previously saved cache instead of downloading the page again” (Brunty, 2012)

“Criticism ranged from claims that they ‘dumb down’ the digital investigative process to suggestions that they allow a deterioration of expert knowledge by an over reliance on automation and produce a less thorough, or lower quality, investigation” (Vincze, 2016)

“[e]ach time a web page is opened, it is sent to your browser’s temporary cache on the computer hard drive. If that page is accessed again and has not been modified, the browser will open the page from the previously saved cache instead of downloading the page again” (Brunty, 2012) Check your cached files What evidence do they reveal?

Objectives: Hashing Files Hashing all files in a folder Keyword searching: Listing the files the .txt files that contain a word Deleting duplicates: Deleting all duplicates of a file

Hashing a file import hashlib file1 = open("file1.txt","rb") fileContent = file1.read() m = hashlib.md5() m.update(fileContent) print(m.hexdigest()) a = input("press any key to exit")

Hashing all .txt files in a folder import os import hashlib folder = os.listdir(".") for name in folder: if(name.endswith(".txt")): file1 = open(name, "rb") fileContent = file1.read() m = hashlib.md5() m.update(fileContent) file1.close() print(m.hexdigest()) a = input("press any key to exit") Write the hashes to a file instead of printing them Hash all files in a directory called NewFolder Use os.listdir(“NewFolder”) Use name2 = “NewFolder/” + name

Listing files that contain the word hello import os import hashlib folder = os.listdir(".") for name in folder: if(name.endswith(".txt")): file1 = open(name, "r") fileContent = file1.read() if("hello" in fileContent): print(name) print("\n") a = input("press any key to exit")

Deleting a file import os os.remove("file1.txt")

Deleting if it contains the word ‘hello’ import os import hashlib folder = os.listdir(".") for name in folder: if(name.endswith(".txt")): file1 = open(name, "r") fileContent = file1.read() file1.close() if("hello" in fileContent): try: os.remove(name) except Exception as e: print(e) a = input("press any key to exit") 1. Create a python script that creates a file that contains a list of the files that contain the word ‘kill’

Removing Duplicates of the file f1.txt import os import hashlib items = os.listdir(".") hasher = hashlib.md5() file = open("f.txt", "rb") file2 = file.read() hasher.update(file2) h1 = hasher.hexdigest() for nn in items: file = open(nn, "rb") h2 = hasher.hexdigest() file.close() if(h1 == h2 and nn != 'f.txt'): print(nn) try: os.remove(nn) except: print("failed") e = input("press any key to exit") Removing Duplicates of the file f1.txt The script removes all duplicates of the file f.txt How do we create a script that remove all duplicates?