Bones & Bytes Digital Forensics Group C Summer Bridge 2015 FTK Imager Cookies Steganography

Day 1- Digital Forensic Cases  BTK Killer(Dennis Radar)- was a guy who killed ten people between 1974 and  BTK stands for Bind, Torture, Kill  The case went unsolved for 30 years  He sent a floppy disk to the local police with a deleted file, which showed that he killed the people  The investigators were able to recover the deleted file and proved it was him  He later confessed to killing the ten people & is now at the Kansas’s El Dorado Correctional Facility. His earliest possible release date is February 26, 2180.

Day 1 Continued- Digital Forensic Cases  Casey Anthony, 25 year old mother of a two year old daughter named Caylee Anthony.  Casey is charged with seven counts in her daughter's death, including first-degree murder. If convicted, she could face the death penalty.  Digital Forensics was used to recover Casey Anthony’s search history after she had deleted it (showing she searched how to make chloroform). Chemical testing the trunk of Casey’s car, carpet samples showed alarming amounts of chloroform and smelled strongly of human decay.  Casey was found not Guilty.

Day 2: Recovering deleted files  We began with studying the Origins of Forensic science along with Microscopy, Edgeoscopy, and Poreoscopy, which is when you take a fingerprint and determine who it is from. Also, we learned to recover deleted files using FTK Imager which told us nothing is ever really deleted from a computer.  We learned how to distinguish private from public law. We also learned what crimes can be committed on a computer and how perform professionally in criminal situations.

Day 2: Continued

Day 3 - Encrypt and Decrypt Through the use of infoencrypt.com we used a simple password to decrypt a message sent to us. Plaintext –Original Message Algorithm –Transformation Procedure Key –Variable used to scramble message Cipher text–Resulting garbled output Source

Day 3 Continued- Steganography  We used this concept by encrypting a message into an image, by using a program called Steganography (Version 1.2).  The encrypted message was then decrypted by another person using the same program.  Below is an example of our work: Before After

Day 3 Continued- Using Wireshark to Grab Passwords  We used Wireshark to extract plain-text data  Cookies  Passwords and usernames This is Wireshark grabbing all the plain-text data before filtering to HTTP Because this website doesn’t use encryption, we can use it to grab the username and password information. This is after we filtered to HTTP and then got the user ID and password from that website.

Day 4 - MISSING PERSON: Dr. Hwajung Lee  Dr. Lee has called our class upset because she is lost on campus  We can use the location service on her IPhone to determine where she is  She sent us this picture to help

Enabling Location Services Location Services Regex.info/exif.cgi

Jeffry’s Exif Viewer  Uses location services on a Smartphone to pinpoint your location  Gives info about the phone on which the picture was taken and where the picture was taken

We found her!  Dr. Lee is in Davis Hall in her classroom! We don’t know why she felt lost

DAY 5 RELATIONSHIPS: Summer Bridge has helped us meet new people and has given us the opportunity to fuse strong relationships. We met women from all over the nation and even another country that shared a common interest. These bonds will stick with each and every one of us even after this camp is over.