1. Mike Mabey CSE 598 – Spring 2010Nishanth Kotha Venkata A Robot for Google Wave

2. Agenda Motivation MBR/VBR/Timestamp Analysis Forensie Demo Applications Future work Q & A’s References 2

3. Motivation Google Wave – Collaboration tool Java vs. Python Course knowledge Open source extension 3

4. Master Boot Record (MBR) It is the first 512 bytes of the hard disk (sector 0 ). It performs the following activities: Scans the partition table for active partitions Find the starting sector of the active partition Loads a copy of the boot sector from the active partition into memory. Note: Although every partitioned hard disk contains an MBR, the master boot code is used only if the disk contains an active, primary partition. 4

5. Master Boot Record (MBR) 5 Byte RangeDescription 0 – 445Boot Code 446 – 461Partition Table Entry #1 461 – 477Partition Table Entry #1 478 - 493Partition Table Entry #1 494 - 509Partition Table Entry #1 510 – 511Signature value (0x55AA)

6. Volume Boot Record (VBR) It is the first sector of the individual partition on the device 6

7. MAC Attributes Date Analysis Time Analysis 7 4 3 2 1 0 8 7 6 5 15 14 13 12 11 10 9 Year (0 – 127)Month(1 – 12) Day(1 – 31) 1980 - 2107 4 3 2 1 010 9 8 7 6 5 15 14 13 12 11 Hour (0-23)Minute (0 – 59) Second (0 – 29)

8. Forensie Start using Forensie by: Having a Wave account Adding forensie@appspot.com as a contact Start waving Project home page: http://code.google.com/p/forensie/

9. Forensie: Structure 9

10. 10

11. Demo 11

12. Applications Good experience for authors Provided hands-on knowledge of Wave Mobile and decentralized access to forensic analysis tool Paired with a hex editor, give a very quick and easy to use tool to discover basic hard drive structure Very easy to share analysis with another Wave user 12

13. Future Work Support attaching files to a blip for analysis Wave currently doesn’t allow robots to access files FAT analysis for simulation and training Support more file system types: NTFS HFS Image file reconstruction Try adding valid header & footer to corrupt file Make new file available for download/preview 13

14. Q & A’s 14

15. References 15