Introduction to Digital Forensics - Assignment Example

INTRODUCTION TO DIGITAL FORENSICS INTRODUCTION TO DIGITAL FORENSICS Virtual disks are file types that behave just like the real hard disks but provide a variety of benefits to the user. For example, mistakes when working in a virtual hard disk cannot harm your computer like it would when working under the real hard disk. These virtual hard disks are created and saved as .vhd files. Fixed size virtual hard disk are .vhd files whose sizes are predetermined when the files are created. This paper looks at the creation and working of the fixed size virtual hard disks. Part 1 Alex. As a student there is often pressure to cheat especially given the numerous homework and parents expectations. Cheating seems to be the only sure way of staying safe from these. On the contrary, cheating is never the right option because it does not add value to my knowledge. In fact, cheating deprecates my knowledge As the lecturer, I must strategize on how to punish him without negatively impacting his behaviour. This is best done by talking to him and advising him that cheating will only give him an unfair advantage in class over the others. In reality, he cannot defend what is on his papers, therefore, the best punishment would be to give him a zero. Part 2 1. To create a virtual hard disk, right click on my computer and select manage. On the computer management screen that pops out click on Disk Management then action and create VHD. Browse to the folder in which you intend to save the virtual hard disk and choose the size you intend to assign the hard disk i.e. 72MB. Since this is a fixed size hard disk, click on fixed size. The virtual hard disk has been created, but it is listed as unallocated space. Virtual hard disks, just like their physical counterparts cannot be used unless they have been formatted. Right, click on the red arrow that faces down beside the Virtual hard disk and select the initialize disk. In the initialize disk box that appears select MBR and then click OK to proceed. Right-click the unallocated space and select the new Simple Volume so that a volume is created. Insert the amount of space you want to use with the volume and assign the volume a drive letter. Format the volume with any of the file systems and click on finish. 2. As per the requirement, this virtual hard disk is to be partitioned into three parts. Partitioning involves dividing the hard disk into logical parts. The first two partitions are FAT whereas the last partition is an NTFS. By partitioning this VHD, we can work on one partition without affecting the other partitions. Open the computer management tool and select the virtual hard disk. Select disk management and navigate to the available disks. A space is made for the new partition by clicking on the VHD and choosing shrink. Insert the number of MBs i.e. 40MBs you intend the partition to have and click next. When the new unallocated partition window pops up, click it and choose new simple volume option. Click next and insert the size of the partition and click on the next button. Assign a letter to the partition and proceed to select the NTFS file system in the file system type. Click on finish. Repeat the procedure to create the other 2 FAT partitions but in the size option insert 65MB and 6MB but leaving the file systems as FAT. Disk view is used to create the differencing disk. On the disk view tab locate the virtual disks and select create. Choose the differencing virtual hard disk. This creates virtual disk say VD1 with the original virtual disk as its parent. The differencing disk is used in categorizing the computers as one virtual machine. This virtual machine has just one hard disk. The catch is that, the virtual server can manage all the transactions in the network and, therefore, send the information to the differencing disk. The parent is usually taken as a read-only thereby giving the user the ability to create numerous differencing disks under one parent. These numerous virtual disks can be utilized with numerous virtual machines. Each of the virtual machines is given the ability to utilize the differencing disks with the operating system on the original disk. The residual text is oe25 and is 2KB. When text files are deleted, they often leave behind this type of files. It is interesting that the residual left behind is similar to the one left behind in the other FAT 32 partition. It appears that text files cannot be entirely deleted from the computer unless they are deleted and later overwritten. The size of the smaller FAT partition is 6MB, and the residual file is also named 0xe5 Disk view is used to create differencing disk views. To hide the virtual hard disk partition, right-click on the computer and click manage. From the list of options click on disk management to show all of the installed disks. Right-click the partition to be hidden and choose the change drive letter and paths. Select Remove and confirm with the yes button. On the dialog box that appears click finish. The partition will be hidden. The NTFS file system uses a storage algorithm to reduce input and output overhead. Typical attributes contain minute details linked to them. NTFS thinks it is fit to join the value to the attribute if the value cannot make the size of the attribute bigger than the size of the MFT. In this case, this attribute does not directly store its data but instead stores the allocation map that points to the real data that is stored somewhere else in the volume. The attributes of the resident data are directly accessed from the resident attribute. The size of data in resident files depends on the traits of the attribute. A user can force NTFS to label resident files as nor resident files or even non-resident files as resident files. For example, with a small text file the user can force the clusters to be allocated for the data so that the file is saved as a nonresident. The last file deleted from NTFS was the small.txt. Read More