Reference no: EM134010160
Lab Exercise – Introduction to Hexadecimal and the Windows Hex Editor
Hexadecimal – Relating to a numbering system that uses 16 as the radix, employing the numerals 0 through 9 and representing digits greater than 9 with the letters A through F. For students working with Computer Science concepts, hexadecimal analysis is an important skill in digital investigations and low-level file interpretation.
There are many ways to obfuscate computer files so that they become difficult to examine by forensic investigators. This week and in week 9 we will be examining how to counter these efforts and expose hidden components that may provide the forensic examiner with key evidence. Often, the forensic software suites will be able to determine what was hidden in these files. However, this is not always the case. It is sometimes necessary to work down to the machine-code level of interpreting the actual hexadecimal content to identify what was there before the attempted obfuscation. This week we will be doing just that – examining the hexadecimal content of files that have been changed so that the common user wouldn’t be able to tell what they were originally.
BEFORE YOU BEGIN
Create ONE SINGLE Microsoft Word document that will contain ALL your deliverables for this lab exercise. Cut-and-paste screen captures of project windows and / or text files into this document. You will submit ONE file, this Word document, as your deliverable for this lab exercise.
PART 1 – Downloading the Hexadecimal Editor
Download the Week 7 Project Files. At the bottom of the Weekly Lesson - Week 7 screen, download the files that we will be examining for this Lab assignment.
Scenario - In an attempt to hide important files from us, a suspect made modifications to the files so we wouldn't be able to open them.
Download and install the XVI32 Hex Editor. Understanding Computer System Architecture can also help when interpreting hexadecimal values and file signatures during forensic analysis.
Click the folder icon to open a file (1), navigate to your project files (2), click a file and open (3). Deliverable: Create a screen capture of each file that you open and include it in your deliverable.
Students studying Data Communication And Networking may also find file signature analysis useful when examining how files are transferred, modified, or concealed within systems.
Write it up.
In addition to the output files referenced above, write a brief description of the contents that are presented in these results. The delivered report should be written in no less than 200 words and no more than about 500 words. It is NOT necessary to use proper APA formatting (double spaced, indents, section headers, etc.). The report does NOT require an abstract, introduction, discussion, and conclusion. Please include any other sources (online and in the literature) if it is academically suitable for this type of work (i.e., Wikipedia is not permitted). Grading will be based upon content, grammar, spelling, format, and timeliness of the submission. There will be situations where you may not be able to find the result through your examination. Explain why you think the answer did not exist in each specific case.
Deliverable Summary for this Lab Exercise:
Word document containing a personal assessment of the Hex Editor output listed below.
Screen captures of each of the 9 files examined through the Hex Editor.
Your interpretation of each result with justification for your conclusion.
A final review of how Hexadecimal and the Hex Editor might be useful to you as a forensic examiner. Knowledge of Operating System concepts may also support deeper understanding of file handling and memory structures during forensic investigations.
This completes the requirements for this Lab Exercise.