Reference no: EM133800517
Assignment - Cyber Forensic
In this Lab Assignment, you will use WinAudit/DevManView to identify computer system/software/devices configuration details and use WinHex to perform a byte-level forensic examination.
A significant proportion of the practical work for the course will entail use of Amazon Web Services (AWS).
To prepare:
1. Create or activate an AWS account. (Note: Access the PDF document in the Learning Resources for guidance.)
2. Log on to AWS.
3. Explore the basic, top-level, Cloud Management functions, services, options, and key tools offered by AWS.
4. Review relevant information in the official Amazon Web Services white paper, available in this week's resources.
For these tasks, you should refer to, and follow, relevant instructions in the official Amazon Elastic Compute Cloud User Guide, available in this week's resources.
Tasks:
1. Log on to AWS using the user account credentials provided by AWS.
2. Launch a new instance using the Amazon EC2 console in your default Region/Availability Zone.
3. Select the Amazon Windows server.
4. Choose the t2. medium instance type.
5. Launch the instance in the default VPC.
6. Assign the instance a public IP address (your choice), and add a tag to the instance of Key: Name, Value: MCYB6270-YourName
7. Create a new security group called MCYB6270-Group-YourName.
8. Add a rule to the group MCYB-Group-YourName, allowing RDP access from any IP address.
9. Launch the instance and, when prompted for a key pair, create a new public-private key pair - MCYB6270Key-YourName. Download the private key (a .pem file) to your workstation.
10. Open a Windows terminal or command prompt window and copy the private key into the working directory.
11. Run the command on the key file as follows - MCYB6270Key-YourName
12. Use the Windows native RDP (Remote Desktop Platform Place Your Order Now!) to connect to AWS server. For example, you may follow the instructions
13. When you log on to AWS Windows server, download and install DevManView
14. Download and install FTK imager
In this Lab, you need to learn how to carry out forensic investigations using these tools.
15. Run the devmanview.exe to identify all devices connected to Windows and make a screenshot.
16. Run FTK Imager to investigate the disk image RHINOUSB.dd