Overview

Conducted forensic analysis using file carving, imaging, and investigation tools on Kali Linux, processing NIST-provided images (2020JimmyWilson.E01, 4Dell Latitude CPi.E01) and implementing intrusion prevention with Fail2Ban.

Task 1: File Carving

• Converted 2020JimmyWilson.E01 to image.raw using ewfexport for tool compatibility.

• Carved files with Foremost (foremost -i image.raw -o foremost_output), recovering over 2,000 JPGs, organized by file type.

• Used MagicRescue with JPEG-EXIF recipe (magicrescue -r /usr/share/magicrescue/recipes/jpeg-exif -d magic_output -M 5 image.raw), recovering 1,800 JPGs.

• Extracted metadata from Foremost’s JPGs using ExifTool (exiftool foremost_output/jpg/*.jpg > exif_output.txt), capturing timestamps and device data.

• Created carving_tools_analysis.sh to automate tool execution, timing Foremost (~~14s), MagicRescue (~~1220s), and ExifTool (~0s).

• Compared outputs, noting Foremost’s broader file type support (e.g., ZIP) versus MagicRescue’s recipe dependency.

Task 2: Forensic Imaging

• Converted 2020JimmyWilson.E01 to image.raw using ewfexport for Guymager and dd compatibility.

• Used Guymager GUI (sudo guymager) to manually add and acquire image.raw as .E01, inputting case details.