The first experiments were redone without Process Monitor running, and analysis was then conducted. However, this resulted in the forensic images and memory captures being tainted with a large amount of data: on both the memory captures and hard drive images. In the first series of experiments, SysInternals Process Monitor v3.03 (previously Filemon and Regmon) was used to monitor system changes in the VMs ( Russinovich & Cogswell, 2012). MD5 values were calculated for these files and key terms were selected to enable searching and location of the data and files in subsequent analysis. A picture file in “jpg” format was created from the Enron data to further test if any differences were observed for different file types.
The text was also copied and used to create a Word 2010 document saved in the “docx” format. The text of email 3111 was copied and used to create a text file saved in the “rtf” format. The UC Berkeley Enron Email subset data file was used as the sample data and was downloaded from the project web site ( ) on the February 9, 2012. Thirdly, it was considered that if data of relevance was able to be located on smaller systems, there would be a greater chance of remnants on typically larger systems. Secondly, to reduce the time required to analyze the data resulting from the experiments. Firstly, to reduce the storage space required for the many virtual devices and forensic images created during the experiments. The base systems were set up with small amounts of memory and hard drive space for a variety of reasons. Using each copy of the Eraser-VMs, CCleaner was downloaded, installed, and run with default options. Using each copy of the Download-VMs, the Dropbox and Enron files were erased using Eraser software. Each file was downloaded to the VM Hard Drive Desktop and opened. Each file stored in the Dropbox account storage was opened but was not purposely downloaded.īrowser used to access the Dropbox web site at and sign in to the user test account. Using the Upload-VM, uninstall the Dropbox client software using the option from the Windows Start Menu.īrowser used to access the Dropbox web site at and sign in to the user test account. Enron sample data were uploaded to user Dropbox account. Browser for each test installed Microsoft Internet Explorer (IE), Mozilla Firefox (FF), Apple Safari (AS) and Google Chrome (GC).ĭropbox Windows client software (version 1.2.52) was downloaded and installed. Windows 7 Home Basic SP1, 1 GB RAM, 20 GB hard disk drive.
0 kommentar(er)
