silentnawer.blogg.se

1. #Hdd mfg serial number spoofing how to
2. #Hdd mfg serial number spoofing windows 10
3. #Hdd mfg serial number spoofing verification

Verification finished: Sat Apr 08 12:15:51 2017 Information for C:\Users\mbigueur\Desktop\USB Drive Image 2: It should be noted that both of the MD5 and SHA-1 hash values have changed subsequent to the addition of the aforementioned ten files.īelow is the output from the Image Summary screen from FTK Imager revealing more details of the drives metadata. The new hash values for the USB drive after adding the ten files are seen below in figure 5. I then created ten test files as seen below in figure 4 and copied them to the USB drive. Verification finished: Sat Apr 08 12:05:10 2017 Physical Evidentiary Item (Source) Information: Information for C:\Users\mbigueur\Desktop\USB Drive Image: NOTE: MD5 and SHA-1 Hashes were performed simultaneously providing two hash values adding an extra layer of integrity checking.īelow is the Image Summary output from FTK Imager, which is a more detailed data output.Ĭreated By AccessData® FTK® Imager 3.4.3.3 The hash and details of the forensic image acquisition is displayed as well in figure 3. Next, I performed physical acquisition using FTK Imager as seen in figure 3 below.

Step two is to ensure that we have a forensically sound environment by enabling USB write block, which I had performed using a quick registry hack as seen below in figure 2. For the sake of time, I decided to wipe the USB drive using the one pass zero option, which basically write a pattern of zeroes across the entire drive’s files system ensuring that no remnants of any prior data remains. After a short search, I decided to use a freeware program called “Disk Wipe v1.7”. The first step is to wipe the hard drive clean in order to achieve uncontaminated results during our experiment.

#Hdd mfg serial number spoofing windows 10

This assignment was performed using Windows 10 running as a virtual machine inside of VMware Fusion 8 hypervisor on macOS Sierra as the host operating system.

#Hdd mfg serial number spoofing how to

This assignment will walk through the basic forensic examination process of how to examine USB drive artifacts. This is why having the ability to examine USB device history and files are critical to digital forensic investigations. The proliferation of USB devices not only is an added convenience to users but also a hindrance to network and information security and as a result can be used for nefarious purposes.

(Like the Write Error Rate is way above WorstValue but yet the drive is functioning 100% and is only 10 months old.Īlso you can query specific drives. WRITE_ERROR_RATE 185 0 165 &H8 Again from my local drive.Īlthough i have no idea what the info is actualy saying about the drive. Code: Attribute Name Value Threshold WorstValue Status