Overview

The objective of this assignment is for you to demonstrate an understanding of timelines and MAC times. There are TWO parts to the assignment. The first is where you run a couple of Linux forensics utilities against an image to create a timeline based on files I’ve provided.  You will then answer questions associated with the timeline you created.

Part two of the assignment requires you to answer questions about a timeline I provide you.

Files

• Assignment Description
• Files for part 1 (https://dl.dropboxusercontent.com/u/1546231/4860.3.part.1.zip)
• File for part 2 (https://dl.dropboxusercontent.com/u/1546231/4860.3.part.2.WindowsXPTimeline.zip)

Video

• Date and time stamps (right click and Save As)

Textbook

• Nelson Chapters 7 & 8

Additional Resources

• Detecting changes in date and time stamps
• Time stamp forensics
• MAC times
• P. Craiger, Computer forensics methods and procedures. In H Bigdoli, (Ed), Handbook of Information Security, New York, John Wiley, Vol 2., pp. 736-755, 2006.