Target Detailed Information Note Personal HW Type Virtual System VMWare v11 Computer CPU 1 Processer (2 Core) (PC) RAM 2,048 MB HDD Size 20 GB File System NTFS IP Address 10.11.11.129 NAT English (64 bits) SW Operating Microsoft Windows 7 MSDN image (not activated) (OS) System Ultimate (SP1) SW Web - MS Internet Explorer Latest versions if possible (Apps) - Google Chrome Document Microsoft Office Word, Excel, PowerPoint MSDN image (not activated) Cloud - Google Drive Auto Syncing is ON if possible - Apple iCloud NIST.gov mail server E-mail Microsoft Outlook Anti-forensics - CCleaner Latest versions if possible - Eraser Removable HW Type USB removable storage device Media #1 Vendor ID = 0x0781 Mfg. SanDisk (RM#1) Model Cruzer Fit Unique serial number Serial No. 4C530012450531101593 Size 4 GB File System exFAT Volume label Authorized USB Removable HW Type USB removable storage device Media #2 Vendor ID = 0x0781 Mfg. SanDisk (RM#2) Model Cruzer Fit Unique serial number Serial No. 4C530012550531106501 Size 4 GB Partitioned 1 GB only File System FAT32 Volume label IAMAN $_@ Removable HW Type CD-R Media #3 Size 700 MB (RM#3) File System UDF Created by Windows 7 Volume label IAMAN CD Smart Device - - - Future work Regarding developing user and system artifacts, we tried to keep simple as much as possible. For efficiency of both developing and analyzing images, it was designed to avoid complicated operations and create various meaningful artifacts from the viewpoint of digital forensics. Detailed behavior of the suspect is described as a text (below table) and visual diagram.
Target Detailed Information Note Personal Computer (PC) HW Type Virtual System VMWare v11 CPU 1 Processer (2 Core) RAM 2,048 MB HDD Size 20 GB File System NTFS IP Address 10.11.11.129 NAT SW (OS) Operating System Microsoft Windows 7 Ultimate (SP1) English (64 bits) MSDN image (not activated) SW (Apps) Web - MS Internet Explorer - Google Chrome Latest versions if possible Document Microsoft Office Word, Excel, PowerPoint MSDN image (not activated) Cloud - Google Drive - Apple iCloud Auto Syncing is ON if possible E-mail Microsoft Outlook NIST.gov mail server Anti-forensics - CCleaner - Eraser Latest versions if possible Removable Media #1 (RM#1) HW Type USB removable storage device Mfg. SanDisk Vendor ID = 0x0781 Model Cruzer Fit Serial No. 4C530012450531101593 Unique serial number Size 4 GB File System exFAT Volume label Authorized USB Removable Media #2 (RM#2) HW Type USB removable storage device Mfg. SanDisk Vendor ID = 0x0781 Model Cruzer Fit Serial No. 4C530012550531106501 Unique serial number Size 4 GB Partitioned 1 GB only File System FAT32 Volume label IAMAN $_@ Removable Media #3 (RM#3) HW Type CD-R Size 700 MB File System UDF Created by Windows 7 Volume label IAMAN CD Smart Device - - - Future work Regarding developing user and system artifacts, we tried to keep simple as much as possible. For efficiency of both developing and analyzing images, it was designed to avoid complicated operations and create various meaningful artifacts from the viewpoint of digital forensics. Detailed behavior of the suspect is described as a text (below table) and visual diagram.