170 likes | 425 Views
Forensie. A Robot for Google Wave. Mike Mabey CSE 598 – Spring 2010 Nishanth Kotha Venkata. Agenda. Motivation MBR/VBR/Timestamp Analysis Forensie Demo Applications Future work Q & A’s References. Motivation. Google Wave – Collaboration tool Java vs. Python
E N D
Forensie • A Robot for Google Wave • Mike Mabey • CSE 598 – Spring 2010 NishanthKothaVenkata
Agenda • Motivation • MBR/VBR/Timestamp Analysis • Forensie • Demo • Applications • Future work • Q & A’s • References
Motivation • Google Wave – Collaboration tool • Java vs. Python • Course knowledge • Open source extension
Master Boot Record (MBR) • It is the first 512 bytes of the hard disk (sector 0). • It performs the following activities: • Scans the partition table for active partitions • Find the starting sector of the active partition • Loads a copy of the boot sector from the active partition into memory. Note: Although every partitioned hard disk contains an MBR, the master boot code is used only if the disk contains an active, primary partition.
Volume Boot Record (VBR) • It is the first sector of the individual partition on the device
MAC Attributes • Date Analysis • Time Analysis 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Year (0 – 127) Month(1 – 12) Day(1 – 31) 1980 - 2107 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Hour (0-23) Minute (0 – 59) Second (0 – 29)
Forensie • Start using Forensie by: • Having a Wave account • Adding forensie@appspot.comas a contact • Start waving • Project home page: • http://code.google.com/p/forensie/
Applications • Good experience for authors • Provided hands-on knowledge of Wave • Mobile and decentralized access to forensic analysis tool • Paired with a hex editor, give a very quick and easy to use tool to discover basic hard drive structure • Very easy to share analysis with another Wave user
Future Work • Support attaching files to a blip for analysis • Wave currently doesn’t allow robots to access files • FAT analysis for simulation and training • Support more file system types: • NTFS • HFS • Image file reconstruction • Try adding valid header & footer to corrupt file • Make new file available for download/preview