Digital Forensics and Incident Response COMP6445/COMP6845 18s2

End of course survey

Posted by Tek Huynh Saturday 10 November 2018, 09:38:31 PM.

Hey guys,

Congratulations on completing the Digital Forensics course.

If you have a few spare minutes, could you please fill out this survey so we can improve the course next year. We take this feedback seriously and onboard in future iterations of the course and we sincerely appreciate any feedback:

https://goo.gl/forms/ZrVXCqelnDijlfw22

We will release more information about a supplementary exam at a later date.

If you have any other formal questions, please let us know at cs6445@cse.unsw.edu.au.

I had lots of fun working with all of you.

Tek

Exam Instructions and Downloads

Posted by Roland Wen Saturday 10 November 2018, 10:37:31 AM.

Hi everyone,

Today is the day!

The exam instructions are available at:

https://exam.6445.sec.edu.au/

Make sure you read the instructions carefully, at least twice.

The exam files are encrypted so check that you're able to decrypt files using GPG. The instructions include a test file for you to test decrypting.

If you are using your own laptop you can download the encrypted exam files before the exam (the prac image is about 200 MB).

All the best, see you in the exam!

Cheers, Roland

Exam VM

Posted by Tek Huynh Friday 09 November 2018, 12:40:20 AM.

General VM Info

• Use of the VMs is optional. You may use your own laptop, use the lab computers, or both.
• You will be provided with 2 VMs to use during the exam. There will be a prompt allowing you to select between the two.
• The VMs can only run 1 at a time.
• The VMs do not persist changes, so any saved files will be lost when you exit the VM.
• To help you with this limitation, you may use this tool to save your exam write-ups on the class account
  • https://cgi.cse.unsw.edu.au/~cs6445/18s2/notes/notes.cgi/
  • You may also bring notes/commands into the exam using this tool.
  • Please inform Tek of any bugs/vulnerabilities
• These VMs will already have the files for the practical section of the exam mounted onto the CD/DVD Drive, so no need to download them again. You will still need to download the theory questions as they are bundled separately.
• You may download and install extra tools on the VMs if you wish during your exam time. You will be given the sudo/admin passwords to both VMs.
• We will give you links to the exam files along with all the exam instructions tomorrow. (hopefully)

Windows 10 VM

• Volatility
• Redline
• Autopsy
• FTK Imager
• Notepad
• Note: Please do not login as Administrator as this will trigger Windows Updates. The VM should already be logged in when you start it. You may need Administrator access to install or access things. This should be ok.

Linux VM - Ubuntu 14.04

• Emacs
• Vim
• VSCode
• Sublime
• The Sleuth Kit (TSK)
• Volatility
• Binwalk
• Xattr
• Binary Ninja
• IDA
• Radare2
• Pwndbg
• Pwntools