Tuesday, 31 August 2021

Useful Forensic information in Apple MAC

 If you are a MAC user and looking to see some great information visit the following locations to find more information 


  • To see the History of installed Application cat /Library/Receipts/InstallHistory.plist

  • User Password  ~/Library/Keychains

  • List of Historically connected Wifi Access points  /Library/Preferences/SystemConfiguration/com.apple.airport.preferences

  • Current and historical Bluetooth devices : ~/Library/Preferences/com.apple.BluetoothAudioAgent.plist

  • Recently opened files,appliations and savers ~/Library/Preferences/com.apple.recentitems.plist

Tuesday, 24 August 2021

Attach new Hard Disk to Debian Virtual Machine in VMware Workstation Pro

Subscribe to " FACEITNET " Youtube channel for more interesting videos 

There are situations where you need to add 2nd Hard Disk to your virtual Machine. In windows its  quite an easy process. Click Here to see how to do this in windows. But Linux/ Debian you have to use some commands in terminal to archive this. 

This step by step document shows you how to add 2nd Disk on Debian OS. 

First Create a new virtual disk and attack to VM. to do this you need to shutdown the VM and add new virtual hard Disk. 






Once finished, you have created and attached the new virtual disk to your virtual machine you must logically configure it before it is ready for use

Power on the VM and go to terminal and confirm the disk is attached 


now you must format the disk with a filesystem, i am  going to use the fourth extended filesystem (ext4)

1) sudo mkfs.ext4 /dev/sdb


Now we have to mount this to the system, Create a new directory within /mnt using the following command:

2) sudo mkdir /mnt/external

configure it to mount automatically, this is done via fstab.

First, backup the fstab file 

3) sudo cp /etc/fstab /etc/fstab.bak 

Now edit the file  to the fstab file using the following sed command:

4) sudo sed -i -e '$a/dev/sdb\t/mnt/external\text4\tdefaults\t0\t0' /etc/fstab

now mount the disk 

5) sudo mount /mnt/external

Now you can create the directory under the disk 

6) sudo mkdir /mnt/external/analyst

change the user and group ownership of the directory to the analyst 

7) sudo chown analyst:analyst /mnt/external/analyst

 create a symbolic link, located on the analyst user’s desktop

8)  ln -s /mnt/external/analyst/ ~/Desktop/external



How to Share a File from Windows host to Dabian Guest in VMware Workstation Pro?

Subscribe to " FACEITNET " Youtube channel for more interesting videos 

If you are wondering how can i share a file or Folder from your windows host operating system to a Debian Guest operation system then follow the steps below. 

Go to your windows system and create a folder you wish to share with Guest OS. 


Then go to VMware setting and click on the option tab on the top, 

Now go to shared folder and enable the Folder Sharing. 

Then click on the add button and provide the path of the folder you would like to share with 


Click next and finish the file sharing. Now you would see something like below. 
 

Go to the Debian Terminal and use the following command to check the file is been shared

in the sudo 

cd /mnt/hgfs and enter

now type ls to list the files. 


you can create a symbolic link to your desktop and access the files too 

in the terminal run the following command 

 ln -s /mnt/hgfs/forensics ~/Desktop/myData



Now you can see the shared folder in the Debian. 
 








Monday, 23 August 2021

How to check the integrity of the downloaded file?

Subscribe to " FACEITNET " Youtube channel for more interesting videos 

Let's say, you have downloaded an operating system file from the internet and you are wondering whether it is the right file or it's been modified?

Most of the Applications and operating system ISO files today provide the checksum or SHA hash value as well. 

Once you downloaded the file check the SHA values to confirm you have got the file with no modification. 

Let's see how we can check the SHA hash to confirm the integrity of the downloaded file. In windows, you can use the Powershell command Get-FileHash

I have downloaded a file from the internet and saved it in the Download folder and the SHA has they had on the website

SHA1: 968126a78c9b56c019133fac3a5ec9a9c57db9ce 

PS C:\Users\Instructor\Downloads> get-filehash  .\debian-x64-buster-forensics.ova -Algorithm sha1


Alternatively, if you are using either macOS or Linux as your host environment, can calculate the SHA1 of the downloaded file using the following terminal command:  shasum -a1

Terminal: shasum -a1 <file path>



If the calculated SHA1 value does not match the value provided above then you need to redownload or consider downloading from another location 

Http vs Https