4

Suppose two users have done a murder at 6pm at Dunkin Donuts, I have got the hard disks on site, disk1 and disk2.

How do I identify the time and order of each user's activities on the hard disks?

The Gmail communications are easy to pick on, but I am not getting anywhere with the rest. I can see that users logged on multiple times. I can also see some failed logins, which makes me wonder what could have caused them on the first disk? The second disk installs ssh and it looks like it runs hydra, which is a brute-force password cracking tool. I don't see how it will be useful for them for a physical crime? The second disk also shows sessions opening, then other sessions opening before the opened ones close, which makes me wonder whether this is a remote machine. I don't really know what is going on here, so I can't figure out the timeline....

disk1 (larger)

(image containing a photograph of the logs of <code>disk1</code>, too long to reproduce)

disk2 (larger)

(image containing a photograph of the logs of <code>disk2</code>, too long to reproduce)

Improve this question
1
  • It isn't running hydra, he installs the libssh2 package from the hydra folder, which is strange because the user SSH session was already working. Have you possibly thought about the time stamps in the logs as possible alibis?
    – jas-
    May 14, 2015 at 11:22

1 Answer 1

Reset to default
3

My solution would be:

The user innocent compiles THC-Hydra from source, then realises that he / she is missing a necessery lib and installs it (hence the sudo aptitude install libssh-2 on innocent-laptop). He / she then proceeds to use Hydra against naive's ssh roughly at 18:22:30 (as marked by the network configuration). The attack succeds at 18:50:29. Innocent then proceeds to delete naive's .bash_history, launch a firefox on naive's computer (presumably through X tunneling) and sends an e-mail from naive's gmail to his / her own requesting a meeting at 5:50pm. Then innocent shuts down naive's computer and deletes his / her bash history before shutting down innocent-laptop too.

This basically means that innocent is trying to craft an allibi for him- or herself, which basically makes him / her the prime culprit in the murder.

TL;DR
Innocent isn't really innocent.

By the way where do you get homework like this? Because this stuff is awesome.

Improve this answer
1
  • Really, insane homework.
    – xyz
    Jun 24, 2015 at 19:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.