Completed: October 2, 2025
Category: Digital Forensics & Incident Response (DFIR)
The purpose of this project is to simulate a digital forensic investigation using a confiscated USB drive from a fictional employee who was suspected of violating company policy at ACME Medical Center.
This project demonstrate professional forensic methodology including:
- Evidence acquisition and imaging
- Hash verification for data integrity
- Analysis using industry-standard tools (FTK Imager, Autopsy, OSForensics)
- Structured documentation of findings (view above Google Drive link)
The ACME Medical Center security team confiscated a USB device from employee Joe Bob, who is suspected of viewing illegal material on company computers and drives. The ACME Medical Center requests that all findings be documented in this report. The results of this analysis may be admissible in court proceedings.
Disclaimer:
All "contraband" are simply just photos of cats.
This investigation is entirely fictional and no real illegal material or sensitive data is used.
All names, files, and evidence are simulated replicas of a realistic forensic scenario and workflow.
The USB flash drive used for this examination was restored using OSForensics with an image called "Furry Image" which contained the contraband cat photos. This will act as our suspect drive.
The newly restored suspect drive would never be opened directly to ensure integrity of the original evidence.
| Tool | Version |
|---|---|
| USB Write Blocker ALL Windows | v1.3 |
| OSForensics | 11.0.1007 |
| FTK Imager | 4.7.3.81 |
| Autopsy | 4.22.1 |
All software used to conduct this examination is either owned or licensed to (me, my company, etc) and has been fully tested and/or validated for usage.
| Component | Description |
|---|---|
| Host Machine | Windows 10 |
| Processor | Intel Core i7-12700K @ 5.0 GHz |
| Evidence Device | JetFlash Transcend 8 GB USB |
- Environment setup - isolated from the internet, validate forensic tools, document environment, etc.
- Prepare storage media by labeling drive and forensically erasing bit-by-bit so all bits are set to zeroes.
- Fill out a chain of custody.
NOTE: Since this is a home lab and simulation, I did not conduct these steps. In a real world scernario, I would be forced to. These steps are extremely important to ensuring an investigation protects evidence integrity, credibility, and legal defensiiblity.
I received the USB drive (Transcend 8 GB, USB_SERIAL_REDACTED) at 11:21 AM EST. The drive does not appear to have its connections or external casing damaged. I photographed and documented before imaging.
- To begin, I software blocked the suspect USB using the company-approved USB Write Blocker ALL Windows v1.3 and then verified the hash of the original suspect USB with OSForensics.
- I then created two identical forensic images in FTK Imager, one as a forensic copy (Suspect USB FURRY IMAGE drive.001) and then a forensic working copy (Suspect FURRY IMAGE Forensic Working copy.001).
The forensic copy was used to conduct the research, discover evidence, and analyze data.
- FTK imager provided the MD5 and SHA-1 hash values for each copy. I compared them to the original drive.
The hash values matched the original drive and one another, verifying that the data was not damaged, overwritten, or altered in any way during the image process.
I used the FTK Imager to conduct an investigation into the forensic working copy. I added the image file as evidence, which showcased many folders for potential evidence on partition 1. The main folder was called “Harmless Folder” containing subfolders listed as Videos and HighQuality. There was also a Pictures folder and ‘Secret Folder’.
Illegal images and videos were located under "Harmless Folder". It contained a subfolder “Video” containing 49 graphics of .jpg, .mov, and .m4v files, all of which contain illegal material (photos of cats). There were 6 videos total of cats.
The root directory itself contained an additional 51 similarly formatted image files and 12 videos, though they are all either corrupted or overwritten. The video titles referenced cats and kittens.
I used Autopsy to recover a deleted backup folder that appeared twice labeled "HighQuality" which contained 82 images of cats. Before deletion, it would've been located under "Harmless Folder" and root.
The files were exported to the examiner’s machine to a folder located in the FTK Images folder called “Exported Contents” with their associated file extensions. See Appendix B for extracted images.
Exported Files Locations
For a DFIR report, the blurred photo would be used to avoid breaking laws and chain-of-custody rules. The second, unblurred photo would NOT be used for the DFIR report.
The SHA-1 and MD5 hash values were verified to ensure that data integrity was maintained.
I used FTK Imager to verify its image post-analysis, with the result matching the pre-analysis hash values.
After conducting a thorough investigation into the provided USB drive, I determined it contains potential illegal images. Despite some files being overwritten and corrupted, there is more than enough evidence to support the criminality of the contents of Joe Bob’s drive. A total of 149 confirmed photos of illegal content were located. Due to the explicit nature of the images recovered, the photos and drive will be turned into law enforcement for further investigation.
This project demonstrates the complete forensic workflow, from securing evidence with proper handling to analysis and documentation.
Despite this case being completely fictional, it reflects industry-standard DFIR methodology used in real investigations.
- Digital evidence imaging and verification (MD5/SHA-1)
- Chain-of-custody documentation
- Use of FTK Imager, Autopsy, and OSForensics
- Forensic workflow and methodology
- Technical report writing and structured documentation
- File recovery and metadata analysis
Digital Forensics · Incident Response · Cybersecurity · Autopsy · FTK Imager