594 lines
18 KiB
Markdown
594 lines
18 KiB
Markdown
# Forensisches Gutachten - Gruppe 13
|
||
|
||
## Auswertung sichergesteller Medien im Fall "Tilo Barkholz"
|
||
Bearbeitende Forensiker:
|
||
- Eric Lehmann
|
||
- Markus Winklhofer
|
||
- Yodkhatha Bick
|
||
- Niklas Heringer
|
||
|
||
# Datenübergabe
|
||
Die Daten des Falls wurden uns via einem **Write Blocker** übergeben, zu sehen im folgenden Bild:
|
||
|
||
Die technischen Daten des Write Blockers:
|
||
|
||
|
||
Die technischen Daten des Netzteils des Write Blockers:
|
||
|
||
|
||
Zur Sicherung des digitalen Beweismittels wurde zunächst das Tool `CRUWBlocker_.exe` ausgeführt, um den Write Blocker ordnungsgemäß zu initialisieren.
|
||
|
||
> Die Verwendung des Write Blockers dient der Gewährleistung der Integrität der vorliegenden Daten gemäß forensischer Standards.
|
||
|
||
Übertragungsaufbau:
|
||
|
||
|
||
Technische Daten der Ursprungsfestplatte:
|
||
|
||
|
||
Nach erfolgreichem Anschluss des Datenträgers wurden die Systeminformationen des Datenträgers erhoben:
|
||
```powershell
|
||
|
||
|
||
PS E:\> Get-Volume
|
||
|
||
DriveLetter FriendlyName FileSystemType DriveType HealthStatus OperationalS
|
||
tatus
|
||
----------- ------------ -------------- --------- ------------ ------------
|
||
E TOSHIBA EXT NTFS Fixed Warning Full Repa...
|
||
NTFS Fixed Healthy OK
|
||
C NTFS Fixed Healthy OK
|
||
```
|
||
|
||
```powershell
|
||
PS E:\> Get-Partition
|
||
|
||
|
||
DiskPath: \\?\scsi#disk&ven_nvme&prod_wd_pc_sn740_sddq#5&1551df2e&0&0000
|
||
00#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
|
||
|
||
PartitionNumber DriveLetter Offset Size Type
|
||
--------------- ----------- ------ ---- ----
|
||
1 1048576 100 MB System
|
||
2 105906176 16 MB Reserved
|
||
3 C 122683392 476.18 GB Basic
|
||
4 511417778176 659 MB Recovery
|
||
|
||
|
||
DiskPath: \\?\usbstor#disk&ven_toshiba&prod_external_usb_3.0&rev_5438#23
|
||
1841104d8b&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
|
||
|
||
PartitionNumber DriveLetter Offset Size Type
|
||
--------------- ----------- ------ ---- ----
|
||
1 E 1048576 465.76 GB IFS
|
||
```
|
||
|
||
```powershell
|
||
PS E:\> Get-PhysicalDisk
|
||
|
||
Number FriendlyName SerialNumber
|
||
------ ------------ ------------
|
||
0 WD PC SN740 SDDQNQD-512G-1014 E823_8FA6_BF53_0001_001B_444A_481A_...
|
||
3 TOSHIBA External USB 3.0 231841104D8B
|
||
```
|
||
|
||
|
||
|
||
Die Ausgaben zeigen, dass das externe Medium (TOSHIBA External USB 3.0) korrekt erkannt wurde und unter dem Laufwerksbuchstaben `E:` bereitgestellt war. Die physikalische und logische Struktur wurde dokumentiert, um die vollständige Nachvollziehbarkeit der durchgeführten Schritte zu gewährleisten.
|
||
|
||
## Übertragung der sichergestellten Medien
|
||
Eine Untersuchung besagten `E:`-Laufwerks zeigte eine einzelne anwesende Datei, `ForImage2.img`, Größe +++ GB.
|
||
|
||
Wir sicherten die Integrität der Datei durch Hashen (das Erstellen einer Datei-Signatur in ihrem aktuellen Zustand) vor und nach dem Übertragen.
|
||
|
||
```powershell
|
||
PS E:\> Get-FileHash .\ForImage2.img -Algorithm MD5
|
||
|
||
Algorithm Hash Path
|
||
--------- ---- ----
|
||
MD5 BE61A64B8AAD45ABBC0B4C266B688EB2 E:\ForImage2.img
|
||
```
|
||
|
||
```powershell
|
||
PS E:\> Copy-Item .\ForImage2.img C:\Users\herin\Documents\"DIF PL"
|
||
```
|
||
+++ analoge Pfade für die anderen? oder besser so lassen (dann hätten wir ja wohl alle übertragungen dokumentieren müssen)
|
||
|
||
```powershell
|
||
PS E:\> Get-FileHash 'C:\Users\herin\Documents\DIF PL\ForImage2.img' -Algorithm MD5
|
||
|
||
Algorithm Hash Path
|
||
--------- ---- ----
|
||
MD5 BE61A64B8AAD45ABBC0B4C266B688EB2 C:\Users\herin\Documents\DIF PL\ForImage2.img
|
||
```
|
||
+++ gescheite Command-Erklärungen
|
||
|
||
|
||
## Fallbearbeitung - Initialisierung
|
||
Team 13 verwendet in dieser Bearbeitung den eigens angefertigten [Forensic Log Tracker](https://github.com/mev0lent/forensic-log-tracker) - dieser dient der Automatisierung von Hashing, Autor-Signaturen sowie dem Protokollieren sämtlicher Aktionen.
|
||
|
||
```bash
|
||
flt new-case gutachten --description "Forensisches Gutachten im Fall Tilo Barkholz"
|
||
[+] New case created: /home/kali/forensic-log-tracker/logs/gutachten
|
||
[+] Logs for case 'gutachten' will be stored in: /home/kali/forensic-log-tracker/logs/gutachten
|
||
```
|
||
|
||
```bash
|
||
md5sum ForImage2.img
|
||
be61a64b8aad45abbc0b4c266b688eb2 ForImage2.img
|
||
```
|
||
|
||
Die Übertragung auf die Bearbeitungs-VM erfolgte reibungslos.
|
||
|
||
|
||
---
|
||
|
||
## Fallbearbeitung - Bearbeitungslog
|
||
|
||
|
||
# [++] Forensic report of case: dif_gutachten
|
||
|
||
## [++] Description
|
||
Forensisches Gutachten im Fall Tilo Barkholz
|
||
|
||
|
||
## [++] Timeline of Commands and Comments
|
||
|
||
### [+] Command: `file ForImage2.img`
|
||
- Timestamp: `2025-07-14T18-03-17-505557+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `7bf5d482601016dfe39f3de29aad7f83b3a0f59d3177828e1f1823817b1778d8`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
ForImage2.img: QEMU QCOW Image (v3), 35433480192 bytes (v3), 35433480192 bytes
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `file ForImage2.img`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T18:21:56.035483+02:00
|
||
|
||
`file` identifies file types by examining magic numbers and headers. Useful for verifying or correcting file extensions and detecting anomalies.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-05-10-852941+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Der file-Befehl wurde verwendet, um das Format des Abbilds zu bestimmen. Dabei wurde erkannt, dass es sich um ein QCOW2-Image handelt, ein haeufig genutztes Format fuer virtuelle Maschinen unter QEMU/KVM
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-06-02-925862+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Wir werden nun Partitionen im Image identifizieren, um sie zu extrahiern & zu analysieren
|
||
|
||
---
|
||
|
||
### [+] Command: `sudo modprobe nbd max_part=8`
|
||
- Timestamp: `2025-07-14T18-06-22-301370+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `aec4dbdae6db78716bf86b6c6d3a9f3327d00c39a9d0715fb7ff7b953c1c499f`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `sudo modprobe nbd max_part=8`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T18:21:56.051974+02:00
|
||
|
||
**[!] Note:** This command was executed with administrative rights (`sudo`).
|
||
[x] No specific explanation found.
|
||
|
||
---
|
||
|
||
### [+] Command: `sudo: qemu-nbd: command not found`
|
||
- Timestamp: `2025-07-14T18-06-51-644697+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `7bd21e679c39eb29ea0eebe56f0a54110538c4bdb094fbbd9d7b9e8d7c2a7ed4`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[!] Command failed:
|
||
sudo: qemu-nbd: command not found
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `sudo: qemu-nbd: command not found`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T18:21:56.068456+02:00
|
||
|
||
[x] No specific explanation found.
|
||
|
||
---
|
||
|
||
### [+] Command: `qemu-nbd: unrecognized option '--conect=/dev/nbd0'`
|
||
- Timestamp: `2025-07-14T18-07-49-932393+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `23ec6e05fb897e4b0ad2d77613416100a2fcd3f300135a2e5677364b4b115d74`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[!] Command failed:
|
||
qemu-nbd: unrecognized option '--conect=/dev/nbd0'
|
||
qemu-nbd: Try `qemu-nbd --help' for more information.
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `qemu-nbd: unrecognized option '--conect=/dev/nbd0'`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T18:21:56.085776+02:00
|
||
|
||
[x] No specific explanation found.
|
||
|
||
---
|
||
|
||
### [+] Command: `sudo qemu-nbd --connect=/dev/nbd0 ForImage2.img`
|
||
- Timestamp: `2025-07-14T18-08-00-970730+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `aec4dbdae6db78716bf86b6c6d3a9f3327d00c39a9d0715fb7ff7b953c1c499f`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `sudo qemu-nbd --connect=/dev/nbd0 ForImage2.img`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T18:21:56.102182+02:00
|
||
|
||
**[!] Note:** This command was executed with administrative rights (`sudo`).
|
||
[x] No specific explanation found.
|
||
|
||
---
|
||
|
||
### [+] Command: `sudo fdisk -l /dev/nbd0`
|
||
- Timestamp: `2025-07-14T18-08-17-811009+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `4a2bcce842d23a7b6e392a9e547e0942145cdd7450910980c116667d81b5078a`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
Disk /dev/nbd0: 33 GiB, 35433480192 bytes, 69206016 sectors
|
||
Units: sectors of 1 * 512 = 512 bytes
|
||
Sector size (logical/physical): 512 bytes / 512 bytes
|
||
I/O size (minimum/optimal): 512 bytes / 131072 bytes
|
||
Disklabel type: gpt
|
||
Disk identifier: 7AB35F56-8FB0-407B-AC62-FD7C3E10AB6A
|
||
|
||
Device Start End Sectors Size Type
|
||
/dev/nbd0p1 2048 4095 2048 1M BIOS boot
|
||
/dev/nbd0p2 4096 1054719 1050624 513M EFI System
|
||
/dev/nbd0p3 1054720 46135295 45080576 21.5G Linux filesystem
|
||
/dev/nbd0p4 46874624 68360191 21485568 10.2G Microsoft basic data
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `sudo fdisk -l /dev/nbd0`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T18:21:56.119311+02:00
|
||
|
||
**[!] Note:** This command was executed with administrative rights (`sudo`).
|
||
`fdisk` is an interactive command-line tool to create, delete, and manage partitions on storage devices.
|
||
|
||
|
||
Lists partition tables of all recognized devices.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-09-46-180536+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Das QCOW2-Image wurde mit qemu-nbd als Blockgerät bereitgestellt, um anschließend mit fdisk die Partitionstabelle und Dateisystemtypen zu identifizieren – ein essenzieller Schritt zur Strukturaufklärung und Vorbereitung weiterer Analysen.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-10-39-291304+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Hierbei haben wir vier Partitionen entdeckt, die wir nun naeher untersuchen werden
|
||
|
||
---
|
||
|
||
### [+] Command: `sudo mmls /dev/nbd0`
|
||
- Timestamp: `2025-07-14T18-10-44-804259+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `1e7e7d7d86604a62aceffd32db9f4f6f897f22c84de9f2367b46bf6fa4d9b77b`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
GUID Partition Table (EFI)
|
||
Offset Sector: 0
|
||
Units are in 512-byte sectors
|
||
|
||
Slot Start End Length Description
|
||
000: Meta 0000000000 0000000000 0000000001 Safety Table
|
||
001: ------- 0000000000 0000002047 0000002048 Unallocated
|
||
002: Meta 0000000001 0000000001 0000000001 GPT Header
|
||
003: Meta 0000000002 0000000033 0000000032 Partition Table
|
||
004: 000 0000002048 0000004095 0000002048
|
||
005: 001 0000004096 0001054719 0001050624 EFI System Partition
|
||
006: 002 0001054720 0046135295 0045080576
|
||
007: ------- 0046135296 0046874623 0000739328 Unallocated
|
||
008: 003 0046874624 0068360191 0021485568 FAT
|
||
009: ------- 0068360192 0069206015 0000845824 Unallocated
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `sudo mmls /dev/nbd0`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T18:21:56.136172+02:00
|
||
|
||
**[!] Note:** This command was executed with administrative rights (`sudo`).
|
||
`mmls` analyzes the partition layout of a disk image without modifying it. It shows partitions, offsets, and sizes — a typical forensic step before mounting.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-11-51-739620+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Die Analyse mit mmls dient der genauen Bestimmung der Partitionsstruktur und der Start-Offsets, was erforderlich ist, um gezielt Dateien zu extrahieren und das Dateisystem forensisch korrekt zu analysieren.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-13-42-016732+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Die mmls-Ausgabe zeigt vier Partitionen. Drei davon sind relevant für die Analyse – die BIOS-Boot-Partition (nur 1 MB) enthält keine Nutzdaten und wird daher übersprungen.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-13-51-840180+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Die Partitionen 005 (EFI), 006 (Linux-Dateisystem) und 008 (Microsoft-Dateisystem) werden einzeln gemountet und analysiert, um strukturierte und nachvollziehbare Ergebnisse zu erhalten.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-13-59-612800+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Eine sequentielle Analyse aller nutzbaren Partitionen erlaubt eine saubere Trennung der Datenquellen und kann forensisch besser dokumentiert werden.
|
||
|
||
---
|
||
|
||
### [+] Command: `sudo mkdir -p /mnt/efi /mnt/linuxfs /mnt/windows`
|
||
- Timestamp: `2025-07-14T18-16-06-814084+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `aec4dbdae6db78716bf86b6c6d3a9f3327d00c39a9d0715fb7ff7b953c1c499f`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `sudo mkdir -p /mnt/efi /mnt/linuxfs /mnt/windows`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T18:21:56.154189+02:00
|
||
|
||
**[!] Note:** This command was executed with administrative rights (`sudo`).
|
||
`mkdir` creates a directory. In forensic workflows, it is often used to prepare target folders for mounts or exported data.
|
||
|
||
|
||
The `-p` option ensures that parent directories are created as needed. It also avoids errors if the target directory already exists.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-16-14-867728+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Drei dedizierte Mount-Verzeichnisse wurden erstellt, um die Partitionen getrennt voneinander und nachvollziehbar analysieren zu können.
|
||
|
||
---
|
||
|
||
### [+] Command: `sudo mount -o ro /dev/nbd0p3 /mnt/linuxfs`
|
||
- Timestamp: `2025-07-14T18-18-28-516252+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `aec4dbdae6db78716bf86b6c6d3a9f3327d00c39a9d0715fb7ff7b953c1c499f`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `sudo mount -o ro /dev/nbd0p3 /mnt/linuxfs`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T18:21:56.171151+02:00
|
||
|
||
**[!] Note:** This command was executed with administrative rights (`sudo`).
|
||
`mount` is used to attach a filesystem to the directory tree. In forensic contexts, it must be used cautiously, as mounting can alter timestamps or content.
|
||
|
||
|
||
The `-o` option sets mount parameters — e.g., to enable read-only mode or suppress timestamp changes.
|
||
|
||
|
||
`ro` stands for "read-only". It ensures that the mounted filesystem is not modified. This is critical in digital forensics.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-18-36-250749+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Das Linux-Dateisystem wurde readonly in /mnt/linuxfs eingebunden, um die Hauptdatenstruktur des Betriebssystems forensisch zu untersuchen.
|
||
|
||
---
|
||
|
||
### [+] Command: `sudo mount -o ro /dev/nbd0p4 /mnt/windows`
|
||
- Timestamp: `2025-07-14T18-18-44-352022+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `aec4dbdae6db78716bf86b6c6d3a9f3327d00c39a9d0715fb7ff7b953c1c499f`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[STDOUT]
|
||
|
||
[STDERR]
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `sudo mount -o ro /dev/nbd0p4 /mnt/windows`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T18:21:56.188116+02:00
|
||
|
||
**[!] Note:** This command was executed with administrative rights (`sudo`).
|
||
`mount` is used to attach a filesystem to the directory tree. In forensic contexts, it must be used cautiously, as mounting can alter timestamps or content.
|
||
|
||
|
||
The `-o` option sets mount parameters — e.g., to enable read-only mode or suppress timestamp changes.
|
||
|
||
|
||
`ro` stands for "read-only". It ensures that the mounted filesystem is not modified. This is critical in digital forensics.
|
||
|
||
---
|
||
|
||
### [+] Timestamp: `2025-07-14T18-18-48-788722+02-00`
|
||
#### [+] Comment from analyst: Niklas Heringer
|
||
|
||
#### [+] Content:
|
||
Die als 'Microsoft Basic Data' gekennzeichnete Partition wurde readonly in /mnt/windows eingebunden, vermutlich zur Analyse von Benutzerdaten oder Überresten eines Dual-Boot-Systems.
|
||
|
||
---
|
||
|
||
### [+] Command: `qemu-nbd: Failed to blk_new_open 'ForImage2.img': Failed to get "write" lock`
|
||
- Timestamp: `2025-07-14T18-20-16-782579+02-00`
|
||
- GPG-signature: [+] Valid
|
||
- SHA256: `927576f78ad2da1d55b32d2e32af8a13ec8a59dcde4168fcfbea80ab6c3161be`
|
||
|
||
#### Output:
|
||
```Shell
|
||
[!] Command failed:
|
||
qemu-nbd: Failed to blk_new_open 'ForImage2.img': Failed to get "write" lock
|
||
Is another process using the image [ForImage2.img]?
|
||
```
|
||
|
||
#### Context:
|
||
### [+] Legal Context for `qemu-nbd: Failed to blk_new_open 'ForImage2.img': Failed to get "write" lock`
|
||
|
||
**Analyst:** Niklas Heringer
|
||
**Timestamp:** 2025-07-14T18:21:56.204455+02:00
|
||
|
||
[x] No specific explanation found.
|
||
|
||
---
|
||
|
||
|
||
## [+] GPG-Overview
|
||
Each `.log`-file was digitally signed with GPG where applicable.
|
||
The signature status is documented per command.
|
||
|
||
|
||
---
|
||
|
||
### Wichtige Abfolge nach Neustart der Forensischen Untersuchungsstation
|
||
|
||
Nach einem Neustart der virtuellen Maschine muss die Verbindung zum QCOW-Image erneut hergestellt werden, da die `qemu-nbd`-Verbindung und die Mountpunkte nicht persistent sind. Die folgenden Schritte sind erforderlich:
|
||
|
||
**1. NBD-Modul erneut laden**
|
||
Bindet das Netzwerk-Block-Device-Modul mit ausreichend Partitionseinträgen ein:
|
||
|
||
```bash
|
||
sudo modprobe nbd max_part=8
|
||
```
|
||
|
||
**2. Image erneut mit NBD verbinden**
|
||
Stellt die Verbindung zwischen dem QCOW-Image und dem NBD-Gerät her:
|
||
|
||
```bash
|
||
sudo qemu-nbd --connect=/dev/nbd0 ForImage2.img
|
||
```
|
||
|
||
**3. Partitionen erneut mounten (readonly)**
|
||
Mountet die relevanten Partitionen wieder in die vorgesehenen Verzeichnisse:
|
||
|
||
```bash
|
||
sudo mount -o ro /dev/nbd0p2 /mnt/efi
|
||
sudo mount -o ro /dev/nbd0p3 /mnt/linuxfs
|
||
sudo mount -o ro /dev/nbd0p4 /mnt/windows
|
||
```
|
||
|
||
Diese Schritte müssen nach jedem VM-Neustart durchgeführt werden, um erneut forensischen Zugriff auf die Dateisysteme zu erhalten.
|
||
|
||
---
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
---
|
||
|
||
## Ergebnis: Feststellung von Dateien zum Ermittlungsverfahren wegen Verkauf gefälschter Pässe
|
||
|
||
---
|
||
|
||
## Ergebnis: Nachweis der Nutzung/ Verbreitung
|
||
|
||
---
|
||
|
||
## Ergebnis Extrahierung der elektronischen Kommunikation (E-Mail, Chat)
|
||
|
||
--- |