Cyber Forensics

[Day 3] 3. Assignment

D

DITISS Admin

•August 26, 2026•1 min read

Attach a 2GB hard disk to your Virtual Machine.
Create a partition on the attached disk and format it.
Mount the partition.
Create a directory named
```
exam
```
.
Inside the
```
exam
```
directory, create a file named
```
paper1.txt
```
.
Create a subdirectory named
```
files
```
within the
```
exam
```
directory.
Copy some files from the
```
/etc
```
directory into the
```
files
```
directory.
Delete the
```
paper1.txt
```
file.
Use the
```
dd
```
command to create a disk image.

Next:

Disconnect the 2GB VMDK from the Virtual Machine.
Use FTK Imager to create an E01 image file.
Open the E01 file in Autopsy.
Check if Autopsy displays the deleted
```
paper1.txt
```
file under "Deleted Files."

Read Next

[Day 3] 4. Extra

**1. What is the location of containers locally?** - Containers are typically stored in the **/var/lib/docker** directory (on Linux systems) by def...

[Day 4] 1. Memory Forensics

Memory forensics involves analyzing volatile data captured from the memory (RAM) of a system to uncover evidence of malicious activity, user actions,...