courses

Homework 1

Due Date: 2026-04-13 23:59:59
Submission: via GitLab repo

Introduction

This homework is intended for you to provide verification of a functional forensics workstation. You will be using this environment for the rest of the term. In theory, you have already completed nearly all of this. However, I want to make sure that you have a working environment before we get too far into the term.

All work will be submitted via MarkDown documents within a gitlab repo. You will be using this repo for the rest of the term. This repo exists on the CECS intranet.

Tasks

  1. Create a private GitLab repo called forensics-S26-<CECS> (replace <CECS> with your actual MCECS username) and clone it to your local machine. You will be using this repo for the rest of the term. This repo exists on the CECS intranet, and uses your CECS credentials for authentication.
  2. Add dmcgrath as a member (developer or higher) of your repo. This will allow me to view your repo and provide feedback.
  3. Create a folder within the repo called hw1. This is where you will add documentation regarding this assignment.
  4. Now that you have your repo set up, we’ll be turning to the workstation. I would suggest you document everything you did in a markdown file in your repo called hw1.md. And by suggest I mean require. I’m just being nice about it.
  5. Create your SIFT VM. SIFT (SANS Investigative Forensics Toolkit) is a pre-built Ubuntu environment maintained by SANS that ships with over 150 forensic tools pre-installed and configured. cast is the tool used to install and manage SIFT overlays — think of it as a SIFT-aware package manager. The overlay source teamdfir/sift-saltstack is the community-maintained Salt formula that defines exactly which tools and configurations make up a SIFT workstation. Use one of:
    • Windows – install Ubuntu 24.04
    • Mac – install Ubuntu 24.04
    • Linux: Install virt-manager and then otherwise follow the instructions on the Mac page.
    • In all cases, use the default SIFT credentials:
      • Login: sansforensics
      • Password: forensics
  6. Install the Sift overlay:
    1. Install the Latest Cast Binary from its release page
    2. Run ‘sudo cast install teamdfir/sift-saltstack’ to install the latest version of SIFT
    3. Congrats – you now have a SIFT workstation!
    4. $ sudo su - – Use to elevate privileges to root while mounting disk images.
  7. Include a screenshot of the workstation showing the successful output of the cast installation.

Submission

Once you have completed the above, you should have a markdown file in your repo called hw1/hw1.md that contains all the requested information. Commit and push this to your repo. Also commit and include the requested screenshots. Once you have done this, you can consider the assignment submitted.