courses

Timeline analysis and Network Forensics

Due Date: 2026-05-26 23:59:59

Timeline Analysis

Introduction

Kelly Copy is a researcher at the University of Illinois studying water tables. She submitted a proposal to a federal funding agency. Allison Origin is a graduate student in another lab at the university. Allison claims that Kelly stole her data and writing and used the results to produce the proposal. Allison submitted the USB drive she kept her research on, which was imaged (obtain tim.dd.xz via scp <ODIN username>@linux.cs.pdx.edu:/stash/forensics/tim.dd.xz . from your VM) though all the data has been deleted. Kelly’s computer was also imaged as a part of the investigation (obtain tim2.dd.xz via scp <ODIN username>@linux.cs.pdx.edu:/stash/forensics/tim2.dd.xz . from your VM). You’ve been hired by the university to investigate Allison’s claims.

Checksums

File system forensics

Let’s begin by looking at the file system of the thumb drive (tim.dd.)

mmls tim.dd

mmls prints the partition table. The output looks something like:

DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors

      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
001:  -------   0000000001   0000000001   0000000001   Unallocated
002:  000:000   0000000002   0000000062   0000000061   Win95 FAT32 (0x0b)

The Start column gives the sector offset of each partition. Here slot 002 starts at sector 2 — that is the value passed to the -o flag below.

There’s a FAT32 partition on the thumb drive. We’ll use Sleuthkit, a classic file system forensics tool, to examine the file system on this disk image.

❯ sudo apt-get install sleuthkit
❯ fls -o 2 tim.dd

fls​ is intended to be analogous to the Unix ​ls​ command, but for a file system. The ​-o​ argument indicates the offset of the partition, which we can get from the ​mmls​ command.

File system timeline

The raw output of ​fls​ shows some interesting data relevant to our case, but we’d ideally like to view what happened to the file system chronologically. We can do this by creating a timeline.

❯ fls -l -m "/" -z CST6CDT -f fat32 -r -o 2 tim.dd > body.txt
❯ mactime -b body.txt -d > tim.csv

You can view the csv file produced by mactime in a text editor or Excel. Alison says she was working in Microsoft Word. Search through the timeline for a “docx” file. When was this file deleted?

Deleted file recovery

The “meta” column in the mactime output contains the inode address of the deleted file. Let’s recover it using another sleuthkit command. icat works similar to cat, but based on inode numbers.

❯ icat -f fat32 -o 2 tim.dd ​inode​ > recovered.docx

Do the contents of this file look familiar? Using what you already know, you should be able to view the metadata from this file to recover more clues. Who created the file? When? What software were they using?

Super timeline/plaso

Plaso is a powerful, integrated tool and Python backend for doing timeline forensics that incorporates Sleuth Kit. Using this tool, we can integrate artifacts from the file system, registry, log files and much more into a comprehensive timeline. Running the program produces a binary .dump file, which is not human-readable. The default behavior is to use all the parsers available in plaso (e.g. file system events, registry changes, and event logs.)

Install plaso using uv (the current recommended method — faster and avoids dependency conflicts with system Python):

❯ sudo apt remove python3-plaso plaso 2>/dev/null   # remove any system package first
❯ curl -LsSf https://astral.sh/uv/install.sh | sh   # install uv if not already present
❯ uv tool install plaso

uv tool install creates an isolated environment automatically and adds log2timeline, psort, pinfo, and psteal to your PATH. Verify:

❯ log2timeline --version
❯ psort --version

If you need to upgrade plaso later:

❯ uv tool upgrade plaso

The below command will take a long time (about equal to the installation). ​Even the image for this simple scenario contains hundreds of thousands of events.

❯ log2timeline --vss_stores 3 --volumes all --hashers all --parsers webhist,win7,win7_slow,win_gen --storage-file tim2.plaso tim2.dd
Flag Meaning
--vss_stores 3 Process Volume Shadow Copy (VSS) store 3 — Windows shadow copies can contain deleted or older versions of files; use all to process every shadow copy
--volumes all Process all partitions/volumes found in the image
--hashers all Compute cryptographic hashes for each file encountered (useful for hash-based IOC matching)
--parsers webhist,win7,win7_slow,win_gen Restrict to these parser groups instead of running all parsers (dramatically reduces runtime); covers web history, common Windows 7 artifacts, slower Windows 7 parsers, and generic Windows event sources
--storage-file tim2.plaso Output file — a SQLite database containing all extracted events

We can use the dump file to build a human-readable csv format using psort. It’s also possible to output in other formats, including SQL databases. ​This will take a LONG LONG time.

❯ psort --output_time_zone "CST6CDT" -w tim2.csv -o dynamic tim2.plaso

As you might imagine, a full timeline of all the events that happened on the system is a bit much for a human to read. To pare down our search, you can take a time slice around the time the documents were deleted from the USB device we examined earlier or search for interesting strings in the timeline.

Suggestions to help make a smaller file: grep .docx tim2.csv > new.txt

Look at the new.txt file.

Use this final timeline to complete your investigation. What was the sequence of events that lead to the creation of ​proposal.pdf​ and the deletion of the contents of the USB drive? Can you establish who is responsible?

Report

Write a 1-2 page comprehensive forensic report of your findings with the following sections:

Reference Material

Submission

This report should go in your repo in a file called hw4/hw4_1.md.

Network Forensics

Introduction

John wakes up in the morning and found that his MacBook Pro, Android phone, and iPhone are missing. He thinks he must have lost them at the bar last night. Later that day, he calls the bar, and the bartender confirms that they found no iPhone last night. John rushed to the campus cops and files a missing device case. However, he could not provide the MAC address of the devices. He was able to give his netid: jschmo.

As a forensics investigator you are called in to investigate the case. You have been given two log files:

Log format reference:

RADIUS entries follow this pattern:

TIMESTAMP server radius.authN[PID]: [wireless] Auth OK|FAIL for USERNAME ... on CLIENT-MAC via AP-IP:AP-MAC:SSID id AP-ID ...

Key fields: timestamp, username (for USERNAME), client MAC address (on XX:XX:XX:XX:XX:XX), AP identifier (id NNN), and auth result (OK or FAIL).

DHCP entries follow this pattern:

TIMESTAMP server dhcpd[PID]: DHCPACK|DHCPEXPIRE on IP-ADDRESS to CLIENT-MAC (hostname) ...

Key fields: timestamp, lease event type, IP address assigned, and client MAC address.

OUI lookup: The first three octets of a MAC address (the OUI — Organizationally Unique Identifier) identify the manufacturer. Use macvendors.com or the IEEE OUI registry to map MAC prefixes to manufacturers. This is how you distinguish a MacBook from an Android phone.

You can use any of the commonly available tools/scripting languages (e.g. grep, cat, awk/python/bash scripts etc) to answer the following questions.

Questions:

Submission

Please answer all the above questions in a file called hw4/hw4_2.md in your repo. Please list the questions and then provide the answers in the same order. It will just make my life easier.