The idea is that there is lots of slack space (shown as dots using
the hex editor tool) on the storage device that runs to the end of the
sector that the file is saved in. This is the space on a disk that is
unused when a file smaller than a sector is saved into that sector. This
slack space can only be used if the file saved in that sector is made
large enough to take up all of the space in the sector. A hex editor can
be used to directly store data directly onto this slack space, as will
be demonstrated in this exercise. The MD5 hashing tool uses an algorithm
to derive a hash value for any given file. Each file has a unique hash
value. Therefore slight changes to a file can generate totally different
hash values.
1. Login to a Windows machine in the lab.
a. Username: Administrator
b. Password: (no password)
2. Open a Windows explorer and browse to c:\temp\forensicdata\modified
and run the file spider.exe (spider solitaire). This is the modified
file.
3. Does the game of solitaire function as intended?
4. Double click the link “MD5Hash” to open a MD5 hashing tool.
5. From the Windows explorer drag the file “spider.exe” in
folder c:\temp\forensicdata\modified to the MD4Hash window.
6. What is the hash value displayed for the modified file?
7. Similarly what is the hash value for the original file
“spider.exe” in folder
c:\temp\forensicdata\original
8. Close all windows.
9. Open Hex Workshop by double clicking the link “Hex
Workshop.”
10. Click the Compare button on the toolbar (or go to the Tools
menu and click Compare > Compare Files)
11. Click the button (with ellipses) to the right of the Source
box and browse to c:\temp\forensic data\original\spider.exe
12. Click the button (with ellipses) to the right of the Target
box and browse to c:\temp\forensic data\modified\spider.exe
13. Make sure the Resynchronizing Compare radio button option
is selected
14. Click Ok to begin comparing the two files.
15. On the toolbar, click the Next Difference button (next to
the Compare button on the toolbar or go to the Tools menu and click
Compare > Next Difference)
This will highlight any difference in the file for you. The top
window will show the original file and the bottom window shows the
modified file. You should see the text that was inserted into this file
using a hex editor. This could have been malicious code that was
executed when you first opened the file.
16. Close all windows.
NOTE: Hex-editors and other editors that can write directly to a
storage device must be used with extreme caution.
