From 5ac1015bda8ecedb4b8361aba756b765ac36dde6 Mon Sep 17 00:00:00 2001 From: Frank Xu Date: Mon, 21 Jan 2019 20:13:08 -0500 Subject: [PATCH] data leakage data --- .../DataLeaks_Win7_mem/secret_file.docx | Bin 0 -> 11534 bytes ...ndow_memory_forensics_lab_2 (Optional).pptx} | Bin 2 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 FSCS727_Forensics/Labs/11_Volatile_Memory_Forensics/DataLeaks_Win7_mem/secret_file.docx rename FSCS727_Forensics/Labs/11_Volatile_Memory_Forensics/{Window_memory_forensics_lab_2.pptx => Window_memory_forensics_lab_2 (Optional).pptx} (100%) diff --git a/FSCS727_Forensics/Labs/11_Volatile_Memory_Forensics/DataLeaks_Win7_mem/secret_file.docx b/FSCS727_Forensics/Labs/11_Volatile_Memory_Forensics/DataLeaks_Win7_mem/secret_file.docx new file mode 100644 index 0000000000000000000000000000000000000000..c355663c536d0bc2bafeed1abed0b9f5cb57e4a7 GIT binary patch literal 11534 zcmeHN1y>!(wmw*p-~ zwl+>CHcooVZgwV)It;GXpjX+j&{SCfXh{42UjM-}P#ZsF)6Ik~dX;dC7So_&xSL%} z10BYfNUyjDkLLlc`ViaS`q+*It)K!Gg9IWYXT4fsRqYEHUq}TZV$`{iAK>yP`o-y5 zaL~@rexvs>#-~`1XIc>)WcLNVZEeGsW`|;WUDp#kqJ$)umXj8Mt$q!Nq)CWUed8X% zN*s8P!@73WwgQv1LT*PbR|ijss+)!RJg$0{&C5oD49|GpaZ=qZK{`;s_Ql72&%LS4 zc+VvHXotlBN1~HR0zCd?d9_IRLnjiaw+gfaePsDA21Q{Np32&8O_jNHvWqX*E>!Z! zYi}3mMHr!CMwe2v%hW$FXFO5C=SM)b@`!FO5}{GYtPud-?Z^gVOY>KVoes5PkRv0*Z_od_;(xIJ{q*Uj zv0auuOvnPq0S^J=Z3+urcsa6+Mq`V3^Y92-KxwSSIm_9{2cEe(Xq`O+@u7*yxG{If zG%@G3c%2i1L=}|KHpH15-5#yGR#!kmP-`Bu>x|t7@~7<|rVn3V1F63TglS-hf(f3* zT!$o&bYgAMi2T?pcy2*P4W2T3QC`jU(l{G#$ZnNMQQAf6N%yC|p1$gBjvIF98TpF18NFjQ?^H zV_PFNLnG>Cmapm}GdYC+Rz`Om=M4nD~4eN!!+d6_vS5MJmVVegoOc z{GBzkD=KL!kQKH6832F*A;a&i`I#@dDl)cY4US%i_VF3?oS4HFS)e@oss%e`og;UY(U2uW5fQKpS)FP* z#4r3a9o*(Asx*cfFf}lpy|b|n@A#dHmL(9L@<|+K1e->RDVF<%47QZz4563bZYp;b zW`v!`7g-8kpA`cQi-IrJ1er5`hpr!j)I>^7T0G5}P&Vg{2idZ6E|N4yi4$RJA8oLXT4h4YKxSPsALLCr!T@Ud1ODIaGQcf6h8-dX3~r( z*iV*3K^faZIXUY(5+j2yd?`kSJ(Le%5;G6c^qpn+WJfZ@O*NDvu&6X1)v1}BreD1V zX#}c7-Pch(_q11)KYS?8(TQYKJ!PQ;vb3~GG8_Yaocg7jEwsm^C!E~zc_N+ylV}=J zSzu>_wQTCs=rVqcJBKd>Jv|e44A1nIvMJCIuzx<3vOX*-RM&vk|G>LSmy%xt+U1_S%luqAftgZhl!o}e7yQ2wvZ3}V;dw8hW(v`#fs#s zuOa*kBLD!f|KOmLxrwz23*cUs-@2+uUmWlo#XDZ*l+fJmg7W+@ea=w?rYfhXWpC_ zYRpptZsRpyay8C%U@8RMs;c~KRhzvUEY`58C^*wWS+u%2-*Ibng!o-7GJpVviA z?>>R_>*f8+E4}-N3#F6U^J889o3D{O+>ck8e0N8)j7I{WVf4Hn4x@0vx?blunfyFe zoh`_bPS>Qe=dVg-v0P zS*Wqt*QV#a0!{>nO`)}XXE(n9zAH(($7}33@e)c!b<;&02GpcPwxF!XSc81%I|AmF z%UwW@d;J4hZeauQJqURczNJyJ=+()~J#!%ke5iO^PIR5T$nNM`!VV$geU_T|Iz1nU zhnB?Tw--Z39(BfYzHGNgMM~!`VMottlNkn{(xf3KtK;_s?hf!$84?Z#a6J$AbtGja zA{FX-C6cxXvZ-zoylRfe^;ozX0W17j-Sdpnzbb zU_dT7LKHh~Lag7+w(P>pGU4@OrTulnbh|)x27Zk-qR7YtC#6wH{P|gG1|=u2($cK) zvPVNTL(s)^gWOTG2Ps_JP^GhY+0ZrnQnTw_e9-lVl?%z}gqDO2?(>T_r;eoWPi;=N zi{Kr`Iob%-r0b31@})Og$45re1AfU^wfzarj$CbaRD>#``1B-L`Biib!K`)|0maC8 z*qQnmBwy@kJ`@#WkhR+p*)!#7XP_0&@4q{ERb!kP>}FM`$&(@pL#29j=1IMSQS`M%y+zi)l#7M$hAqx?IN11jx(T2(9lS3{PBN7wvM(IOW8h+oLYo0~qs3)(*q4%HA&63VRbN|LT+QfW zc;qEzr}~){c>4-9sw-r8&YB8li>*WhAUxd5l1gg2u%RnzFH?@AHGbU-suLwm>9e!X z-ZjkVQE>x`fBIn9%tu?(o;*zTHTGhr;QPFo#s`X2E!614soI17mUrLSRB4wv)VC(u z%AJpd4(ih}ZGB#uPpJmrPqFmjSeB^9EpX`~)UGE=IWFScuM~9M7LTBYZ0HtQ5>`;` z?zU^+c)97MV{~DwIFV&y+;50)X(K9IeP*D99>)95iAJM4duf%SS6tgFI9S$_pg43e zBc%f_QG?g5n>d~({+boSS>%2*Cw#*rydB2DSnRcVB&Dcb!wC15TFDuWf!65qN1o>5 z;}1A}{1o_zg-RXUD}ucDZSUxs9&}5leh{`PcC2&U^|T+?E%baqYt+uG3OzvC@cW5kMz^d#?i#d z$->6W@wbRltE%O=!T!SgSo#TOa|aXTh*D$xK|o>-mYp!p<}N~d_Ov#J(^%k3c>ZuUFILQ@8CM>t*oj@ znc+xa)vRI*6$$S;7695wlJymERVKCHhIp<})=h=_#6LDPn!#dHla;>ULC?tx2viH! zTBYJ%;DcEd4N=7o@hIm_cVBt5MY^weL3Nub;jkMSh&k9Q8_J|Um08{xO_eL3fG&%| zuwBoLlNmFMo)Ef5B)UXS3pdkgonEJh@zk3~Wr)`AeR zJTHq}k8WEiDhotzTo+v_3X(1Ajw^Xri(AAe=-(Zy9ciXjXaQ254HE*GP6 zMWD0-4|8lR_KT}QHP$X~FBSsDD|nu7ryrCppb4z^d_KTeaQQY>-D9jcR>_^fzD^ff z@Q!A_W5JS)#g9=OppIH!_DN>0);2_ZhA`p!Y)d3}0F+_N6lxIZU9j9|q0viriw#sE zin8J1)sgz5pFHuPH00w?!nNOIQMAYOq=RC6xno|V&{eQ}VH1Cdn#$y6TKbdP@F{z!4SDvNKkCn!tmk8;B|zp?bs7c zG-hNz&rnzkb^l9uRH|UA^v*OIsCTXE{1i0!n|ZvG_^~CDwq2xpx!uzDc2g$X`Jj14R5UN^KwqERir|!;4LBO|!iOE_UVCLwhbp^*!_h}!$q6^va zOj|hoEe+))tAW;~-i@IuNF+-rfcJUHh+E=2*^mAfshzRY-NSfc4~EPY)(sW90tU8g z1|%nEnA9(E@uUMSKtDVf&du(=5;koPsV*Nxq+Y7tEmd4`AE~zOUGg+6r!;2F-j$dS zpS`}^u>HrKY=phQ`ZeTKjSkt(V*as{HHApW$_9oYliwDd);JBDMJDv%)#n$e(5prY zVMHn+FP%R6L5mWnUI5<8Xoxf+yj&;-kM*zQaO_$ycsPj+%0f{}ghS&%(LY6JntBgw z>-bF4EFi&8q=vr1k|Z-|)B)C%4c;fl)rT9cMT{X+)MGyjsB=zryLUQJXT5Ts)U_+o+TK#6*>ka%+zSuKyTS}Dvl{G$ zAL7u&BN^?NrFx?Y69F=iJJ1z6DAlSPb%63^vtm1W8@KHXJbN9TxTH~8m#NQeBnB1K zk43Oj>kg2XgUN;W-QMc2tBRz@PK`+m$5ktXewZ{#aeh58JC*QH_-Lpvx$G$~m-}E} zC!aMG9Pj zAThFG9tT^anLb3hH6)8qAa%69OPXRhxBPOC$f`_&@iGy}Lc)36E+gy319buokl>LcQZ0bR7 zVFloXzjT|T@HUMEtb(iVhLX^Ox9mS|Pm=ND-TfGJc7!pT8Wz8r(c zgc?n(0hV&tn|vz1_u_z^P;O%@NS|LGKm1a8Z|QXQk&ns>XU{k-50Sv)xk<5T^H8Q3 zngwPyQ_$GV8X2#FMAH3_XY4E77YYUv65WBKn*F=m;cyy8ue*~Mg1Pf9BSK)kdO;dA zAFXJkP*Ml-HQs|yXtSv+@tSm*j$Z6!o_1shC6skkg5@GFIKRzt(vzJvyjOxbKpe1s z!L5dJhB(ga8&SwqtF6}AbxU@FUs>*}Lf;x4lf9{wN+96sBuh(8X7W`p;evgRh2q#O z2iSrN;)FK#4m;ab;W7_Ooi_&M_kdnm9f1}6 zOh3$5Q0Lk z@K_zWZl)K($1?Y5QpXK8zG6w%Z!8;Qzlel?X;~o7s`k#MM}BNu?t2!d?drmpasK1N zx@J!>zKb|~OLCj)qu~qR+)(?b(eZvm9KNhhZZdr8gus_XUD+1)9&rlkiY99#R49G+ zm40fm?0MYcggZ{5Re6NyU&Jz^+nW@{(07z-`clW}HDHK)PkC|H5MD>FX);ZIV3cs42F-+j!(t3sE2#5_I<0m5rlK+x8g72f_Enmjcr?SD?1ls z>nYx+gHO+g41+@z(s+XHG5g{~9g-sZEMEFdm!NEe{WoempRg%~du6kn&92$P^dK|+ z_YhRDCs|DO8~}i~0|3wl!ufN+CJ;;*(=SLFp9Z`3L*2XZ@BMQBIBtw9zwW=5p8$)Zv>YOHwzRxao) z~skF8O;gqI)NU?GKCzgq_T&c9qX^Pv?(>^BvgZ+%KHv$WRE|W_vOVuVFH4 zBol+&QdYM{hPD$P9CNCxLo!CyF`nC3Xw5_`o3HeTm7>3XKs6I}Q$W~mcUuOr9y1QZ zYrWpgc4F5H6$$UlAKzen*hZrOi^Id0(5vNRX)V4PB34~=t-rF~f4}W{F>83dA2$DX za_Jmn=qewV!fxqM>tS|&b8ASgew{ol$oj*GRC%10L$z&|VzM?Lr+0(NeoLfcL zRI!0(qwqCB64zI7;C5`DdC=2&9|fp}R8=MaiJvEZP9$2?;emBqD(>-iIUHZ6JsDuZ zr}I%}ll|U@b}m;To8G%CB?TsXP%7|<56NDi49U!PF=aZ;t07Z}&FNYbg{VzcxW8h0 zY|x6$=~fe^&8sY!Zu=M{VT|~sL5RT)Q`o{u%#qDST=SWWm=SW9WN{HwW^rYRh&%GQ zg>Sn~yy&7o~WI?qAfDEsO^o4U+AP(-Of!#)Hl9edf ziKdkO6;$(B{g;aPCNm>cU_7(j|3XQ6{zHv?%hgjjA9`|@BH8RqJn^*E~Fs02Te zq=fjikjo&7UOFpRYklS(DVQ*PU3~T7lkU#(aLW(^f^iA9x7kou<|3P_JCxInkQe*k zUS`IEqZZq!^3pe!Rr+(Enp$X!hKmln9+E>pgzv$1p7h8#j=pU+;_?`ncfd%&nmkf> z$*elkF8;>VT)>%M22?(9|3s$dULmTALNZ2AkkB;4L*`NDCh|<{JXq_nMwj9f+=6(j zyQ${LSJg>PMaD_ll+t~;BfEww2iIV0WV_dA{=?6X)cuhk4HIj`WJ6PICx_OF7Au1n z_qR$#7TTTx$E1oj#8WM>%^hnfDHuwf8JA_)WM_sQ{v~0P*YQF*)7_i?HHIZ1&UsKQBAEB?Th#RB zS*u`!~cmCU130!9QA(;~vsuO8mWOK`sH-M&8x#8F}=Fta2g=<=jXl z`J7ybBp_CI+G}%{6I1dkY_}y=%zC%#cMdg@E1^6`_=t<1i>wp3PPElSXe8>7bEyag zIyW`tr#yo$3kjkJYcr-Tm=;9yiT(vT8nq?~yJV3g)6j*o{NU@&yOe&CDEpX9|Ejpm ziA6PUk)*EnGm`F?^UQJi*0x?(u*p|PWX-d~H)eVJ=RdS?({A~voJ(+JHM(+CM-85y zt7+AQ`@Hm!ithi zYp`QI;#uKH-2vf9)aE%tunUFgkQ!~@^>Cz3d$FKX zQn8?T^c*3if0aWJNErWW=4a($>l&><3TLexB0z{uHYQeg&AI}jcpTX9V6-$hfm3O#l?-L7d02A&WI`Io|I|KEr9M@PSnN91oqEN)Zh z>?~v=HdDqUF;td7WTwgeb8P>DK!!?{oYUy(eM2vr6yC* z-W=u7QrPoYs8VrX`Uob|rn$tc<8yU2KZx)~XO0t^SDMNg+Gm(u!SriBx#?HA!s27_ zT1#SJ0}IVrhbX8BBi%TKj!nlV5(Gp+Gf^)hg`#D9qn}6Y zD)7UwJ1@9UzlfAZ+On~+M-m0`-?gwn6sC1WVdY8)kby`gfBkKihK#T7$De zzzD@T#D4njG=U|kdBiU=qq6z}b>BqbRi#i#D>eN!%ii{@NR^v=3+Y`#zJ%o#k&3qs zueH+qg{A>Nq+jj2DGKLCg$LNusYc5|TDEe{{dfX3dS}UqlEiz(&Eh=vBKv8@PgCo0 zHJRvd{?F=0%OaV5KX_wC$TUDqQbQV^NkL33+|;Vzf;Ma|Nvq5Zf4s53j9m6MWl`!#ea{G7 zPqQc?!lzK&=Ca0{A8+K8MjEopNj9ri{cfubz-oC5k)UAx%RN&GjwGQ2u(i&Q!$TK~ z;MN?lYV0U;vC6sgiB4Q_i+kZ6Yushj`#m3<8WEU`RFcwSkJNi(Hpvd3-n{$aeYujn zr<_>u(CzYIyO;T6?_JI9-D>M;Q#w_v@9BH9{iG4J4{m)ek7C!`Nc9}#5rmq-iz~9s zPPrUjS`TWiPyGM8sfL24hiEweoHz<;^q1=&(n#f{{%YW_X>LEG;~DQc)KW*(nvSa_2A@VEy*WdYn!mT0ajo;zF{@nl7#IOHu{xs18 zNmBXOQROG8>{s}&GVGsl4xE3(|02r%ivLxf`xCE+_iy|!V%@J6{;E>_i3b2u@d1Ee zHLG9Ie-#jZM)SV>3H^th@GJb+qurkdHi-Y2z5hMv$xFdO=