diff --git a/P2P_Leakage/Presentation/ID00_Lab_Setup.pptx b/P2P_Leakage/Presentation/ID00_Lab_Setup.pptx new file mode 100644 index 0000000..b3d539d Binary files /dev/null and b/P2P_Leakage/Presentation/ID00_Lab_Setup.pptx differ diff --git a/P2P_Leakage/Presentation/ID01_Disk_Image_and_Partitions.pptx b/P2P_Leakage/Presentation/ID01_Disk_Image_and_Partitions.pptx new file mode 100644 index 0000000..7b18d86 Binary files /dev/null and b/P2P_Leakage/Presentation/ID01_Disk_Image_and_Partitions.pptx differ diff --git a/P2P_Leakage/Presentation/ID02_Registry_and_File_Directory.pptx b/P2P_Leakage/Presentation/ID02_Registry_and_File_Directory.pptx new file mode 100644 index 0000000..76a5c9c Binary files /dev/null and b/P2P_Leakage/Presentation/ID02_Registry_and_File_Directory.pptx differ diff --git a/P2P_Leakage/Presentation/ID03_MFT_Timeline.pptx b/P2P_Leakage/Presentation/ID03_MFT_Timeline.pptx new file mode 100644 index 0000000..79b520e Binary files /dev/null and b/P2P_Leakage/Presentation/ID03_MFT_Timeline.pptx differ diff --git a/P2P_Leakage/Presentation/ID04_USN_Journal_Timeline.pptx b/P2P_Leakage/Presentation/ID04_USN_Journal_Timeline.pptx new file mode 100644 index 0000000..9e12d22 Binary files /dev/null and b/P2P_Leakage/Presentation/ID04_USN_Journal_Timeline.pptx differ diff --git a/P2P_Leakage/Presentation/ID05_uTorrent_Log_File.pptx b/P2P_Leakage/Presentation/ID05_uTorrent_Log_File.pptx new file mode 100644 index 0000000..07578ad Binary files /dev/null and b/P2P_Leakage/Presentation/ID05_uTorrent_Log_File.pptx differ diff --git a/P2P_Leakage/Presentation/ID06_File_Signature.pptx b/P2P_Leakage/Presentation/ID06_File_Signature.pptx new file mode 100644 index 0000000..ce634e9 Binary files /dev/null and b/P2P_Leakage/Presentation/ID06_File_Signature.pptx differ diff --git a/P2P_Leakage/Presentation/ID07_Emails.pptx b/P2P_Leakage/Presentation/ID07_Emails.pptx new file mode 100644 index 0000000..4bde61b Binary files /dev/null and b/P2P_Leakage/Presentation/ID07_Emails.pptx differ diff --git a/P2P_Leakage/Presentation/ID08_Web_History.pptx b/P2P_Leakage/Presentation/ID08_Web_History.pptx new file mode 100644 index 0000000..d11707f Binary files /dev/null and b/P2P_Leakage/Presentation/ID08_Web_History.pptx differ diff --git a/P2P_Leakage/Presentation/ID09_Website_Analysis.pptx b/P2P_Leakage/Presentation/ID09_Website_Analysis.pptx new file mode 100644 index 0000000..7f87073 Binary files /dev/null and b/P2P_Leakage/Presentation/ID09_Website_Analysis.pptx differ diff --git a/P2P_Leakage/Presentation/ID10_Timeline_of_Case.xlsx b/P2P_Leakage/Presentation/ID10_Timeline_of_Case.xlsx new file mode 100644 index 0000000..b091dac Binary files /dev/null and b/P2P_Leakage/Presentation/ID10_Timeline_of_Case.xlsx differ diff --git a/P2P_Leakage/Presentation/Questions.docx b/P2P_Leakage/Presentation/Questions.docx new file mode 100644 index 0000000..2bb6877 Binary files /dev/null and b/P2P_Leakage/Presentation/Questions.docx differ diff --git a/P2P_Leakage/Scripts/p2p_lab_tool_install.bash b/P2P_Leakage/Scripts/p2p_lab_tool_install.bash new file mode 100644 index 0000000..b9e8324 --- /dev/null +++ b/P2P_Leakage/Scripts/p2p_lab_tool_install.bash @@ -0,0 +1,55 @@ +#!/bin/bash + +echo "*******************************" +echo "* *" +echo "* Installation Script *" +echo "* *" +echo "* *" +echo "* University of Baltimore *" +echo "* *" +echo "*******************************" + + +echo -e "Installing necessary tools...\n" + +# Installing tools + +sudo apt update -y + +sudo apt install git hashdeep libreoffice mutt python2 python3 python3-evtx sleuthkit sqlite3 sqlitebrowser xmlstarlet wine64 -y +sudo apt install vinetto tree libhivex-bin python3-hivex libesedb-utils pasco pff-tools libnl-utils libvshadow-utils ewf-tools -y +sudo apt install python-setuptools python3-setuptools python3-plaso pip foremost pst-utils bulk_extractor libimage-exiftool-perl -y +pip3 install time-decode +sudo apt install npm -y +sudo npm install -g imgclip + +cd ~/Downloads +wget https://raw.githubusercontent.com/dfir-scripts/installers/main/RegRipper30-apt-git-Install.sh +sudo bash RegRipper30-apt-git-Install.sh +rm RegRipper30-apt-git-Install.sh +wget https://github.com/torrent-file-editor/torrent-file-editor/releases/download/v0.3.17/torrent-file-editor-0.3.17-x64.exe +wget https://f001.backblazeb2.com/file/EricZimmermanTools/JLECmd.zip +unzip JLECmd.zip && rm JLECmd.zip + +# Installing other tools + +mkdir ~/Forensic_Tools +mv torrent-file-editor-0.3.17-x64.exe ~/Forensic_Tools +cd ~/Forensic_Tools +git clone https://github.com/volatilityfoundation/volatility.git +git clone https://github.com/volatilityfoundation/volatility3.git +git clone https://github.com/PoorBillionaire/USN-Journal-Parser.git +git clone https://github.com/PoorBillionaire/USN-Record-Carver.git +git clone https://github.com/PoorBillionaire/Windows-Prefetch-Parser.git +git clone https://github.com/prolsen/recentfilecache-parser.git +git clone https://github.com/dkovar/analyzeMFT.git +mkdir JLECmd && mv ~/Downloads/JLECmd.exe ./JLECmd +mkdir Torrent_File_Editor && mv ~/Downloads/torrent-file-editor-0.3.17-x64.exe ./Torrent_File_Editor +cd + +# Installing terminal emulator + +sudo apt install terminator -y + +# Ending +echo -e "\nFinished!\n" \ No newline at end of file diff --git a/P2P_Leakage/Scripts/p2p_lab_tool_install.txt b/P2P_Leakage/Scripts/p2p_lab_tool_install.txt new file mode 100644 index 0000000..b9e8324 --- /dev/null +++ b/P2P_Leakage/Scripts/p2p_lab_tool_install.txt @@ -0,0 +1,55 @@ +#!/bin/bash + +echo "*******************************" +echo "* *" +echo "* Installation Script *" +echo "* *" +echo "* *" +echo "* University of Baltimore *" +echo "* *" +echo "*******************************" + + +echo -e "Installing necessary tools...\n" + +# Installing tools + +sudo apt update -y + +sudo apt install git hashdeep libreoffice mutt python2 python3 python3-evtx sleuthkit sqlite3 sqlitebrowser xmlstarlet wine64 -y +sudo apt install vinetto tree libhivex-bin python3-hivex libesedb-utils pasco pff-tools libnl-utils libvshadow-utils ewf-tools -y +sudo apt install python-setuptools python3-setuptools python3-plaso pip foremost pst-utils bulk_extractor libimage-exiftool-perl -y +pip3 install time-decode +sudo apt install npm -y +sudo npm install -g imgclip + +cd ~/Downloads +wget https://raw.githubusercontent.com/dfir-scripts/installers/main/RegRipper30-apt-git-Install.sh +sudo bash RegRipper30-apt-git-Install.sh +rm RegRipper30-apt-git-Install.sh +wget https://github.com/torrent-file-editor/torrent-file-editor/releases/download/v0.3.17/torrent-file-editor-0.3.17-x64.exe +wget https://f001.backblazeb2.com/file/EricZimmermanTools/JLECmd.zip +unzip JLECmd.zip && rm JLECmd.zip + +# Installing other tools + +mkdir ~/Forensic_Tools +mv torrent-file-editor-0.3.17-x64.exe ~/Forensic_Tools +cd ~/Forensic_Tools +git clone https://github.com/volatilityfoundation/volatility.git +git clone https://github.com/volatilityfoundation/volatility3.git +git clone https://github.com/PoorBillionaire/USN-Journal-Parser.git +git clone https://github.com/PoorBillionaire/USN-Record-Carver.git +git clone https://github.com/PoorBillionaire/Windows-Prefetch-Parser.git +git clone https://github.com/prolsen/recentfilecache-parser.git +git clone https://github.com/dkovar/analyzeMFT.git +mkdir JLECmd && mv ~/Downloads/JLECmd.exe ./JLECmd +mkdir Torrent_File_Editor && mv ~/Downloads/torrent-file-editor-0.3.17-x64.exe ./Torrent_File_Editor +cd + +# Installing terminal emulator + +sudo apt install terminator -y + +# Ending +echo -e "\nFinished!\n" \ No newline at end of file