Digital Forensics
Due Monday, March 10

Assignment 4: File identification

Your assignment is to analyze the two files on 45.56.74.139 at /usr/local/CIS4385/{1,2}.

First, create a new subdirectory called ~/assign3, and copy these into it:

$ mkdir -v ~/assign3
mkdir: created directory '/home/test/assign3'
$ cp -v /usr/local/CIS4385/{1,2} ~/assign3/
'/usr/local/CIS4385/1' -> '/home/test/assign3/1'
'/usr/local/CIS4385/2' -> '/home/test/assign3/2'
      

I would strongly suggest only doing this analysis on 45.56.74.139 (and not on your personal machine or a regular departmental server.)

Some programs to consider for your analysis are file, strace, readelf, gdb, and r2 (all of which are on 45.56.75.139).

The questions to answer are:

  1. What are these files? (I.e., are these executables; if so, then on what sort of platforms are these executable.)
  2. How was each created? (Feel free to speculate, but there is clearly some amount of information embedded in these files, and your speculation should cohere with that information.)
  3. What is the function of each of these files?

Please put your write-up in ~/assign3/WRITEUP.TXT; please address each of the above points in your write-up. (I suggest that you use the list above as the initial contents of your write-up, but if you feel it's more clear to use a different format, please do so.)

You don't have to submit anything; I will review your WRITEUP.TXT file on the server.

The assignment is due by the beginning of class on Monday, March 10.