http://courses.cs.taltech.ee/w/index.php?action=history&feed=atom&title=Malware%3AITX8042%3A2015%3ALAB2 2026-05-21T21:06:39Z Selle lehekülje redigeerimiste ajalugu MediaWiki 1.35.9 http://courses.cs.taltech.ee/w/index.php?title=Malware:ITX8042:2015:LAB2&diff=2926&oldid=prev 2015-09-18T08:47:06Z

<p></p> <table class="diff diff-contentalign-left diff-editfont-monospace" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="et"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">←Vanem redaktsioon</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Redaktsioon: 18. september 2015, kell 08:47</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l14" >14. rida:</td> <td colspan="2" class="diff-lineno">14. rida:</td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  * Make  an virtual image of the drive/card</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  * Make  an virtual image of the drive/card</div></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>         * compute hash  </div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>         * compute hash  </div></td></tr> <tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>  * <del class="diffchange diffchange-inline">Restore data from the </del>virtual image</div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>  * <ins class="diffchange diffchange-inline">Use </ins>virtual image <ins class="diffchange diffchange-inline">and restore files from there with photorec</ins></div></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  * Document the processs</div></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>  * Document the processs</div></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td></tr> </table>

Toomas http://courses.cs.taltech.ee/w/index.php?title=Malware:ITX8042:2015:LAB2&diff=2855&oldid=prev 2015-09-08T19:52:31Z

<p>Uus lehekülg: &#039;== LAB 2 == ===Additional Reading + presentations!=== [https://docs.google.com/presentation/d/1pBPhAnQyTRVL7h7a37zayHx-pLWA8BAeiak2vvPHYH0/edit?usp=sharing Slides for lab] ...&#039;</p> <p><b>Uus lehekülg</b></p><div>== LAB 2 ==<br /> <br /> ===Additional Reading + presentations!===<br /> <br /> <br /> [https://docs.google.com/presentation/d/1pBPhAnQyTRVL7h7a37zayHx-pLWA8BAeiak2vvPHYH0/edit?usp=sharing Slides for lab]<br /> <br /> <br /> ===Assignment===<br /> <br /> Find USB Thumb Drive or SD card (The smaller, the better- it takes less time to create an image of it). If it is a new drive/card copy some files there and then delete them.<br /> <br /> For the actual lab:<br /> * Make an virtual image of the drive/card<br /> * compute hash <br /> * Restore data from the virtual image<br /> * Document the processs<br /> <br /> Additional question: Provide a reasoning why to restore from image rather than from actual drive/card.<br /> <br /> Upload the report to the moodle in time !</div>

Toomas