Disk imaging and analysis in Cybersecurity - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a disk image using the dd command.

Cybersecurity

dd if=[1] of=/path/to/image.img bs=4M

Drag options to blanks, or click blank then click option'

A/dev/sda

B/home/user

C/dev/null

D/etc/passwd

Attempts:

3 left

💡 Hint

Common Mistakes

Using a directory path instead of a device file.

Using a file that is not a disk device as input.

The dd command copies data from the input file (if=) to the output file (of=). To create a disk image, the input file should be the disk device, such as /dev/sda.

2fill in blank

medium

Complete the command to verify the integrity of a disk image using SHA256 checksum.

Cybersecurity

sha256sum [1]

Drag options to blanks, or click blank then click option'

A/dev/sda

B/home/user

Cimage.img

D/etc/passwd

Attempts:

3 left

💡 Hint

Common Mistakes

Trying to checksum the disk device instead of the image file.

Using a directory or unrelated file as input.

The sha256sum command calculates the SHA256 checksum of a file. To verify a disk image, you provide the image file name, such as image.img.

3fill in blank

hard

Fix the error in the command to mount a disk image read-only.

Cybersecurity

mount -o loop,[1] image.img /mnt

Drag options to blanks, or click blank then click option'

Arw

Bro

Cexec

Dnoexec

Attempts:

3 left

💡 Hint

Common Mistakes

Using rw which allows writing.

Using unrelated mount options.

To mount a disk image in read-only mode, use the ro option. This prevents any changes to the mounted image.

4fill in blank

hard

Fill both blanks to create a dictionary comprehension that maps file names to their sizes if size is greater than 1000 bytes.

Cybersecurity

{filename: [1] for filename, [2] in files.items() if size > 1000}

Drag options to blanks, or click blank then click option'

Asize

Cname

Dlength

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect variable names like 'name' or 'length'.

Not matching the variable used in the condition with the unpacked value.

The comprehension maps each filename to its size. The loop unpacks filename and size from files.items(). The condition filters sizes greater than 1000.

5fill in blank

hard

Fill all three blanks to create a dictionary comprehension that maps uppercase file names to their sizes if size is less than 5000 bytes.

Cybersecurity

{ [1]: [2] for filename, size in files.items() if [3] < 5000 }

Drag options to blanks, or click blank then click option'

Afilename.upper()

Bsize

Dfilename

Attempts:

3 left

💡 Hint

Common Mistakes

Using the original filename instead of uppercase.

Mixing up the variable names in keys, values, or condition.

The comprehension creates keys by converting filename to uppercase using filename.upper(). The values are the size. The condition filters sizes less than 5000 bytes.

Practice

1. What is the main purpose of creating a disk image in cybersecurity investigations?

easy

A. To delete unnecessary files from a disk

B. To make an exact copy of all data on a disk without changing the original

C. To speed up the computer by cleaning the disk

D. To encrypt the disk data for security

Solution

1. Step 1: Understand disk imaging

   Disk imaging means copying every bit of data exactly from a disk to a file, preserving all information.

2. Step 2: Purpose in investigations

   This allows investigators to analyze data safely without changing the original disk, which is crucial for evidence integrity.

3. Final Answer:

   To make an exact copy of all data on a disk without changing the original -> Option B

4. Quick Check:

   Disk imaging = exact copy without change [OK]

Hint: Disk imaging means exact copy, not deletion or encryption [OK]

Common Mistakes:

• Confusing imaging with deleting files
• Thinking imaging speeds up the disk
• Mixing imaging with encryption

2. Which of the following commands is commonly used to create a disk image in Linux?

easy

A. dd if=/dev/sda of=/path/to/image.img

B. rm -rf /dev/sda

C. ls -l /dev/sda

D. chmod 777 /dev/sda

Solution

1. Step 1: Identify disk imaging command

   The dd command copies data from an input file/device to an output file/device, perfect for disk imaging.

2. Step 2: Analyze options

   dd if=/dev/sda of=/path/to/image.img uses dd with if=/dev/sda (input disk) and of=/path/to/image.img (output image file), which is correct.

3. Final Answer:

   dd if=/dev/sda of=/path/to/image.img -> Option A

4. Quick Check:

   dd command = disk image creation [OK]

Hint: dd copies disk data exactly; remember if= input, of= output [OK]

Common Mistakes:

• Using rm which deletes data
• Using ls which lists files
• Using chmod which changes permissions

3. Given the following Python snippet analyzing a disk image file:

with open('disk.img', 'rb') as f:
    data = f.read(512)
print(len(data))

What will be the output?

medium

A. 512

B. 0

C. An error because 'rb' mode is invalid

D. The entire disk image size

Solution

1. Step 1: Understand file reading mode

   Opening with 'rb' means read binary mode, which allows reading raw bytes from the file.

2. Step 2: Read 512 bytes and check length

   The code reads 512 bytes from the start of the file, so len(data) will be 512 if the file is at least that big.

3. Final Answer:

   512 -> Option A

4. Quick Check:

   Read 512 bytes = length 512 [OK]

Hint: Read bytes length matches requested size if file is large enough [OK]

Common Mistakes:

• Thinking 'rb' is invalid mode
• Assuming entire file is read
• Expecting zero length if file exists

4. A forensic analyst tries to create a disk image using the command:
dd if=/dev/sda of=/mnt/usb/image.img bs=4M
but gets a permission denied error. What is the most likely cause?

medium

A. The output file path is incorrect

B. The USB drive is full

C. The block size (bs) is too large

D. The user lacks root or admin privileges to read /dev/sda

Solution

1. Step 1: Understand permission requirements

   Accessing raw disk devices like /dev/sda usually requires root or administrator rights.

2. Step 2: Analyze error cause

   A permission denied error typically means the user running the command does not have sufficient privileges to read the disk device.

3. Final Answer:

   The user lacks root or admin privileges to read /dev/sda -> Option D

4. Quick Check:

   Permission denied = insufficient privileges [OK]

Hint: Raw disk access needs admin rights, else permission denied [OK]

Common Mistakes:

• Blaming wrong output path without checking permissions
• Assuming block size causes permission errors
• Ignoring user privilege requirements

5. During disk image analysis, an investigator wants to find all JPEG files inside the image without altering it. Which approach is best?

hard

A. Edit the disk image to add file extensions for easier search

B. Delete non-JPEG files from the disk image to reduce size

C. Mount the disk image read-only and search for files by signature

D. Convert the disk image to a compressed archive before searching

Solution

1. Step 1: Preserve original disk image integrity

   Investigators must not alter the disk image to keep evidence valid, so read-only access is essential.

2. Step 2: Search by file signature

   JPEG files have unique headers (signatures) that can be searched inside the mounted image without changing it.

3. Final Answer:

   Mount the disk image read-only and search for files by signature -> Option C

4. Quick Check:

   Read-only mount + signature search = safe analysis [OK]

Hint: Always analyze disk images read-only to avoid evidence tampering [OK]

Common Mistakes:

• Editing image files which corrupts evidence
• Deleting files from image mistakenly
• Compressing image before analysis changes data