Task 1: Disk Forensics Dead Endpoint
STRANGE & UNUSUAL ACTIVITY // FORENSICS
Dead Endpoint
HARD
An internal photo gallery has stopped working, and its images are unreadable. Examine the preserved Linux disk, trace the compromise, and find a way to recover the affected files.
LINUX FORENSICS MALWARE ANALYSIS DATA RECOVERY
+ INCIDENT BRIEF
STATUS: ACTIVE
01 // MISSION
Staff arrived to find their internal photo gallery unusable and its images unreadable. The Linux server’s disk has been preserved, but the cause is still unclear. Reconstruct how the application was compromised, analyze the executable left behind, and find a way to recover the affected images.
EVIDENCE PROVIDED
+ Linux Disk Image (.img)
02 // OBJECTIVES
01. Establish how the gallery application was compromised.
02. Identify the executable responsible for the affected images.
03. Analyze its behavior and determine how the files were encrypted.
04. Recover the images and retrieve the inspection checklist.
ANALYST NOTE
Examine the disk without modifying it and analyze the executable without running it. Correlate the application records, system logs, and recovered files to support your conclusions.
ANALYST WORKSPACE
Evidence:
~/Desktop/artifacts/Additional tools:
~/Desktop/artifacts/tools/Python 3’s
cryptography library is installed for offline cryptographic analysis.GALLERY_SERVICE_INCIDENT // CASE FILE OPEN
DEAD_ENDPOINT // FORENSICS // MALWARE_ANALYSIS
Answer the questions below
Which application endpoint was abused to execute commands on the server?
What was the full path of the executable responsible for encrypting the images?
What is the SHA-256 hash of that executable?
Which encryption algorithm and mode protected the images?
What initial seed value was used to generate the encryption key?
What flag appears in the recovered inspection checklist?