M57-Patents Scenario

February 22nd, 2011 Leave a comment Go to comments

2009-M57-Patents

The 2009-M57-Patents scenario tracks the first four weeks of corporate history of the M57 Patents company. The company started operation on Friday, November 13th, 2009, and ceased operation on Saturday, December 12, 2009. As might be imagined in the business of outsourced patent searching, lots of other activities were going on at M57-Patents.

Two ways of working the scenario are as a disk forensics exercise (students are provided with disk images of all the systems as they were on the last day) and as a network forensics exercise (students are provided with all of the packets in and out of the corporate network). The scenario data can also be used to support computer forensics research, as the hard drive of each computer and each computer’s memory were imaged every day.

The full corpus is large (close to 460GB). To facilitate download and sharing of the data we provide BitTorrent files containing different portions of the corpus. If you have limited storage but want the entire corpus, pull down the “All Materials” torrent. You can recreate all other views into the data from the resulting files using the manifests for the other torrents. There are two versions of torrents which contain disk images. The torrents which end in “-E01″ have EnCase formatted disk images. The others use the Advanced Forensic Format (from which RAW images can be extracted using tools available at http://www.afflib.org/).

In a hurry? If you just want to work with the main exercises, the “Police Evidence” torrents contain only data that would be captured by an incident response team (and correspond to the final day of the scenario). These, along with the detective reports, warrant and affidavit, exercises (outlined in the slides blow), and instructor packet contain everything you will need.

The torrents can be found here:

We have prepared a variety of supporting materials for this scenario, including sample exercises, instructor slides, simulated detective reports and associated warrant, and encrypted scenario guides, hash tables, and answer keys for instructors (email Simson Garfinkel or Kam Woods for the passphrase).

Instructor Materials and Answer Keys (encrypted):

Exercise slides:

Detective reports, warrant and affidavit:

Individual items from the corpus organized by calendar date as they were produced during the scenario can also be found here:

Notes:

  1. Friday, 13 November has no images, because the scenario did not officially start until the following Monday (16 November). Your data may contain drive images from Thursday, 12 November. These are for reference (e.g. prior to any employee activity).
  2. Friday, 20 December has images for two separate drives for Jo and Terry. See the scenario information for that date. The “Police Evidence” torrents contain only the second drive image.
  1. Blue.D
    March 2nd, 2011 at 18:11 | #1
    Reply | Quote

    Hi, could you tell me the physical link speed of the network pcap files you shared? especially in day11-14.dmp.zip? Thank you!

  2. admin
    January 28th, 2012 at 13:25 | #2
    Reply | Quote

    I believe it was 1gbit/sec. Why?

  1. January 27th, 2012 at 19:03 | #1
    test aja : time to secure

 
"This material is based upon work supported by the National Science Foundation under Grant No. 0919593. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation."