UPDATING

I really haven't been updating much at all, project has been finished; experiments, results  and findings will posted up shortly.

*Experiments carried out maybe backdated. All posts after playing game from hard drive are updates.*

Playing online (Xbox Live)

For this experiment I will be playing 'Call of Duty 4: Modern Warfare 2'. A profile with an Xbox live Gold membership will be used, transferred via USB. The game will then be played online.

Activities;

• Transfer profile to Xbox console via USB.
• Start with USB account.
• Start the game straight from disk [1948].
• Accept any updates via Xbox live [1949].
• Begin online game play [1949].
• Stopped [2022].

Imaging started at home, imaging at home [2025].

MD5 HDD: 9fccbb0bea48e2dac983c54d9cacb0d7
MD5 Image:9fccbb0bea48e2dac983c54d9cacb0d7

Analysis of this image will be performed at a later stage.

Playing a game from the hard drive

For this experiment I will be playing a game that has been installed on the hard drive, multiple saves will be made (manual and automatic).

Activities;

• Install Mass Effect 2     
• Start with Acc2 profile  
• Start the game
• Select 'new game' then select 'male'.
• Accept defaults.
• Achievement gained (5g) [1651]
• Accept defaults (name, details, etc...).
• Select the hard drive as the storage device.
• Select 'Quick Start'.
• Save [1656].
• Autosave [1706].
• Autosave [1711].
• Achievement (10g) [1714].
• Save [1714].
• Autosave [1716].
• Autosave [1717].
• Autosave [1718]. 
• Autosave [1721].
• Autosave [1723].
• Autosave [1737].
• Save [1740].

Experiment performed at home; imaging at home.

MD5 HDD: 4D157A46641DB3BAE4DAE4DAE8E09165451A
MD5 Image: 4D157A46641DB3BAE4DAE4DAE8E09165451A

Analysis of this image will be performed at a later stage.

Playing a game from CD

For this experiment I will be playing a game from the CD and will make multiple saves(manually and automatically(auto saves)). The game I have used for this experiment is Mass Effect 2; it is one of the games I have that I know I can save manually. The time at which game saves are made and when achievement's are gained will be noted. Once this experiment is completed the hard drive will be imaged.

Activities;

• [Time set]*.
• Signed in with acc1.
• Insert game and play.
• Select 'new game' then select 'male'.
• Accept defaults.
• Achievement gained (5g) [1423]
• Accept defaults (name, details, etc...).
• Select the hard drive as the storage device.
• Select 'Quick Start'.
• Save [1428].
• Save [1445].
• Achievement (5g) [1446].
• Auto save [1447].
• Achievement (10g) [1449].
• Auto save [1453].
• Auto save [1500].
• Save [1500].

* Console has been taken home to continue experiments, power loss causes the time to be lost.

Experiment performed at home; imaging at home.

MD5 HDD: 480BCD0558AA3F0D5ED2D09B31CE946F
MD5 Image: 480BCD0558AA3F0D5ED2D09B31CE946F

Analysis of this image will be performed at a later stage. 

Creating a disk image using a write blocker and 'dd'

I do not have FTK imager at home but I can borrow a write blocker to aid me in imaging the hard drive. I have an installation of Linux (Ubuntu 10.04) with 'dd' installed and a Tableau t3u write blocker. Acqusition steps:

1. Remove hard drive from the Xbox 360 hard drive unit (see removal steps).
2. Connect the hard drive to the write blocker.
3. Open up the terminal in Ubuntu.
4. Next you must identify where the hard drive is located, I located the hard drive under /dev directory as sdc.
5. Next calculate the md5 of the hard disk:
1. md5sum /dev/sdc > XboxDiskName.md5
6. Next the drive is imaged, this was done by typing the following:
1. sudo dd if=/dev/sdc of=/media/externalHDD/XboxImageName.dd
7. To check is the image created is the same the hard disk the MD5 is calculated:
1. md5sum XboxImageName.dd > XboxImageName.md5
8. The md5's can be compared to see if they are identical.

Once these steps have been completed an image should be created of the Xbox disk that is a duplicate of the data stored on the actual hard drive.

Creating user profiles

As the hard drive has been formatted there are no user profiles on that console. I will be creating 2 user profiles; acc1 and acc2. One of the accounts will be used to play a game that has been installed to the hard drive and the other will be used to play a game from CD. I will be looking at the game saves and if there is any difference between the saves when running the game from hard disk and CD.

To create a user profile go to My Xbox > Sign In > Create Profile. The accounts I have created are; acc1 and acc2 selecting any of the avatars created by default.

The console is switched off and the hard drive imaged, see Xbox 360 hard drive acquisition (a single dd image will be created).

FTK results:

Analysis of this image will be performed at a later stage.

Initial setup and formatting

Starting with an unused Xbox 360 (manufacture date: 17/11/2006 (DD/MM/YYYY)), set the console up with no internet connection, just attach the necessary cables to use offline (power and video).

Turn the console on and if this is the first time it has been turned on it will ask you to create a gamer profile, I created a gamer profile called acc1 leaving the gamer picture as default and then exiting the setup. Once you exit the setup you will be asked to update the console or you will not be able to use it; accept and install the updates. When the console restarts you will be asked to sign in, select the one just created, pick an avatar then save and exit.

Next set the date/time of the console to the correct time, go to My Xbox > System Settings > Console Settings > Clock > Date and Time.

Then format the hard drive ('My Xbox > System Settings > Memory' press 'y' and select 'format); this will remove the profile you just created and anything else on the drive like videos and demo's. This will give me a fresh drive with nothing but the basic items the Xbox 360 places on it. Turn off the console and image the drive see Xbox 360 hard drive acquisition (a single dd image will be created).

FTK imager results:

Analysis of this image will be performed at a later stage.