Playing online (Xbox Live)

For this experiment I will be playing 'Call of Duty 4: Modern Warfare 2'. A profile with an Xbox live Gold membership will be used, transferred via USB. The game will then be played online.

Activities;

• Transfer profile to Xbox console via USB.
• Start with USB account.
• Start the game straight from disk [1948].
• Accept any updates via Xbox live [1949].
• Begin online game play [1949].
• Stopped [2022].

Imaging started at home, imaging at home [2025].

MD5 HDD: 9fccbb0bea48e2dac983c54d9cacb0d7
MD5 Image:9fccbb0bea48e2dac983c54d9cacb0d7

Analysis of this image will be performed at a later stage.

Playing a game from the hard drive

For this experiment I will be playing a game that has been installed on the hard drive, multiple saves will be made (manual and automatic).

Activities;

• Install Mass Effect 2     
• Start with Acc2 profile  
• Start the game
• Select 'new game' then select 'male'.
• Accept defaults.
• Achievement gained (5g) [1651]
• Accept defaults (name, details, etc...).
• Select the hard drive as the storage device.
• Select 'Quick Start'.
• Save [1656].
• Autosave [1706].
• Autosave [1711].
• Achievement (10g) [1714].
• Save [1714].
• Autosave [1716].
• Autosave [1717].
• Autosave [1718]. 
• Autosave [1721].
• Autosave [1723].
• Autosave [1737].
• Save [1740].

Experiment performed at home; imaging at home.

MD5 HDD: 4D157A46641DB3BAE4DAE4DAE8E09165451A
MD5 Image: 4D157A46641DB3BAE4DAE4DAE8E09165451A

Analysis of this image will be performed at a later stage.

Playing a game from CD

For this experiment I will be playing a game from the CD and will make multiple saves(manually and automatically(auto saves)). The game I have used for this experiment is Mass Effect 2; it is one of the games I have that I know I can save manually. The time at which game saves are made and when achievement's are gained will be noted. Once this experiment is completed the hard drive will be imaged.

Activities;

• [Time set]*.
• Signed in with acc1.
• Insert game and play.
• Select 'new game' then select 'male'.
• Accept defaults.
• Achievement gained (5g) [1423]
• Accept defaults (name, details, etc...).
• Select the hard drive as the storage device.
• Select 'Quick Start'.
• Save [1428].
• Save [1445].
• Achievement (5g) [1446].
• Auto save [1447].
• Achievement (10g) [1449].
• Auto save [1453].
• Auto save [1500].
• Save [1500].

* Console has been taken home to continue experiments, power loss causes the time to be lost.

Experiment performed at home; imaging at home.

MD5 HDD: 480BCD0558AA3F0D5ED2D09B31CE946F
MD5 Image: 480BCD0558AA3F0D5ED2D09B31CE946F

Analysis of this image will be performed at a later stage. 

Creating a disk image using a write blocker and 'dd'

I do not have FTK imager at home but I can borrow a write blocker to aid me in imaging the hard drive. I have an installation of Linux (Ubuntu 10.04) with 'dd' installed and a Tableau t3u write blocker. Acqusition steps:

1. Remove hard drive from the Xbox 360 hard drive unit (see removal steps).
2. Connect the hard drive to the write blocker.
3. Open up the terminal in Ubuntu.
4. Next you must identify where the hard drive is located, I located the hard drive under /dev directory as sdc.
5. Next calculate the md5 of the hard disk:
1. md5sum /dev/sdc > XboxDiskName.md5
6. Next the drive is imaged, this was done by typing the following:
1. sudo dd if=/dev/sdc of=/media/externalHDD/XboxImageName.dd
7. To check is the image created is the same the hard disk the MD5 is calculated:
1. md5sum XboxImageName.dd > XboxImageName.md5
8. The md5's can be compared to see if they are identical.

Once these steps have been completed an image should be created of the Xbox disk that is a duplicate of the data stored on the actual hard drive.