Playing online (Xbox Live)

For this experiment I will be playing 'Call of Duty 4: Modern Warfare 2'. A profile with an Xbox live Gold membership will be used, transferred via USB. The game will then be played online.

Activities;

• Transfer profile to Xbox console via USB.
• Start with USB account.
• Start the game straight from disk [1948].
• Accept any updates via Xbox live [1949].
• Begin online game play [1949].
• Stopped [2022].

Imaging started at home, imaging at home [2025].

MD5 HDD: 9fccbb0bea48e2dac983c54d9cacb0d7
MD5 Image:9fccbb0bea48e2dac983c54d9cacb0d7

Analysis of this image will be performed at a later stage.

Playing a game from the hard drive

For this experiment I will be playing a game that has been installed on the hard drive, multiple saves will be made (manual and automatic).

Activities;

• Install Mass Effect 2     
• Start with Acc2 profile  
• Start the game
• Select 'new game' then select 'male'.
• Accept defaults.
• Achievement gained (5g) [1651]
• Accept defaults (name, details, etc...).
• Select the hard drive as the storage device.
• Select 'Quick Start'.
• Save [1656].
• Autosave [1706].
• Autosave [1711].
• Achievement (10g) [1714].
• Save [1714].
• Autosave [1716].
• Autosave [1717].
• Autosave [1718]. 
• Autosave [1721].
• Autosave [1723].
• Autosave [1737].
• Save [1740].

Experiment performed at home; imaging at home.

MD5 HDD: 4D157A46641DB3BAE4DAE4DAE8E09165451A
MD5 Image: 4D157A46641DB3BAE4DAE4DAE8E09165451A

Analysis of this image will be performed at a later stage.

Playing a game from CD

For this experiment I will be playing a game from the CD and will make multiple saves(manually and automatically(auto saves)). The game I have used for this experiment is Mass Effect 2; it is one of the games I have that I know I can save manually. The time at which game saves are made and when achievement's are gained will be noted. Once this experiment is completed the hard drive will be imaged.

Activities;

• [Time set]*.
• Signed in with acc1.
• Insert game and play.
• Select 'new game' then select 'male'.
• Accept defaults.
• Achievement gained (5g) [1423]
• Accept defaults (name, details, etc...).
• Select the hard drive as the storage device.
• Select 'Quick Start'.
• Save [1428].
• Save [1445].
• Achievement (5g) [1446].
• Auto save [1447].
• Achievement (10g) [1449].
• Auto save [1453].
• Auto save [1500].
• Save [1500].

* Console has been taken home to continue experiments, power loss causes the time to be lost.

Experiment performed at home; imaging at home.

MD5 HDD: 480BCD0558AA3F0D5ED2D09B31CE946F
MD5 Image: 480BCD0558AA3F0D5ED2D09B31CE946F

Analysis of this image will be performed at a later stage. 

Creating user profiles

As the hard drive has been formatted there are no user profiles on that console. I will be creating 2 user profiles; acc1 and acc2. One of the accounts will be used to play a game that has been installed to the hard drive and the other will be used to play a game from CD. I will be looking at the game saves and if there is any difference between the saves when running the game from hard disk and CD.

To create a user profile go to My Xbox > Sign In > Create Profile. The accounts I have created are; acc1 and acc2 selecting any of the avatars created by default.

The console is switched off and the hard drive imaged, see Xbox 360 hard drive acquisition (a single dd image will be created).

FTK results:

Analysis of this image will be performed at a later stage.

Initial setup and formatting

Starting with an unused Xbox 360 (manufacture date: 17/11/2006 (DD/MM/YYYY)), set the console up with no internet connection, just attach the necessary cables to use offline (power and video).

Turn the console on and if this is the first time it has been turned on it will ask you to create a gamer profile, I created a gamer profile called acc1 leaving the gamer picture as default and then exiting the setup. Once you exit the setup you will be asked to update the console or you will not be able to use it; accept and install the updates. When the console restarts you will be asked to sign in, select the one just created, pick an avatar then save and exit.

Next set the date/time of the console to the correct time, go to My Xbox > System Settings > Console Settings > Clock > Date and Time.

Then format the hard drive ('My Xbox > System Settings > Memory' press 'y' and select 'format); this will remove the profile you just created and anything else on the drive like videos and demo's. This will give me a fresh drive with nothing but the basic items the Xbox 360 places on it. Turn off the console and image the drive see Xbox 360 hard drive acquisition (a single dd image will be created).

FTK imager results:

Analysis of this image will be performed at a later stage.

Project shift of focus

In order for my final year project to be viable I will be focusing more on how the Xbox 360 file system works and looking at Xbox 360 specific artefacts that are created through the use of an unmodified Xbox 360.

The information gathered from this will allow me to build a list of artefacts that could be considered known; for example this could be default installation files or system updates. By creating a list of known files it would cut the number of files needed to be searched; reducing time and money spent trying to obtain evidence.

I will be creating a comprehensive user manual for investigators that are performing an Xbox 360 investigation.

I may also look for artefacts left from other applications that run on the Xbox 360 console mentioned in the previous post.

This is a brief description I am yet to perform a MoSCoW (Must have, Should have, Could have, Won't have but would like in the future) analysis for my project.

Creating and gathering artefacts

I will be carrying out a number of experiments to determine if artefacts are created by carrying out certain actions on the Xbox 360; if artefacts are created I intend to locate the artefacts and find out what they mean.

What may generate artefacts?

1. Use of Facebook
2. Use of Twitter
3. Use of Windows messenger
4. Using Xbox live
5. Using Windows media center
6. Logging into console/signing in
7. Playing on games; game saves

I will need to acquire an image of the Xbox 360 hard drive after performing an action on the console that I suspect will create artefacts. So I need a way to take an image of the Xbox hard drive; I will also need to identify a forensically sound method of doing this.

I will also see what artefacts are created on USB drives used on the Xbox 360. I will see if by removing the hard drive the USB drive is used as an alternative; causing artefacts to be created on the device. The USB drive will also be used in conjunction with the hard drive. As with the hard drive I will need a way to image the USB drive in a forensically sound manner.

A network/packet sniffer could be used to monitor the packets sent to and from the console when performing certain experiments. Information may be able to be gathered from analysing the packets; if a network was under surveillance this information could help to determine that a console is being used and the actions being performed on the console.

The Xbox 360 can communicate with other PC's on the network, this means artefacts could be left on the computer that is communicating with the console (for example by using windows media center). The computers hard drive can be imaged and searched for artefacts.