• theRhino hunt scenarioand
• theSANS SIFT image

Steps:

Step 1:DownloadSIFT Workstation

Step 2: Import SIFT Workstation to VMware and open it.

Step 3: Login to SIFT Workstation

Step 4:Download theSANS Rhino hunt

Step 5: Unzip the Rhino hunt

Step 6:Use SIFT to find the rhino pictures.

Step 7: Create a directory for the output:

Step 8: Run foremost against the RHINOUSB image.

Step 9: Review the output.