Title: Forensics Lab: E-Mails
Course: CAP 2141 Digital Forensics II

Overview

E-mail evidence can provide significant information involving computer related crimes. FTK Imager can be used to determine whether potential email evidence exists on the user’s computer before the investigator commits time to a detailed investigation. In this lab, you will perform an initial examination of a computer hard disk image to determine whether email evidence may be present. In this lab identify email account structures and export a Microsoft Outlook .pst file. We will also identify Microsoft Outlook backup files, and view a Microsoft Outlook .pst file in FTK. FTK provides extensive searching and sorting features useful to forensics investigators looking for potential evidence in local computers accessing client-based or Internet based e-mail services. In this lab, you will add an email image file to FTK and recognize Hotmail email folder structures.

Complete ONE of the following labs located at the end of Chapter 12 in the lab manual:

- 12.1 Using Forensic Toolkit Imager to Search for Preliminary E-mail Evidence
- 12.2 Examining Exported Outlook E-mail Accounts
- 12.3 Examining Hotmail Evidence

Be sure to carefully follow the directions for the project and include the full name and description of the project in your submission so that your instructor knows which project you chose.

Submission: To submit your file, choose the link above. Use the "Browse My Computer" button in the Attach File area to attach your document. Be sure to complete your submission by choosing the "Submit" button at the bottom of the screen. Make sure that you follow the due dates in the course calendar.

This lab will be graded using the Lab Assignment Rubric. Please use it as a guide toward successful completion of this lab.