Title: Forensics Lab: Graphics
Course: CAP 2141 Digital Forensics II > Section: Module 2 Recovering Graphic Files

Overview

In this lab you will examine the evidence using Windows Explorer to see why the investigator became suspicious and decided to process this evidence. After the initial inspection of the USB evidence at the crime scene, an image of the drive must be created and processed by FTK to recover any additional evidence. Forensic evidence is often hidden by criminals using various methods on deliberately corrupted or modified partitions to make it invisible to all but the creator of the file. In this lab, you will apply the data-carving feature to rebuild files that have been deliberately altered. We will add data carving to repair damaged file attributes and recover data lost in hidden files.

Complete ONE of the following lab located at the end of Chapter 10 in the lab manual:

- 10.1 Viewing Evidence at the Crime Scene
- 10.2 Processing Evidence Containing Graphics Images
- 10.3 Locating Graphics in Unreadable Partitions

Be sure to carefully follow the directions for the project and include the full name and description of the project in your submission so that your instructor knows which project you chose.

Submission: To submit your file, choose the link above. Use the "Browse My Computer" button in the Attach File area to attach your document. Be sure to complete your submission by choosing the "Submit" button at the bottom of the screen. Make sure that you follow the due dates in the course calendar.

This lab will be graded using the Lab Assignment Rubric. Please use it as a guide toward successful completion of this lab.