Title: Forensics Lab: Investigations
Course: CAP 2141 Digital Forensics II

Overview

In this lab, you will add the Firestarter hard disk image to FTK Imager and export file names, directory lists, and hash signatures to document the recovered evidence and we will use FTK Imager to look for forensic evidence, export files, folders, and hash signature information. ProDiscover provides basic report tools that are useful to forensics investigators performing an initial search of recovered evidence. In this lab, you will add the Firestarter.dd image to ProDiscover and use the reporting tools to document the evidence. FTK also provides detailed search and reporting tools. In this lab, you will add the Firestarter.dd image to FTK to search for additional evidence to build your case thad summarize your findings in the case report.

Complete ONE of the following labs located at the end of Chapter 14 in the lab manual:

- 14.1 Using FTK Imager to Document Case Evidence
- 14.2 Using ProDiscover to Create a Report
- 14.3 Using the Forensic Toolkit to Create a Report

Be sure to carefully follow the directions for the project and include the full name and description of the project in your submission so that your instructor knows which project you chose.

Submission: To submit your file, choose the link above. Use the "Browse My Computer" button in the Attach File area to attach your document. Be sure to complete your submission by choosing the "Submit" button at the bottom of the screen. Make sure that you follow the due dates in the course calendar.

This lab will be graded using the Lab Assignment Rubric. Please use it as a guide toward successful completion of this lab.