Title: Forensics Lab: Acquisitions
Course: CAP 2141 Digital Forensics II

Overview

FTK Imager is also available in a portable version that will fit on a small USB storage device, and it can be used to acquire the contents of virtual memory and the Windows registry. In this lab we will create a portable forensic recovery tool and perform a live acquisition of the Windows registry. In this lab we will also process a virtual memory capture performed on a live computer. The information in the Windows registry can also reveal details regarding using the Registry Viewer we installed in Chapter 1. We will use registry viewing forensic tool and search for user account information.

Complete ONE of the following labs located at the end of Chapter 11 in the lab manual:

- 11.1 Using a Live Acquisition tool to Capture Evidence
- 11.2 Analyzing Virtual Memory Using Forensic Toolkit
- 11.3 Analyzing Windows Registry

Be sure to carefully follow the directions for the project and include the full name and description of the project in your submission so that your instructor knows which project you chose.

Submission: To submit your file, choose the link above. Use the "Browse My Computer" button in the Attach File area to attach your document. Be sure to complete your submission by choosing the "Submit" button at the bottom of the screen. Make sure that you follow the due dates in the course calendar.

This lab will be graded using the Lab Assignment Rubric. Please use it as a guide toward successful completion of this lab.