Title: Forensics Lab: Validation
Course: CAP 2141 Digital Forensics II

Overview

Forensics investigators often involve recovering data from hidden or deliberately modified disk partitions where the criminal might store potential evidence. FTK imager can view Windows, Macintosh, and Linux file partitions and perform preliminary searches for files. In this lab we will search for hidden partitions, and looking for evidence in hidden partitions.

Complete ONE of the following labs located at the end of Chapter 9 in the lab manual:

- 9.1 Searching for Hidden Partitions
- 9.2 Looking for Evidence in Hidden Partitions
- 9.3 Examining the Original Evidence with Forensic Toolkit

Be sure to carefully follow the directions for the project and include the full name and description of the project in your submission so that your instructor knows which project you chose.

Submission: To submit your file, choose the link above. Use the "Browse My Computer" button in the Attach File area to attach your document. Be sure to complete your submission by choosing the "Submit" button at the bottom of the screen. Make sure that you follow the due dates in the course calendar.

This lab will be graded using the Lab Assignment Rubric. Please use it as a guide toward successful completion of this lab.