Title: Forensics Final Lab: Alternates
Course: CAP 2140 Digital Forensics > Section: Macintosh and Linux Boot Processes and File Systems

In this lab, you will extract the OS X and OS 9 image files from the lab book compressed files and export the useful user information to be added to the FTK for evidentiary processing. Also in this lab we will look at Linux Image files with using FTK Imager and the FTK to process a Linux image. Create a situation in which you would have to get a hard drive image to resolve a situation of your choice. Use all prior resources to create a robust and believable situation. Write it down, and include one of the labs below.

Complete ONE of the following labs located at the end of Chapter 8 in the lab manual:

- 8.1 Using Forensic Tools to Examine an OS X Macintosh Image
- 8.2 Using Forensic Tools to Examine an OS 9 Macintosh Image
- 8.3 Using FTK Imager and the Forensic Toolkit to Process a Linux Image

Be sure to carefully follow the directions for the project and include the full name and description of the project in your submission so that your instructor knows which project you chose.

Remember that this lab has two components, a situation and a lab. Your instructor will have more information available on this lab.

Submission: To submit your file, choose the link above. Use the "Browse My Computer" button in the Attach File area to attach your document. Be sure to complete your submission by choosing the "Submit" button at the bottom of the screen. Make sure that you follow the due dates in the course calendar.

This will be considered as a hands-on lab and is graded differently. This lab will be graded using the Forensics Project Rubric. Please use it as a guide toward successful completion of this lab.