Title: Forensics Lab: Images
Course: CAP 2140 Digital Forensics > Section: Understanding Computer Investigations

Overview

There are instances when data must be securely deleted from a storage device to prevent the recovery of sensitive or secret files. In many cases, deleted files may not be overwritten immediately, and forensic software can be used to recover the file remnants and reconstruct the original file. This is known as data carving. In this lab we will securely wipe a storage device, and learn the purpose of data carving. When computers are seized during a forensic investigation, the first process of extracting information involves the use of disk imaging to perform a bit-stream duplication of the original storage device. By using ProDiscover we will perform a bit-stream image of USB or similar storage devices. We will use ProDiscover to perform an .eve to .dd format image conversion. In this lab we also use FTK Imager, which creates bit-stream images in Raw .dd, Smart, and their proprietary E01 formats. We will perform an FTK imager duplication of a USB storage device. Lastly in this lab we will use FTK Imager, which provides a few cursory tools that are useful for forensic analysis of disk images. We will learn how to add images to FTK Imager for preliminary analysis and locate deleted files and export them for further analysis.

Complete ONE of the following labs located at the end of Chapter 2 in the lab manual:

- 2.1 Securely Wiping a USB Storage Device
- 2.2 Using ProDiscoer to Image a USB Flash Drive
- 2.3 Convert ProDiscover Image to .dd Image
- 2.4 Imaging Evidence Using FTK Imager
- 2.5 Viewing Images in FTK Imager

Be sure to carefully follow the directions for the project and include the full name and description of the project in your submission so that your instructor knows which project you chose.

Submission: To submit your file, choose the link above. Use the "Browse My Computer" button in the Attach File area to attach your document. Be sure to complete your submission by choosing the "Submit" button at the bottom of the screen. Make sure that you follow the due dates in the course calendar.

This lab will be graded using the Lab Assignment Rubric. Please use it as a guide toward successful completion of this lab.