Title: Forensics Lab: Processing
Course: CAP 2140 Digital Forensics > Section: Processing Crime and Incident Scenes

Overview

When forensic investigators process evidence during an investigation involving computer related crimes, they often need to create a bit stream copy of the original evidence and analyze the forensically imaged copy. We will learn how to search for evidence by using FTK and locate the hash files and file header information in MS Office documents. In this lab you will examine the email records discovered and identify the location of MS Outlook mailboxes and file header information contained in an email messages. In this lab we also perform keyword searches and refine a keyword search to find specific information. At the end of the lab we will create a final report which includes bookmarks of evidence located and the scientific results obtained during he forensic investigation.

Complete ONE of the following lab located at the end of Chapter 5 in the lab manual:

- 5.1 Searching for Evidence in Forensic Toolkit
- 5.2 Searching for E-mail Evidence Using Forensic Toolkit
- 5.3 Searching for Keywords in Forensic Toolkit
- 5.4 Creating a Final Report

Be sure to carefully follow the directions for the project and include the full name and description of the project in your submission so that your instructor knows which project you chose.

Submission: To submit your file, choose the link above. Use the "Browse My Computer" button in the Attach File area to attach your document. Be sure to complete your submission by choosing the "Submit" button at the bottom of the screen. Make sure that you follow the due dates in the course calendar.

This lab will be graded using the Lab Assignment Rubric. Please use it as a guide toward successful completion of this lab.