Title: Forensics Lab: Tools
Course: CAP 2140 Digital Forensics > Section: Current Computer Forensics Tools

Overview

In this lab FTK Imager is typically used to create forensic copies of storage devices containing digital evidence. In this lab, you will add the image files of a seized hard drive that may contain evidence of a recent bank robbery involving safe deposit boxes and look for potential evidence that can be exported for further analysis. In this lab we also import the exported files and look at each file to see whether it contains potential evidence. Forensics Investigators are expected to prepare a report for court cases. The report also serves to document all the scientific methods used by the forensics investigator using the software tools. During the testimony, the investigator can refer back to the report to justify methods used in obtaining results. In this lab we will use single and compound terms to search for potential evidence in the image file and create detailed reports highlighting the methods used along with the investigatory results.

Complete ONE of the following labs located at the end of Chapter 7 in the lab manual:

- 7.1 Using FTK Imager to Analyze an Image
- 7.2 Using the Forensic Toolkit to View Exported Evidence
- 7.3 Advanced File Searching and Reporting

Be sure to carefully follow the directions for the project and include the full name and description of the project in your submission so that your instructor knows which project you chose.

Submission: To submit your file, choose the link above. Use the "Browse My Computer" button in the Attach File area to attach your document. Be sure to complete your submission by choosing the "Submit" button at the bottom of the screen. Make sure that you follow the due dates in the course calendar.

This lab will be graded using the Lab Assignment Rubric. Please use it as a guide toward successful completion of this lab.