Title: Forensics Lab: Laboratory
Course: CAP 2140 Digital Forensics > Section: The Investigator’s Office and Laboratory

Overview

Computer forensics investigators must be familiar with many types of operating system file structures to enable them to search for potential evidence in current and deleted files and folders. In this lab we will examine a FAT16 .dd image using the FTK imager, and search for existing deleted files and recover the associated file signatures. We will examine the other file systems FAT32, NTFS, and HFS by using FTK Imager.

Complete ONE of the following labs located at the end of Chapter 3 in the lab manual:

- 3.1 Processing a FAT16 Forensic Image
- 3.2 Processing a FAT32 Forensic Image
- 3.3 Processing an NTFS Forensic Image
- 3.4 Processing an HFS Forensic Image

Be sure to carefully follow the directions for the project and include the full name and description of the project in your submission so that your instructor knows which project you chose.

Submission: To submit your file, choose the link above. Use the "Browse My Computer" button in the Attach File area to attach your document. Be sure to complete your submission by choosing the "Submit" button at the bottom of the screen. Make sure that you follow the due dates in the course calendar.

This lab will be graded using the Lab Assignment Rubric. Please use it as a guide toward successful completion of this lab.