Title: Forensics Lab: Data
Course: CAP 2140 Digital Forensics > Section: Data Acquisition

Overview

During the process of seizing a storage device, investigators use imaging tools to create a forensic copy that can be safely analyzed without the danger of damaging or deleting potential evidence. In this lab we will add an image to ProDiscover and search for potential evidence and bookmark suspicious files and create a report in ProDiscover. In this lab we will add an image file to ProDiscover to view NTFS file system attributes. The FTK interface allows investigators to view the file system structure, and it uses built-in file type viewers to display each file in its native format without additional software. In this lab we will add an image file to FTK and analyze the imaged evidence. We will also see the FTK interface which provides a detailed listing in the Explore tab, and the structure will be similar to the results obtained in pervious lab. We will add an image to FTK and process the recovered digital evidence.

Complete ONE of the following labs located at the end of Chapter 4 in the lab manual:

- 4.1 Data Acquisition in ProDiscover
- 4.2 Viewing an NTFS Image in ProDiscover
- 4.3 Adding Forensic Evidence to Forensic Toolkit 1.81
- 4.4 Viewing an NTFS Image in Forensic Toolkit 1.81

Be sure to carefully follow the directions for the project and include the full name and description of the project in your submission so that your instructor knows which project you chose.

Submission: To submit your file, choose the link above. Use the "Browse My Computer" button in the Attach File area to attach your document. Be sure to complete your submission by choosing the "Submit" button at the bottom of the screen. Make sure that you follow the due dates in the course calendar.

This lab will be graded using the Lab Assignment Rubric. Please use it as a guide toward successful completion of this lab.