Running head: FTK IMAGER 1
|
|
- Johnathan Blake
- 6 years ago
- Views:
Transcription
1 Running head: FTK IMAGER 1 FTK Imager Jean-Raymond Ducasse CSOL-590 June 26, 2017 Thomas Plunkett
2 FTK IMAGER 2 FTK Imager Outline Process for Adding Individual Files & Folders as Evidence Items Although FTK Imager allows different source options for adding individual files and folders as evidence items including physical, logical, image and contents of a folder; for purposes of this lab the recommended practice will be to create an image. This is because images contain every bit of data from the source disk and a copy operation will only retrieve currently accessible files. An image is a static snapshot that can be analyzed and used as evidence in a courtroom, while still preserving the original source disk. It contains current files in addition to slack space and unallocated space, which may include deleted files and hidden data (Vandeven, n.d.). If you want to image a USB Flash drive for example, ensure you have a write blocker to avoid inadvertently writing anything to the source drive. From there, open up FTK Imager, go to file, and select create disk image.
3 FTK IMAGER 3 Select physical drive as the source and the USB device from the drop down. The two most widely used imaging formats is the EnCase evidence file format (E01) and the RAW image format, so for the purposes of this lab select E01 and next. Enter the evidence item information, the new image name, select the destination folder and finish.
4 FTK IMAGER 4 Once the image has been created, you can now view the contents and add individual files and folders as evidence items by going to file, add evidence item and browse to select the USB image file that was created.
5 FTK IMAGER 5 From there you can right click on files and folders and either export a copy to review with native software or add to custom content image to begin compiling a list of files to put into an image, allowing you to selectively include specific files instead of all of the files from the device into the image file you create.
6 FTK IMAGER 6 Explain Differences Between Hexadecimal & Text View Computers store text as numbers and with hex view you display the numbers not as a decimal number, but in base 16. Hex or base 16 or hexadecimal is a numeral system that uses 16 symbols. The symbols include 0-9 and a-f (sometimes A-F). While computers work with binary data, it can be difficult for humans to work with a large number of digits. Humans typically use a base 10 system, while for computer applications it is easier to work with hexadecimal than decimal. As hex saves space (either paper space or screen space), you can more efficiently use hex instead of a large number of ones and zeros. Hex numbers represent large numbers compactly and are used in programming since computers use bytes as a unit of information. In hex you need two digits, whereas you need 8 binary digits to represent a byte ("About Convert Hexadecimal to Text Tool", 2017). Text mode allows you to preview a file s contents as ASCII or Unicode characters, even if the file is not a text file. This mode can be useful for viewing text and binary data that is not visible when a file is viewed in its native application. Hex mode allows you to view every byte of data in a file as hexadecimal code. You can use the Hex Value Interpreter in FTK Imager to interpret hexadecimal values as decimal integers and possible time and date values. Preview modes apply only when displaying file data. The data contained in folders or other non-file objects is always displayed in hexadecimal format ("Accessdata Ftk Imager", n.d.
7 FTK IMAGER 7 Strengths of FTK Imager FTK Imager is a data preview and imaging tool that lets you quickly assess electronic evidence and create forensic images of computer data without making changes to the original evidence. Some of the strengths of FTK Imager include: Creation and preview of forensic images of hard drives, floppy diskettes, Zip disks, CDs, and DVDs, entire folders, or individual files from various places within the media. Mount an image for a read-only view that leverages Windows Explorer to see the content of the image exactly as the user saw it on the original drive. Export files and folders from forensic images. See and recover files deleted from the Recycle Bin, but have not yet been overwritten on the drive. Create Message Digest 5 (MD5) and Secure Hash Algorithm (SHA-1) hash files. Generate hash reports for regular files and disk images you can later use as a benchmark to prove the integrity of your case evidence. When a full drive is imaged, a hash generated by FTK Imager can be used to verify that the image hash and the drive hash match after the image is created, and that the image has remained unchanged since acquisition ("About Ftk Imager", n.d.).
8 FTK IMAGER 8 Weaknesses of FTK Imager To be honest, as compared to its competition; there was very little if any, I could determine as a weakness for FTK Imager. Each time I researched the disadvantages of FTK Imager, it implied weaknesses such as lack of an image mount, a 2 million file limit, the inability to open cases if the drive letter changed, no scripting support, Photoshop (PSD) and AVI support (McAnn, 2017). However, those constraints were in previous versions of FTK Imager, and since then the latest version has resolved those limitations. About the only real disadvantage was I could find was that FTK Imager and FTK Imager CLI is unable to generate output formats Ex01, which can be compressed using the bzip algorithm and encrypted using the AES-256 encryption cipher, whereas the competition EnCase and SAN SIFT s Workstation ewfacqure can (Vandeven, n.d.).
9 FTK IMAGER 9 Zimmerman Telegram JPG Hex Code Below is the Zimmerman Telegram JPG displayed as hex code FF D8 FF ("Jpg Signature Format: Documentation & Recovery Example", 2017)..
10 FTK IMAGER 10 References Vandeven, S. (n.d.). Forensic Images: For Your Viewing Pleasure. Retrieved from About Convert Hexadecimal to Text Tool. (2017). Retrieved from AccessData FTK Imager. (n.d.). Retrieved from About FTK Imager. (n.d.). Retrieved from McAnn, J. (2017). The Real World Forensics. Retrieved from JPG Signature Format: Documentation & Recovery Example. (2017). Retrieved from
Ed Ferrara, MSIA, CISSP
MIS 5208 - Lecture 12 Investigation Methods Data Acquisition Ed Ferrara, MSIA, CISSP eferrara@temple.edu Objectives List digital evidence storage formats Explain ways to determine the best acquisition
More informationAccessData Imager Release Notes
AccessData Imager 4.2.0 Document Date: 11/21/2017 2017 AccessData Group, Inc. All rights reserved. This document lists the changes in this release of AccessData Imager. All known issues published with
More informationAccessData Imager Release Notes
AccessData Imager 4.1.1 Release Notes Document Date: 7/19/2017 2017 AccessData Group, Inc. All rights reserved. Introduction This document lists the changes in this release of AccessData Imager. All known
More informationAccessData Imager Release Notes
AccessData Imager 3.4.2 Document Date: 3/29/2016 2015 AccessData Group, Inc. All rights reserved. This document lists the changes in this release of AccessData Imager. All known issues published with previous
More informationAccessData FTK Imager
AccessData FTK Imager LEGAL INFORMATION AccessData Corp. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied
More informationFTK Imager 2.9 Release Notes
FTK Imager 2.9 Release Notes These release notes apply to AccessData FTK Imager 2.9 IMPORTANT INFORMATION If the machine running imager has an active internet connection and you are viewing HTML from the
More informationChapter Two File Systems. CIS 4000 Intro. to Forensic Computing David McDonald, Ph.D.
Chapter Two File Systems CIS 4000 Intro. to Forensic Computing David McDonald, Ph.D. 1 Learning Objectives At the end of this section, you will be able to: Explain the purpose and structure of file systems
More informationAccessData Imager Release Notes
AccessData Imager 3.3.0 Document Date: 12/08/2014 2014 AccessData Group, Inc. All rights reserved. This document lists the changes in AccessData Imager 3.3.0. All known issues published with previous release
More informationAccessData Imager Release Notes
AccessData Imager 3.4.0.5 Document Date: 10/27/2015 2015 AccessData Group, Inc. All rights reserved. This document lists the changes in the verion of AccessData Imager. All known issues published with
More informationAccessData Legal and Contact Information
Imager User Guide 1 AccessData Legal and Contact Information Document date: March 31, 2016 Legal Information 2016 AccessData Group, Inc. All rights reserved. No part of this publication may be reproduced,
More informationAccessData Advanced Forensics
This advanced five-day course provides the knowledge and skills necessary to install, configure and effectively use Forensic Toolkit (FTK ), FTK Imager Password Recovery Toolkit (PRTK ) and Registry Viewer.
More informationAccessData Imager Release Notes
AccessData Imager 3.4.0 Document Date: 4/08/2015 2015 AccessData Group, Inc. All rights reserved. This document lists the changes in AccessData Imager 3.4.0. All known issues published with previous release
More informationAccessData Imager Release Notes
AccessData Imager 3.4.3 Release Notes Document Date: 11/4/2016 2016 AccessData Group, Inc. All rights reserved. Introduction This document lists the changes in this release of AccessData Imager. All known
More informationCSN08101 Digital Forensics. Module Leader: Dr Gordon Russell Lecturers: Robert Ludwiniak
CSN08101 Digital Forensics Lecture 6: Acquisition Module Leader: Dr Gordon Russell Lecturers: Robert Ludwiniak Objectives Storage Formats Acquisition Architecture Acquisition Methods Tools Data Acquisition
More informationRemote Device Mounting Service
HOW TO USE REMOTE DEVICE MOUNTING SERVICES The Remote Data Mounting Services (RDMS) lets you acquire live evidence from active and remote network computers. You can gather many types of active information
More informationComputer Forensics: Investigating Data and Image Files, 2nd Edition. Chapter 3 Forensic Investigations Using EnCase
Computer Forensics: Investigating Data and Image Files, 2nd Edition Chapter 3 Forensic Investigations Using EnCase Objectives After completing this chapter, you should be able to: Understand evidence files
More informationComputer Hacking Forensic Investigator. Module X Data Acquisition and Duplication
Computer Hacking Forensic Investigator Module X Data Acquisition and Duplication Scenario Allen a forensic investigator was hired by a bank to investigate employee fraud. The bank has four 30 GB machines
More informationWindows Core Forensics Forensic Toolkit / Password Recovery Toolkit /
The Windows Forensics Core Training follows up the AccessData BootCamp training. This advanced AccessData training class provides the knowledge and skills necessary to use AccessData products to conduct
More informationCIS Project 1 February 13, 2017 Jerad Godsave
CIS 484-75-4172 Project 1 February 13, 2017 Jerad Godsave Part 1) a) Below are a few screenshots indicating verification that the original evidence and the newly created.e01 forensic image match: Part
More informationIntroduction to Computer Forensics
Introduction to Computer Forensics Subrahmani Babu Scientist- C, Computer Forensic Laboratory Indian Computer Emergency Response Team (CERT-In) Department of Information Technology, Govt of India. babu_sivakami@cert-in.org.in
More informationSource: https://articles.forensicfocus.com/2018/03/02/evidence-acquisition-using-accessdata-ftk-imager/
by Chirath De Alwis Source: https://articles.forensicfocus.com/2018/03/02/evidence-acquisition-using-accessdata-ftk-imager/ Forensic Toolkit or FTK is a computer forensics software product made by AccessData.
More informationPractice Test. Guidance Software GD Guidance Software GD0-110 Certification Exam for EnCE Outside North America. Version 1.6
Guidance Software GD0-110 Guidance Software GD0-110 Certification Exam for EnCE Outside North America Practice Test Version 1.6 QUESTION NO: 1 A FAT directory has as a logical size of: A. One cluster B.
More informationSuperImager TM -Rugged USB Display Touch Screen SAS Drive Slots A Computer Forensic- Field Analysis Platform Unit
SuperImager TM -Rugged USB 3.0 12.1 Display Touch Screen SAS Drive Slots A Computer Forensic- Field Analysis Platform Unit (SIR-0024) The SuperImager Rugged USB 3.0 unit is a high speed potable, computer
More informationGuide to Computer Forensics and Investigations Fourth Edition. Chapter 2 Understanding Computer Investigations
Guide to Computer Forensics and Investigations Fourth Edition Chapter 2 Understanding Computer Investigations Objectives Explain how to prepare a computer investigation Apply a systematic approach to an
More informationGetting Bits off Disks: Using open source tools to stabilize and prepare born-digital materials for long-term preservation
Getting Bits off Disks: Using open source tools to stabilize and prepare born-digital materials for long-term preservation Sam Meister University of Montana Best Practices Exchange 2013 November 13, 2013
More informationANALYSIS AND VALIDATION
UNIT V ANALYSIS AND VALIDATION Validating Forensics Objectives Determine what data to analyze in a computer forensics investigation Explain tools used to validate data Explain common data-hiding techniques
More informationPretty Good Privacy (PGP
PGP - S/MIME - Internet Firewalls for Trusted System: Roles of Firewalls Firewall related terminology- Types of Firewalls - Firewall designs - SET for E-Commerce Transactions. Pretty Good Privacy (PGP
More informationIntroduction to Volume Analysis, Part I: Foundations, The Sleuth Kit and Autopsy. Digital Forensics Course* Leonardo A. Martucci *based on the book:
Part I: Foundations, Introduction to Volume Analysis, The Sleuth Kit and Autopsy Course* Leonardo A. Martucci *based on the book: File System Forensic Analysis by Brian Carrier LAM 2007 1/12h Outline Part
More informationAccession Procedures Born-Digital Materials Workflow
Accession Procedures Born-Digital Materials Workflow Initiating Author: Department: Sam Meister Archives & Special Collections Revision History Date Version Description Changed by 02/29/12 0.1 Draft 03/27/12
More informationIntroduction. Collecting, Searching and Sorting evidence. File Storage
Collecting, Searching and Sorting evidence Introduction Recovering data is the first step in analyzing an investigation s data Recent studies: big volume of data Each suspect in a criminal case: 5 hard
More information24) Type a note then click the OK button to save the note. This is a good way to keep notes on items of interest.
23) Click File Analysis Tab - This allows forensic investigators to look for files on the system as they would on a regular system. Key file attributes are provided to assist the investigator (file size,
More informationVeritas System Recovery Disk Help
Veritas System Recovery Disk Help About recovering a computer If Windows fails to start or does not run normally, you can still recover your computer. You can use the Veritas System Recovery Disk and an
More informationDigital Forensics ITP 375 (3 Units)
Digital Forensics ITP 375 (3 Units) Description In 2007, the FBI reported that over 200 major companies reported a loss of over 60 million dollars due to computer crime. Computers are becoming more of
More informationDigital Forensics Lecture 01- Disk Forensics
Digital Forensics Lecture 01- Disk Forensics An Introduction to Akbar S. Namin Texas Tech University Spring 2017 Digital Investigations and Evidence Investigation of some type of digital device that has
More informationAccessData FTK Quick Installation Guide
AccessData FTK Quick Installation Guide Document date: May 20, 2014 2014 AccessData Group, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system,
More informationAccessData Triage 2.3 Release Notes
AccessData Triage 2.3 Release Notes Document Date: August 26, 2013 2013 AccessData Group, Inc. All rights reserved Introduction These Release Notes cover important information, new features, and fixed
More informationON THE SELECTION OF WRITE BLOCKERS FOR DISK ACQUISITION: A COMPARATIVE PRACTICAL STUDY
ON THE SELECTION OF WRITE BLOCKERS FOR DISK ACQUISITION: A COMPARATIVE PRACTICAL STUDY Mousa Al Falayleh College of Computer Info. Tech. American University in the Emirates Dubai, United Arab Emirates
More informationUser Manual. Published: 25-Oct-17 at 18:38:40
User Manual Published: 25-Oct-17 at 18:38:40 Chapter Contents Published: 25-Oct-17 at 18:38:36 Quick Start Guide... 11 Wibu CodeMeter Activation Dongle... 11 System Requirements... 11 Download... 11 Installation...
More informationGuide to Computer Forensics and Investigations Fourth Edition. Chapter 6 Working with Windows and DOS Systems
Guide to Computer Forensics and Investigations Fourth Edition Chapter 6 Working with Windows and DOS Systems Understanding Disk Drives Disk drives are made up of one or more platters coated with magnetic
More informationCYB 610 Project 6 Workspace Exercise
CYB 610 Project 6 Workspace Exercise I. Digital Forensics Lab (Introduction to FTK Imager) a. Lab Rules: Each student has to do the lab individually. No content directly quoted from Internet or other sources
More informationMatt Danner Flashback Data
Preservation Strategies and Data Collection from a Forensic Expert's Point of View Best practices on executing preservation and administering collection protocols with emphasis on forensically sound methods
More informationHow to install the software of ZNS8022
How to install the software of ZNS8022 1. Please connect ZNS8022 to your PC after finished assembly. 2. Insert Installation CD to your CD-ROM drive and initiate the auto-run program. The wizard will run
More informationDigital Forensics Lecture 02- Disk Forensics
Digital Forensics Lecture 02- Disk Forensics Hard Disk Data Acquisition Akbar S. Namin Texas Tech University Spring 2017 Analysis of data found on a storage device It is more common to do dead analysis
More informationDIGITAL FORENSIC PROCEDURE. Procedure Name: Mounting an EnCase E01 Logical Image file with FTK Imager. Category: Image Mounting
DIGITAL FORENSIC PROCEDURE Procedure Name: Mounting an EnCase E01 Logical Image file with FTK Imager Category: Image Mounting Procedure Development Development Owner Mr. O Organization DFIR Team Document
More informationVeritas System Recovery Disk Help
Veritas System Recovery Disk Help About recovering a computer If Windows fails to start or does not run normally, you can still recover your computer. You can use the Veritas System Recovery Disk and an
More informationINSTITUTO SUPERIOR TÉCNICO
INSTITUTO SUPERIOR TÉCNICO DEPARTAMENTO DE ENGENHARIA INFORMÁTICA FORENSICS CYBER-SECURITY MEIC, METI Lab Guide II Evidence Examination 2015/2016 nuno.m.santos@tecnico.ulisboa.pt 1 Introduction This guide
More informationAccessData FTK Quick Installation Guide
AccessData FTK Quick Installation Guide Document date: February 11, 2015 2015 AccessData Group, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval
More informationECE2049: Embedded Computing in Engineering Design C Term Spring Lecture #3: Of Integers and Endians (pt. 2)
ECE2049: Embedded Computing in Engineering Design C Term Spring 2018 Lecture #3: Of Integers and Endians (pt. 2) Reading for Today: Davies Ch 2, MSP430 User's Guide Ch 6.1, 6.3 Reading for Next Class:
More informationNIST SP Notes Guide to Integrating Forensic Techniques into Incident Response
NIST SP800-86 Notes Guide to Integrating Forensic Techniques into Incident Response Authors: Karen Kent, Suzanne Chevalier, Tim Grance, Hung Dang, August 2006 Computer Forensics The application of science
More informationCIS Business Computer Forensics and Incident Response. Lab Protocol 02: FileSystems/VM
Name: CIS 8630 Business Computer Forensics and Incident Response Lab Protocol 02: FileSystems/VM Purpose: Ensure every student has experienced forensics distinctions between imaging digital storage media,
More informationLesson 3 Saving, Folders, Documents and Files
Lesson 3 Saving, Folders, Documents and Files Terms Hard Drive*: a rigid disk inside a computer that holds a large quantity of data and programs (ie. files). CD Rom (Compact Disk Read-Only Memory)*: a
More informationACCESSDATA FTK RELEASE NOTES
ACCESSDATA FTK 3.3.0 RELEASE NOTES INTRODUCTION This document provides important information relative to the use of FTK 3.3.0. IMPORTANT INFORMATION If the machine running Imager or FTK has an active internet
More informationLab 5: Ciphers and Crypto Fundamentals
Lab 5: Ciphers and Crypto Fundamentals Aim: Bill, Richard, Charley The aim of this lab is to give an introduction to ciphers, basic encoding/decoding techniques and frequency analysis, as to provide some
More informationRecover My Files Data Recovery Software English V3.98. The Options Button
Page 1 of 5 Recover My Files Data Recovery Software English V3.98 The Options Button To access the program options, click on the Options button on "Manually Set Options" in the search selection window
More information(Title) Student s Name. Academic Institution
Running head: DIGITAL FORENSICS (Title) Student s Name Academic Institution DIGITAL FORENSICS 2 Introduction Digital forensics is a branch of forensic science that deals with investigations and recovery
More informationLegal Notices. AccessData Corp.
Legal Notices AccessData Corp. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability
More informationDigital Forensics Practicum CAINE 8.0. Review and User s Guide
Digital Forensics Practicum CAINE 8.0 Review and User s Guide Ana L. Hernandez Master of Science in Cybersecurity Digital Forensics Concentration University of South Florida 12-8-2017 Table of Contents
More informationDigital Forensics. Also known as. General definition: Computer forensics or network forensics
TEL2813/IS2621 Security Management James Joshi Associate Professor Lecture 3 Jan 29, 2014 Introduction ti to Digital Forensics Digital Forensics Also known as Computer forensics or network forensics General
More informationOHLONE COLLEGE Ohlone Community College District OFFICIAL COURSE OUTLINE
OHLONE COLLEGE Ohlone Community College District OFFICIAL COURSE OUTLINE I. Description of Course: 1. Department/Course: CNET - 174 2. Title: Computer Forensics 3. Cross Reference: 4. Units: 3 Lec Hrs:
More informationSources of Evidence. CSF: Forensics Cyber-Security. Part I. Foundations of Digital Forensics. Fall 2015 Nuno Santos
Sources of Evidence Part I. Foundations of Digital Forensics CSF: Forensics Cyber-Security Fall 2015 Nuno Santos Summary Reasoning about sources of evidence Data representation and interpretation Number
More informationUnderstanding FAT12. Introduction to Computer Forensics. Kessler/Schirling
Understanding FAT12 Introduction to Computer Forensics Kessler/Schirling Fall 2002 EXP 248 Project #3 You have a floppy disk image file Examine floppy to find an address and a password, and verify MD5
More informationCS121: Our Digital World
+ CS121: Our Digital World + Redacted Documents 2 + Activity: Badly Redacted 3 Documents Download the following file: http://zeus.cs.pacificu.edu/shereen/cs121sp12/redacted.pdf Can you find the secret
More informationTomTom GPS Device Forensics
TomTom GPS Device Forensics Written by Ben LeMere & Andy Sayers For more information visit GPSForensics.org blemere@gpsforensics.org asayers@gpsforensics.org Introduction: The sales of portable navigation
More informationTesting the Date Maintenance of the File Allocation Table File System
Abstract Testing the Date Maintenance of the File Allocation Table File Tom Waghorn Edith Cowan University e-mail: twaghorn@student.ecu.edu.au The directory entries used in the File Allocation Table filesystems
More informationForensics on the Windows Platform, Part Two by Jamie Morris last updated February 11, 2003
SecurityFocus HOME Infocus: Forensics on the Windows Platform, Part Two 2003-02-17 12:56:05-0900 SFOnline Forensics on the Windows Platform, Part Two by Jamie Morris last updated February 11, 2003 Introduction
More informationCSE 4482 Computer Security Management: Assessment and Forensics. Computer Forensics: Working with Windows and DOS Systems
CSE 4482 Computer Security Management: Assessment and Forensics Computer Forensics: Working with Windows and DOS Systems Instructor: N. Vlajic,, Fall 2010 Required reading: Guide to Computer Forensics
More informationDigital Media Transfer Workflow Documentation
Digital Media Transfer Workflow Documentation Release =0 Rockefeller Archive Center Feb 22, 2018 Contents 1 Inventorying Digital Media Items 3 1.1 Overview.................................................
More informationSecurity+ Guide to Network Security Fundamentals, Third Edition. Chapter 11 Basic Cryptography
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 11 Basic Cryptography Objectives Define cryptography Describe hashing List the basic symmetric cryptographic algorithms 2 Objectives
More informationSTEGANOGRAPHY: HIDDEN IN PLAIN SIGHT BY: KEVIN R. MEDINA SANTIAGO
STEGANOGRAPHY: HIDDEN IN PLAIN SIGHT BY: KEVIN R. MEDINA SANTIAGO COMPUTER FORENSICS Investigation of information found in computers and digital storage media Focuses on: Identifying Preserving Recovering
More informationINSTITUTO SUPERIOR TÉCNICO
INSTITUTO SUPERIOR TÉCNICO DEPARTAMENTO DE ENGENHARIA INFORMÁTICA FORENSICS CYBER-SECURITY MEIC, METI Lab Guide III & IV Case Solving: Mr. Informant Case 2015/2016 nuno.m.santos@tecnico.ulisboa.pt 1 Introduction
More informationCourse 832 EC-Council Computer Hacking Forensic Investigator (CHFI)
Course 832 EC-Council Computer Hacking Forensic Investigator (CHFI) Duration: 5 days You Will Learn How To Understand how perimeter defenses work Scan and attack you own networks, without actually harming
More informationAccessData Triage 2.4 Release Notes
AccessData Triage 2.4 Release Notes Document Date: October 25, 2013 2013 AccessData Group, Inc. All rights reserved Introduction These Release Notes cover important information, new features, and fixed
More informationBitLocker Group Policy Settings
BitLocker Group Policy Settings Updated: September 13, 2013 Applies To: Windows 8, Windows 8.1, Windows Server 2012, Windows Server 2012 R2 This reference topic for the IT professional describes the function,
More informationIntroduction. Arizona State University 1
Introduction CSE100 Principles of Programming with C++, Fall 2018 (based off Chapter 1 slides by Pearson) Ryan Dougherty Arizona State University http://www.public.asu.edu/~redoughe/ Arizona State University
More informationTimeline Creation and Analysis Guides
Timeline Creation and Analysis Guides Written by Chapin Bryce Researched by Chapin Bryce 175 Lakeside Ave, Room 300A Phone: 802/865-5744 Fax: 802/865-6446 http://www.lcdi.champlin.edu Timeline Creation
More informationBits. Binary Digits. 0 or 1
Data Representation Bits Binary Digits 0 or 1 Everything stored in a computer is stored as bits. Bits can mean different things depending on how the software or hardware interpret the bits Bits are usually
More information1/29/2019. Storage Media. Storage Media
File Management TECH 1010 Dan Kohn University of Memphis Engineering Technology Department Last update 1/29/18 (WIN10) Storage Media A computer file is a named collection of stored data An executable file
More informationAndroid Forensics: Simplifying Cell Phone Examinations
Android Forensics: Simplifying Cell Phone Examinations Jeff Lessard, Gary Kessler 2010 Presented By: Manaf Bin Yahya Outlines Introduction Mobile Forensics Physical analysis Logical analysis CelleBrite
More informationDigital Forensics Validation, Performance Verification And Quality Control Checks. Crime Scene/Digital and Multimedia Division
Validation, Performance Verification And Quality Control Checks 5. VALIDATION, PERFORMANCE VERIFICATION AND QUALITY CONTROL CHECKS 5.1. Purpose 5.1.1. The purpose of this procedure is to establish guidelines
More informationManaging Files & Folders
Managing Files & Folders 1 Navigation Pane 2 Back, Forward, and Up Buttons 3 Ribbon 4 Address Bar or Navigation Bar 5 File List 6 Column Headings 7 Search Box 8 Status Bar 9 Preview Pane Identify parts
More informationLab - Data Migration in Windows
Lab - Data Migration in Windows Introduction When a new computer is purchased or a new operating system is installed, it is often desirable to migrate a user s data to the new computer or OS. Windows has
More informationDupScout DUPLICATE FILES FINDER
DupScout DUPLICATE FILES FINDER User Manual Version 10.3 Dec 2017 www.dupscout.com info@flexense.com 1 1 Product Overview...3 2 DupScout Product Versions...7 3 Using Desktop Product Versions...8 3.1 Product
More informationComputer Forensic Capabilities. Cybercrime Lab Computer Crime and Intellectual Property Section United States Department of Justice
Computer Forensic Capabilities Cybercrime Lab Computer Crime and Intellectual Property Section United States Department of Justice Agenda What is computer forensics? Where to find computer evidence Forensic
More informationReport For Algonquin Township Highway Department
Report For Algonquin Township Highway Department Prepared For: Prepared By: Robert Hanlon Attorney at Law robert@robhanlonlaw.com Andy Garrett Garrett Discovery Inc agarrett@garrettdiscovery.com Date:
More informationContact Information. Contact Center Operating Hours. Other Contact Information. Contact Monday through Thursday Friday
Contact Information Contact Center Operating Hours Contact Monday through Thursday Friday Phone: 1.801.796.0944 8 AM 5 PM Eastern Time 8 AM 3 PM Eastern Time Online chat: http://support.paraben.com 10
More informationCIS Business Computer Forensics and Incident Response. Lab Protocol 03: Acquisition
CIS 8630 Business Computer Forensics and Incident Response Lab Protocol 03: Acquisition Purpose: Ensure every student has experienced imaging digital storage media, hashing digital media, transferring
More informationMicrosoft Office 2007, 2010 Registry Artifacts Dustin Hurlbut September 16, 2010
Microsoft Office 2007, 2010 Registry Artifacts Dustin Hurlbut September 16, 2010 INTRODUCTION Previous versions of Microsoft Office used application specific registry artifacts to track opened documents.
More informationAcknowledgments About the Authors
Preface p. xv Acknowledgments p. xix About the Authors p. xxi Case Studies p. xxv Live Incident Response p. 1 Windows Live Response p. 3 Analyzing Volatile Data p. 5 The System Date and Time p. 6 Current
More informationCisco Service Control Online Advertising Solution Guide: Behavioral. Profile Creation Using RDRs, Release 4.1.x
CISCO SERVICE CONTROL SOLUTION GUIDE Cisco Service Control Online Advertising Solution Guide: Behavioral Profile Creation Using RDRs, Release 4.1.x 1 Overview 2 Configuring Behavioral Targeting Support:
More information1 Start Ubuntu Privacy Remix
Table of Contents 1 Start Ubuntu Privacy Remix...1 2 Working with USB flash drives and diskettes...2 3 Open extended TrueCrypt volume...3 4 Open normal TrueCrypt Volume...4 5 Open and store data in the
More informationTECHNICAL BRIEF. Data Integrity During a File Copy TECHNICAL BRIEF
Data Integrity During a File Copy June 2018. Copyright Datadobi, all rights reserved. Datadobi believes the information in this publication is accurate as of its publication date. The information is subject
More informationBackup challenge for Home Users
PARAGON Technologie GmbH, Systemprogrammierung Heinrich-von-Stephan-Str. 5c 79100 Freiburg, Germany Tel. +49 (0) 761 59018201 Fax +49 (0) 761 59018130 Internet www.paragon-software.com Email sales@paragon-software.com
More informationC H A P T E R 1. Introduction to Computers and Programming
C H A P T E R 1 Introduction to Computers and Programming Topics Introduction Hardware and Software How Computers Store Data How a Program Works Using Python Computer Uses What do students use computers
More information10/13/11. Objectives. Live Acquisition. When do we consider doing it? What is Live Acquisition? The Order of Volatility. When do we consider doing it?
Live Acquisition Objectives Understand what Live Acquisition is and when it is appropriate Understand the concept of Order of Volatility Understand live acquisition issues and limitations Be able to perform
More informationThe FileSystemObject Object. Active Server Pages
The FileSystemObject Object Active Server Pages Objectives In this chapter, you will: Describe a drive, a folder, and a file Describe and use the different objects in the FileSystemObject object Describe
More informationDissecting Files. Endianness. So Many Bytes. Big Endian vs. Little Endian. Example Number. The "proper" order of things. Week 6
Dissecting Files Endianness Week 6 The "proper" order of things So Many Bytes So Many Bytes On a 32-bit system, each word consists of 4 bytes So, when any 32-bit value is stored in memory, each of those
More informationSECUDRIVE Sanitizer Portable User Guide
SECUDRIVE Sanitizer Portable User Guide Doc Ver. 2.0.27.238 2014-04-24 Brainzsquare, Inc. TABLE OF CONTENTS 1 Overview... 3 1.1 Features... 3 2 PC Sanitization... 5 2.1 Program Package... 5 2.2 Running
More informationPilotEdit User Manual. Author: Date: Version:
PilotEdit User Manual Author: support@pilotedit.com Date: 2018-02-28 Version: 11.3.0 URL: http://www.pilotedit.com Table of Contents 1. Introduction... 6 1.1. What is PilotEdit?... 6 1.2. PilotEdit GUI...
More informationOperating System Specification Mac OS X Snow Leopard (10.6.0) or higher and Windows XP (SP3) or higher
BlackLight is a multi-platform forensic analysis tool that allows examiners to quickly and intuitively analyze digital forensic media. BlackLight is capable of analyzing data from Mac OS X computers, ios
More informationAccessData. Forensic Toolkit. Upgrading, Migrating, and Moving Cases. Version: 5.x
AccessData Forensic Toolkit Upgrading, Migrating, and Moving Cases Version: 5.x 1 AccessData Legal and Contact Information Document date: March 27, 2014 Legal Information 2014 AccessData Group, Inc. All
More information