In this lab. you acted as a forensic specializer helping the lead forensics research worker at the Cyber Crimes Division ( CCD ) for the Fremont Police Department. You were given a difficult thrust image taken from a seized computing machine suspected of incorporating stolen recognition card Numberss. You reviewed the hunt warrant and completed the Chain of Custody signifier that accompanied the grounds thrust. You prepared the contents of the seized difficult thrust utilizing a assortment of forensic tools as grounds in conformity with the Daubert criterion. You used FTK Imager to make hashes for cardinal grounds files. You so validated the hash codification utilizing EnCase Imager and P2 Commander. two common forensic analysis tools.
Lab Assessment Questions & A ; Answers
1. Why is the unallocated infinite of a Windows system so of import to a forensic research worker?
2. From where were the badnotes1. txt and badnotes2. txt files recovered?
3. What is the INFO2 file used for?
4. How do you bring forth a hash file in FTK Imager?
5. What was the MD5 hash value in 043458. csv. the deleted electronic mail file?
6. What is the Daubert criterion?
7. Why must a forensic research worker be familiar with emerging engineerings?