Answered step by step
Verified Expert Solution
Question
1 Approved Answer
1 . Copy the GCFIi - datacarve - FAT.dd file to your Linux virtual machine with Sleuth Kit and Autopsy installed. Start Sleuth Kit and
Copy the GCFIidatacarveFAT.dd file to your Linux virtual machine with Sleuth Kit and
Autopsy installed. Start Sleuth Kit and Autopsy. In the main window, click New Case. In
the Create a New Case dialog box, fill in your information using GCFI datacarveFAT for
the case name and then click New Case.
In the Creating Case dialog box, click Add Host, and in the Add a New Host dialog
box, enter your information, and click Add Host.
In the Adding host dialog box, click Add Image to continue. In the Open Image dialog box,
click Add Image File. In the Add a New Image dialog box, type the full pathname and the
GCFIidatacarveFAT.dd image filename in the Location text box, click the Partition option
button, click the Copy option button for the import method, and then click Next.
In the Image File Details section, click Add, and in the Testing partitions dialog box, click
OK In the Select a volume to analyze or add a new image file dialog box, click the
Analyze button.
In the Analysis dialog box, click File Analysis, and then click Generate MD List of
Files. In the MD results window, save the list as GCFIidatacarveFATMDtxt in
your work folder, and close the MD results window.
Next, in the Analysis dialog box, click File Type, click Sort Files by Type, and then click
OK When the analysis is finished, print the Results Summary frame of the Web page.
Click Image Details, and in the General File System Details dialog box, print the
frame containing the results
Step by Step Solution
There are 3 Steps involved in it
Step: 1
Get Instant Access to Expert-Tailored Solutions
See step-by-step solutions with expert insights and AI powered tools for academic success
Step: 2
Step: 3
Ace Your Homework with AI
Get the answers you need in no time with our AI-driven, step-by-step assistance
Get Started