Lab 5 Drawing Conclusions Based on Investigative Research Purpose: To investigate and form an opinion based on a user's computing behavior. Application location: Virtual Computing Lab: FTK 5.0 / Windows 7 Preparation: Review background video/slides (on Blackboard) Evidence file: ubinst1.casper-rw.gen3.aff (located in Forensic Data folder on VCL desktop) Questions to answer: 1. What is the operating system (be specific - include the distribution) of this disk image? What is the file system? 2. This particular file system has what are called inodes. What is an inode? What information do inodes store? 3. What is the inode number of the Documents directory? 4. List two websites that the user had bookmarked on 1-7-2009. 5. What mail client does the user have? 6. Did the user have any mail in their inbox? If yes, what is the email address of the sender? 7. Find a document from Karen S. Evans about the planning guidance for Trusted Internet Connections (TIC). Who is the memorandum for? How many pages is the document? 8. Based on all of the documents and data on the user's computer, what can you surmise the user was trying to do? 9. Do you think this person was acting honestly or committing a crime? How did you come to this conclusion? Lab 5 Drawing Conclusions Based on Investigative Research Purpose: To investigate and form an opinion based on a user's computing behavior. Application location: Virtual Computing Lab: FTK 5.0 / Windows 7 Preparation: Review background video/slides (on Blackboard) Evidence file: ubinst1.casper-rw.gen3.aff (located in Forensic Data folder on VCL desktop) Questions to answer: 1. What is the operating system (be specific - include the distribution) of this disk image? What is the file system? 2. This particular file system has what are called inodes. What is an inode? What information do inodes store? 3. What is the inode number of the Documents directory? 4. List two websites that the user had bookmarked on 1-7-2009. 5. What mail client does the user have? 6. Did the user have any mail in their inbox? If yes, what is the email address of the sender? 7. Find a document from Karen S. Evans about the planning guidance for Trusted Internet Connections (TIC). Who is the memorandum for? How many pages is the document? 8. Based on all of the documents and data on the user's computer, what can you surmise the user was trying to do? 9. Do you think this person was acting honestly or committing a crime? How did you come to this conclusion