Answered step by step
Verified Expert Solution
Link Copied!

Question

1 Approved Answer

Need help with this using Autopsy NOT prodiscover Hands-On Project 1-2. In this project, you work for a large corporation's IT Security Department. Your duties

image text in transcribedimage text in transcribed

Need help with this using "Autopsy" NOT prodiscover

Hands-On Project 1-2. In this project, you work for a large corporation's IT Security Department. Your duties include conducting internal digital investigations and forensics examinations on company computing systems. A paralegal from the Law Department, Ms. Jones, asks you to examine a USB drive belonging to an employee who left the company and now works for a competitor. The Law Department is concerned that the former employee might possess sensitive company data. Ms. Jones wants to know whether the USB drive contains anything relevant. In addition, she tells you that the former employee might have had access to confidential documents because a co-worker saw him accessing his manager's computer on his last day of work. These documents consist of nine files containing the word confidential. She wants to know whether the USB's bit-stream image file has these documents. To process this case, make sure the C1Prj02.001 file has been extracted to your work folder, and then follow these steps: 1. Start Autopsy for Windows, if you exited it at the end of the previous project. If the previous project is open, click Case, Close Case from the menu. Click the Create New Case icon. In the New Case Information window, enter C1Prj02 in the Case Name text box, and click Browse next to the Base Directory text box. Navigate to and click your work folder, and then click Next. 2. In the Additional Information window, type C1Prj02 in the Case Number text box and your name in the Examiner text box, and then click Finish. 3. In the Select Data Source window, click the Select data source type list arrow, and click Disk Image or VM file. Click the Browse button next to the Browse for an image file text box, navigate to and click your work folder and the C1Prj02.001 file, and then click Open. Click Next. 4. In the Configure Ingest Modules window, click Select All. Click Next and then Finish. 5. Click the Keyword Search button at the far upper right, type confidential in the text box, and then click Search. 6. In the Result Viewer pane, a new tab named Keyword search 1 opens. Click each file to view its contents in the Content Viewer pane. 7. Ctrl+click to select the files in the Keyword search 1 tab. Right-click this selection, point to Tag File, and click Tag and Comment. In the Create Tag dialog box, click the New Tag Name button, type Recovered Office Documents in the Tag Name text box, and then click OK. 8. Click Generate Report at the top. In the Generate Report window, click the Results - Excel option button in the Report Modules section, and then click Next. 9. In the Configure Artifacts Report window, click the Tagged Results button, click the Recovered Office Documents check box, and then click Finish. 10. In the Report Generation Progress Complete window, click the Results - Excel pathname to open the Excel report. This Excel file should have several tabs of information about the files you tagged for this project. 11. In the Report Generation Progress Complete window, click Close, and then exit Autopsy. Write a memo to Ms. Jones listing the filenames where you found a hit for the keyword. List the cluster numbers for hits that occurred in unallocated space. Include the Excel spreadsheet with the report

Step by Step Solution

There are 3 Steps involved in it

Step: 1

blur-text-image

Get Instant Access to Expert-Tailored Solutions

See step-by-step solutions with expert insights and AI powered tools for academic success

Step: 2

blur-text-image

Step: 3

blur-text-image

Ace Your Homework with AI

Get the answers you need in no time with our AI-driven, step-by-step assistance

Get Started

Recommended Textbook for

Visual C# And Databases

Authors: Philip Conrod, Lou Tylee

16th Edition

1951077083, 978-1951077082

More Books

Students also viewed these Databases questions

Question

Why do HCMSs exist? Do they change over time?

Answered: 1 week ago