Pace University New York File Hashes by using a FTK Imager Report
Question Description
Frist, by using a FTK Imager, you create the image by going to File and Create Disk Image and from Select Source, select Logical Drive. From the Source Drive Selection, choose D (USB) and click Add from the Create Image. From the Select Image Type, choose E01 and follow the Evidence Item Information.
Next, you make a .eve file by ProDiscover Basic and then convert it to .dd file and click File in a FTK Imager after opening again, find Add Evidence Item (first one) and click it. Select Image File to load the image from .dd file.
A county detective asks you, a Forensics Investigator, to help him catch a serial arsonist, who has set fire to multiple Walmart and Lumbermill stores in the county. The detective has obtained a suspect’s USB drive that might be clues to solving the case. The detective wants you to perform a preliminary investigation of the USB drive because he needs a search warrant (subpoena) to seize further evidence in the suspect’s home and workplace. The law prohibits searching a suspect’s home or workplace without specific evidence. After a preliminary investigation, you conclude that you might have found the arsonist, who documented his crimes on his computer. During your analysis of the files, you recovered images of fires in a folder named “Pleasure.” You also found folders named “Walmart” and “Lumbermill.” You submit the results of the preliminary investigation to the detective, and he obtains a subpoena from the County Judge.
Submit the result of Preliminary Investigation by your explanation while providing the evidence (screenshot of File Hashes by using a FTK Imager, screenshot of all documents after right-clicking Export Files to open the files from the FTK Imager).
Open an Autopsy and make a new case:
Now, you are building a real case by further analyzing and gathering evidence related to the fires using an Autopsy tool, and you present a report with the file hashes calculated in FTK Imager to validate the evidence. Without validating the evidence (e.g. Hashing, MD5 and SHA1), the vital evidence might be invalid, and the court would not accept it as legal evidence. Therefore, you as the Forensics Investigator must perform a validation process after conducting an investigation.
To collect evidence, Shift+click to select all the files and then right-click them, point to Tag Files and click Tag and Comment, like Images of Recent Fires.
Once you have collected enough evidence via Autopsy, you may make an Autopsy report by clicking on “Generate Report” located in the upper left-hand corner. In the “Select” and “Configure Report Models” dialog box, click the “Results-HTML with All Results.”.
Submit the Result of Autopsy (a snapshot)
Have a similar assignment? "Place an order for your assignment and have exceptional work written by our team of experts, guaranteeing you A results."