Lab 6, IASP 53011/17/2020

A county detective asks you, a Forensics Investigator, to help him catch a serial arsonist, who has set fire to multiple Walmart and Lumbermill stores in the county. The detective has obtained a suspect’s USB drive that might be clues to solving the case. The detective wants you to perform a preliminary investigation of the USB drive because he needs a search warrant (subpoena) to seize further evidence in the suspect’s home and workplace. The law prohibits searching a suspect’s home or workplace without specific evidence. After a preliminary investigation, you conclude that you might have found the arsonist, who documented his crimes on his computer. During your analysis of the files, you recovered images of fires in a folder named “Pleasure.” You also found folders named “Walmart” and “Lumbermill.” You submit the results of the preliminary investigation to the detective, and he obtains a subpoena from the County Judge.

Frist, by using a FTK Imager, you create the image by going to “File” and “Create Disk Image” and from Select Source, select Logical Drive. From the Source Drive Selection, choose D (USB) and click “Add…” from the Create Image. From the Select Image Type, choose “E01” and follow the Evidence Item Information.

Next, you make a .eve file by ProDiscover Basic and then convert it to .dd file

Again, to open FTK Imager and then,

click “File” in a FTK Imager after opening again, find “Add Evidence Item” (first one) and click it. Select “Image File” to load the image from .dd file.

Submit the result of Preliminary Investigation by your explanation while providing the evidence 1) screenshot of File Hashes by using a FTK Imager,

2) screenshot of your file name that contains .E01, .eve and .dd files.

3) screenshots of evidence fire images and texts in FTK Imager (by searching Control+F key).

4) screenshot of the movie “FIRESTARTER” by FTK Imager.

5) screenshot of the movie “FIRESTARTER” by Autopsy.

6) screenshot of the text “Set a Fire:….” by Autopsy.

Open an Autopsy and make a new case:

Now, you are building a real case by further analyzing and gathering evidence related to the fires using an Autopsy tool, and you present a report with the file hashes calculated in FTK Imager to validate the evidence. Without validating the evidence (e.g. Hashing, MD5 and SHA1), the vital evidence might be invalid, and the court would not accept it as legal evidence. Therefore, you as the Forensics Investigator must perform a validation process after conducting an investigation.

To collect evidence, Shift+click to select all the files and then right-click them, point to Tag Files and click Tag and Comment, like Images of Recent Fires.

Once you have collected enough evidence via Autopsy, you may make an Autopsy report by clicking on “Generate Report” located in the upper left-hand corner. In the “Select” and “Configure Report Models” dialog box, click the “Results-HTML with All Results.”.

Submit the Result of Autopsy (a snapshot)