#Prodiscover basic. pdf
#Prodiscover basic. install
#Prodiscover basic. zip
#Prodiscover basic. windows

#Prodiscover basic. pdf

Submit a single PDF file containing your results of doing the 4 investigations in the lab instructions on github.

Save a list of the registry keys you found and their contents, and include them in your sumission for this lab.

Use Edit->Find and Edit->Find Next to find the string вЂњsuperiorвЂќ and the string вЂњdeniseвЂќ in the registry image.

Use File->Open to open the user.dat file you previously downloaded.

When you start it, it will ask about a security device for licensing use, just choose No to run in Demo mode.

#Prodiscover basic. install

Download the AccessData Registry Viewer and install it.Now we are going to look for references to superior bicycles or denise robinson in the registry to see if they left tracks in the registry.Extract the system.dat and user.dat files to a temporary folder.For this lab, you can download some sample files. Begin by copying the two registry files to a temporary folder.In this scenario, we are trying to determine if a captured registry from an employeeвЂ™s computer has any information which might be useful to a paralegal investigating a Denise Robinson, who works for a competitor, Superior Bicycles.

#Prodiscover basic. windows

If you have an image capture that includes the system.dat and user.dat files form the windows folder on a c: drive, you can examine the registry in that image.

How might you use that information as part of an investigation?Д®xamining the registry in an image file using AccessData Registry Viewer.

What extra files do you see on the D drive in the catfiles directory, compared to the C drive?.

Include the following question with your answers in your submission for this lab.

Repeat the previous step, but use the catfiles directory on drive D.

Click in the evidence tree to select drive C, directory catfiles, so that the files show up in the file list on the upper right.

Add the wholedrive image file you made last week.

Generate a report of your findings that describes the relationship between George and Laura and include that in your submission for this lab.ДЇinding Zone.identifier streams using Autopsy.

Do not include files that arenвЂ™t relevant to both George and Laura together.

Examine the contents of the found files to see if they do reference George and Laura and if they do, check them off as files of interest with suitable comments about what is in the files you found.

Use the Search item in the Prodiscover navigation tree to try finding files with the words George, Montgomery, Laura, or Roper in them.

#Prodiscover basic. zip

Add the inChp02.eve image file extracted from InChp02.exe self-extracting zip file.An image file has been captured for us by a 3rd party. We are looking for evidence that will show whether they had an ongoing business relationship or not. In this investigation, there is an allegation that Laura Roper and George Montgomery worked together. Using Prodiscover for identifying evidence of transactions between George Montgomery and Laura Roper Include the report in your submission for this lab. Open the report by clicking on the file link and review it taking note of what the report contains, and what you would need to add to make it a complete forensic report.When you have examined all the pictures and tagged all the photos with Clint Eastwood in them, click Generate Report.If you find any, check the box next to the file with Clint Eastwood, and tag them as notable items. Use that ability to see if there are any pictures there of Clint Eastwood. Clicking on a file in the file listing allows you to view a file.Use the evidence tree to view the filesystems found in the image, and explore them to see what files are in the image.Add the wholedrive image file from lab 1.Download Autopsy and install it, then run it.We are attempting to ascertain whether he used the computer to get images of Clint Eastwood from the internet. In this investigation, we are continuing with our investigtion of Donald. Autopsy as a tool for identifying whether pictures of Clint Eastwood are on a suspect drive The purpose of this lab is to try using Windows tools to examine Microsoft filesystem images to see what you can recover.

NETS1032 Lab 2 Examining Microsoft Filesystems