Aussie pooch mobile canberra

Exercise 3: Convert the WinLabEnCase image to a DD image

In the Evidence Tree view, select the WinLabEnCase image

Click File > Export Disk Image

In the Create Image dialog, click Add

Select the raw image type and name it as converted.

Exercise 4: Verify images

Select the Encase Image and click File > Verify Drive/Image

Add in the converted raw image to the FTK Imager and click File > Verify Drive/Image.

Question 2: What are the results of verification? Comparing both hashes, are they same or not?

PART II: Working with FTK 1.8x

All exercises and questions in this part are designed for FTK 1.8x.

NOTE: If you choose to use FTK 4 instead of FTK 1.8x, please follow PART III.

Objective: Based on the experience you have in the previous lab, you will utilize FTK to conduct an analysis of an incident. This project will help you tie all of the pieces and techniques together, so that you have a better understanding of the whole picture of forensics investigation.

Requires: FTK and a windows’ disk image provided by your instructor.

Descriptions: In this lab you will be given a scenario and a disk image to go along with it. You will use FTK to analyze the disk image, retrieve deleted files and terms that have been purposefully hidden, and then use FTK to create a report about this incident.

Scenario: ACME Industries develops custom software for the aviation industry. Its main competitors are companies Raytheon and Boeing and a few smaller contractors.

Pat Smith has worked for ACME Industries for 5 years. His supervisor has noted that after being past over several times for a promotion, Pat has become quite disgruntled. The company fears that Pat may be offering proprietary company information to a competitor in exchange for a job.

The first investigator has created an Encase image of Pat’s computer’s hard drive. Your job is to examine it and extract all pertinent information to the investigation. You are to make no assumptions of innocence or guilt, just to gather information.