100% satisfaction guarantee Immediately available after payment Both online and in PDF No strings attached
logo-home
Solutions for Guide to Computer Forensics and Investigations, 7th Edition Nelson (All Chapters included) $29.49   Add to cart

Exam (elaborations)

Solutions for Guide to Computer Forensics and Investigations, 7th Edition Nelson (All Chapters included)

 40 views  0 purchase
  • Course
  • Computer information systems
  • Institution
  • Computer Information Systems

Complete Solutions Manual for Guide to Computer Forensics and Investigations, 7th Edition by Bill Nelson, Amelia Phillips, Christopher Steuart ; ISBN13: 9780357672884...(Full Chapters included Chapter 1 to 15)...Module 1 Understanding the Digital Forensics Profession and Investigations Module 2 Re...

[Show more]

Preview 4 out of 292  pages

  • August 31, 2024
  • 292
  • 2024/2025
  • Exam (elaborations)
  • Questions & answers
  • Computer information systems
  • Computer information systems
avatar-seller
mizhouubcca
Computer Forensics and Investigations
7th Edition by Bill Nelson




Complete Modules Solutions
Manual are included (Mod 1 to 15)




** Immediate Download
** Swift Response
** All Chapters included
** Practice Lab Answers

,Solution and Answer Guide
BILL NELSON, AMELIA PHILLIPS, CHRIS STEUART, ROBERT S. WILSON,
GUIDE TO COMPUTER FORENSICS AND INVESTIGATIONS, 7TH EDITION, ISBN: 9780357672884;
MODULE 1: UNDERSTANDING THE DIGITAL FORENSICS PROFESSION AND INVESTIGATIONS


Table of Contents
Activities - Solutions ................................................................................................................................... 2
Activity 1-1 ............................................................................................................................................... 2
Review Questions - Answers ...................................................................................................................... 3
Hands-On Projects - Solutions ................................................................................................................... 7
Project 1-1 ................................................................................................................................................. 7
Project 1-2 ................................................................................................................................................. 9
Project 1-3 ............................................................................................................................................... 10
Project 1-4 ............................................................................................................................................... 13
Case Projects - Solutions .......................................................................................................................... 15
Case Project 1-1 ...................................................................................................................................... 15
Case Project 1-2 ...................................................................................................................................... 15
Case Project 1-3 ...................................................................................................................................... 16
Case Project 1-4 ...................................................................................................................................... 17

,Activities - Solutions

ACTIVITY 1-1
Estimated Time: 30 minutes
Objective: Configure Autopsy for a new case and analyze the image file of George Montgomery’s USB drive.
Before You Begin:
• Download and install Autopsy as described in Note 15.
• Create Work folder C:\Work\Module_01\Activity_01-1 (referred to as your Work folder in the steps).
• Download to your Work folder the following files provided with the module:
• Activity_01-1.001
To perform the analysis, complete the following steps:
1. Start Autopsy for Windows.
2. In Autopsy’s Welcome window, click the New Case button. In the New Case Information window, enter
Activity_01-1 in the Case Name text box (see Figure 1-15), and click Browse next to the Base Directory text box.
Navigate to and click your Work folder. Make sure the Single-User option button is selected for Case Type, and
then click Next.
[Figure 1-15 New Case Information window of Autopsy]
3. On the Optional Information pane, type Activity_01-1 in the Case Number text box and your full name in the
Name text box in the Examiner section (see Figure 1-16), and then click Finish to start the Add Data Source
Wizard.
4. In the Select Type of Data Source to Add area of the Add Data Source window, click the Disk Image or VM
File button (see Figure 1-17), and then click Next.
5. In the Select Data Source pane of the next window, click the Browse button next to the Path text box, navigate to
and click your Work folder, click the Activity_01-1.001 file, and then click Open. Click Next.
6. Keep the default settings in the Configure Ingest Modules window. Click Next and then click Finish.
[Figure 1-16 Optional Information pane of Autopsy]
[Figure 1-17 Add Data Source window of Autopsy]
Next, complete these steps to display the contents of the acquired data:
1. In the Tree Viewer pane on the left, expand Views, File Types, By Extension, and Documents by clicking the
plus sign next to each folder (see Figure 1-18).
2. Under Documents, click Office. In the Result Viewer (upper-right pane), click the last file, Contract with
Martha.docx, to display its contents in the Content Viewer (lower-right pane).
3. Right-click Contract with Martha.docx, select Add File Tag, and click Tag and Comment.
4. In the Select Tag dialog box, click the New Tag button. In the New Tag section of the Create Tag dialog box,
type Recovered Office Documents in the Tag Name text box (see Figure 1-19), click OK, and then click OK again.
5. Right-click Contract with Martha.docx again, and then click Extract File(s). In the Save window, click Save,
and then click OK.

, [Figure 1-18 Expanded tree view of files in Autopsy]
[Figure 1-19 Create Tag dialog box in Autopsy]
6. In the Tree Viewer pane, click the plus sign to expand the Deleted Files folder, and then click the All (2) folder.
Next, you will select the files and explore what is there.
7. In the Result Viewer pane, click ~$George Presentation.pptx. In the Content Viewer pane, make note of
George’s last name, then click File, and then click Exit to close Autopsy.
8. Open Notepad, and type George’s first and last names as they appeared in the Content Viewer pane in step 7.
Save this file as Activity_01-1_George to your Work folder and exit Notepad.
9. Start File Explorer and navigate to subfolder Activity_01-1\Export in your Work folder and copy the file
Contract with Martha.docx to your Work folder.
10. Submit to your instructor the following files:
• Activity_01-1_George.txt
• Contract_with_Martha.docx
Solution Guidance: This activity is a brief introduction to Autopsy for Windows. By completing the steps
in this activity, students should learn how to initiate a digital forensics examination and how to navigate
and use some of the features available in Autopsy. To show successful completion of this activity, students
should submit the two documents listed in the final step. For examples of the contents of these documents,
see the following solution files:
• Solution_Activity_01-1_George.pdf
• Solution_Contract with Martha.pdf


Review Questions - Answers
1. Digital forensics and data recovery refer to the same activities. True or False?

Answer: False

Explanation: In data recovery, you typically know what you’re looking for. Digital forensics is the
task of recovering data that users have hidden or deleted, with the goal of ensuring that the recovered
data is valid so it can be used as evidence.

The benefits of buying summaries with Stuvia:

Guaranteed quality through customer reviews

Guaranteed quality through customer reviews

Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.

Quick and easy check-out

Quick and easy check-out

You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.

Focus on what matters

Focus on what matters

Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!

Frequently asked questions

What do I get when I buy this document?

You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.

Satisfaction guarantee: how does it work?

Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.

Who am I buying these notes from?

Stuvia is a marketplace, so you are not buying this document from us, but from seller mizhouubcca. Stuvia facilitates payment to the seller.

Will I be stuck with a subscription?

No, you only buy these notes for $29.49. You're not tied to anything after your purchase.

Can Stuvia be trusted?

4.6 stars on Google & Trustpilot (+1000 reviews)

80202 documents were sold in the last 30 days

Founded in 2010, the go-to place to buy study notes for 14 years now

Start selling
$29.49
  • (0)
  Add to cart