Information Technology Reference
In-Depth Information
That.search.gave.me.43.hits.in.5.iles..These.were.all.deleted.
iles,.but.I.was.able.to.recover.two.of.them.and.save.them.as.
document.iles.to.add.to.the.evidence.of.the.case.
As.a.inal.check.to.make.sure.nothing.was.missed,.I.ran.two.
data.carving.processes..Data.carving.is.a.process.that.FTK.
and.other.forensics.applications.will.run..It.goes.through.all.
of.the.unallocated.(deleted.iles,.or.unused.space.on.a.hard.
drive),.and.searches.for.headers.that.indicate.the.presence.of.
a.particular.type.of.ile..If.it.inds.that.header,.it.attempts.to.
piece.it.together.again,.and.“carves”.out.that.section.of.data.
so.it.can.be.recovered.and.analyzed.
I. used. FTK. to. carve. OLE. (Microsoft. Ofice). iles,. and. then.
used.X-Ways.Forensic.version.13.0.to.carve.JPEG.graphics.
iles..(X-Ways.can.sometimes.do.a.better.job.of.carving.graph-
ics.iles.than.can.FTK.).These.processes.take.many.hours.to.
complete,.as.they.are.going.through.the.hard.drive.bit.by.bit..
When.they.completed,.I.did.a.inal.review.and.analysis.of.the.
iles.they.had.located..There.were.no.new.iles.that.had.not.
already.been.reviewed.and.bookmarked.as.evidence.
Finally,.I.cleaned.up.some.of.the.evidence.in.FTK.and.used.
its.Report.Wizard.to.create.a.inal.report,.which.is.included.on.
the.accompanying.CD.
Signatures
Investigator.(printed.name/signature/date.of.report.
submission)
Chief.Information.Security.Oficer.(printed.name/signature/
date.of.receipt.and.review)
Requesting.Department.Contact.(printed.name/signature/
date.of.receipt.and.review)
