Assignment- Forensic Imaging

The purpose of this lab is to learn more about forensic imaging. The lab is designed so that you can practice using three separate forensic tools in order to compare and contrast how each works.

It is important in this lab to not only discuss the processes and results but also show them. Make sure take at least three images (one of each imaging tool result) and discuss them. You can take more if necessary. Please make sure to embed them in your document and label them (e.g., Lab1-Image1: FTK Image).

Assignment

1. Starting with Hands-On Project 4-1 in the Nelson text, make a target drive from the image attached here. (It's also on your textbook DVD). Make sure to discuss the process and provide screenshots as necessary. 2. Continue with Hands-On Project 4-2 in the Nelson text. However, instead of just preparing one image, you will prepare three images using three of the most used tools in the digital forensics examiners toolkit1:

a. dd

b. FTK

c. Prodiscover Basic

3. Make sure to discuss each process-you'll do it three times-and provide screens when necessary. You must at least provide the three screens noted above.

4. Make sure to conclude with a discussion that answers the following questions:

a. Are the images different? If so, why? If not, why?

b. What is the most significant different among the tools? Why?