Hands-On Project
In this project, you create, and delete Word and Excel files on a USB drive (or small disk partition, if you don't have a USB drive), and then use OSForensics to examine the drive. Follow these steps:
1. Create C6Prj01 folders on your USB drive or disk partition.
2. Open a new document in Word, and type, This is to test deletings files and then wiping them. Save th file in the C6Prj01 folder as Test 6-1.docx, and exit Word.deletings files and then wiping them. Save th file in the C6Prj01 folder as Test 6-1.docx, and exit Word.deletings files and then wiping them. Save th file in the C6Prj01 folder as Test 6-1.docx, and exit Word.deletings files and then wiping them. Save th file in the C6Prj01 folder as Test 6-1.docx, and exit Word.
3. Open a new workbook in Excel. Type few numbers, and then save the workbook in the C6Prj01 folder as Test 6-2.xlsx. Exit Excel. numbers, and then save the workbook in the C6Prj01 folder as Test 6-2.xlsx. Exit Excel.
4. Use Windows Explorer or My Computer to delete both files from the USB or disk drive.
5. Start OSForensics, and start a new case. Type C6Prj01 for the case name, and enter Aileen for the investigator. Leave the Acquisition Type option as Live Acquisition of Current Machine, and specify the work folder you created for this chapter. Create subfolder called C6Prj01, and click OK.subfolder called C6Prj01, and click OK.
6. If necessary, click Manage Case in the left pane, and then click the Add Device button in the right pane. Click the drive letter of your USB device, make sure the Forensics mode option button is selected, and click OK.
7. Make sure the case you just created has a green check mark next to it; if not, double-click the case name, and then click Start in the left pane. Using the scroll bar on the far right, scroll down and click the Deleted Files & Data Carving icon. In the Deleted Files Search window, click the Disk list arrow, and then click the USB drive in the list of options. Click the Search button. Because you're searching for deleted files, you don't need to enter a file string or filter.
8. Double-click the Test 6-1.docx file in the lower pane to view its contents. You can also click the File Info tab to verify the file's MAC time. Repeat this process with the Test 6-2.xlsx file.
9. Close all open windows, and exit OSForensics.