4/7/2024 0 Comments Prodiscover basic.Is there anything special about any of the files? List all the Deleted files recovered by ProDiscover in a table – and calculate the MD5 hash value for each deleted file. Go to “Content View” and click on the image. How many clusters are used on this image file? Go to “Cluster View” and click on the image. What is the file system of this image file? This adds some information about the image to the report, which you can view at any time during your examination by clicking on “View” then “Report”. Give it a unique number and name.Ĭlick “Add” then “Image File” and add “123img1.dd”.Ĭlick the “Action” menu then generate “OS Info”. Instructions & QuestionsĬreate a new project for this laboratory. Instructions appear as bullet points, questions are numbered and bolded. These image files are distributed under the GPL and were originally created by Brian Carrier. You will also need to download a copy of the image files for this lab, 123img.zip. In order to do this lab, you will need to download and install ProDiscover Basic (make sure to pick 32-bit or 64-bit depending on your version of Windows) from this URL: (scroll down until you see the download links at the bottom of the page). This lab is a replacement for the EnCase lab (122) for students who have been unable to access EnCase through RLES. Advanced Computer Forensics Windows ProDiscover Forensics Lab
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |