Accept the default settings, and click OK. When you’re done, click the Start button, and then click the Generate Report button. (Note: In ProDiscover, you simply selected the file without an extension for the search term “kitty.”)Ĩ. Repeat this procedure with the search terms kitty and kitten, assigning the bookmark color red to kitty and the bookmark color yellow to kitten. Right-click each file in the results, point to Bookmark, and click Yellow. In the Enter Search Words text box, type craigslist, and then click Search in the right pane. Right-click each file in the results, point to Bookmark, and click Red.ħ. In the Enter Search Words text box, type project2400, and then click Search in the right pane. Click the Search Index button in the left pane. Indexing might take an hour or more, so make sure you allow enough time.Ħ. When OSForensics finishes indexing the image file, click OK in the message box. In the Step 3 of 5 window, type Index all file types in the Index Title text box, and then click Start Indexing.ĥ. In the Step 2 of 5 window, click the Add button, click charlie-.E01, click OK, and then click Next. In the Step 1 of 5 window, click the Use Pre-defined File Types option button, click all the file types listed, and then click Next. Click the Create Index button in the left pane. Click the Image File option button, and then browse to your work folder, click the charlie-.E01 image file, and click Open. Click Custom Location for the case folder, click the Browse button, navigate to and click your Work/C6Prj04 folder, and then click OK twice.ģ. In the New Case dialog box, enter your name for the investigator, type C6Prj04 for the case name, and click the Investigate Disk(s) from Another Machine option button for the acquisition type. Click Start in the left pane, if necessary, and in the right pane, click Create Case.Ģ. Next, you perform the same searches in OSForensics: Before starting this part of the project, create a subfolder of your work folder called C6Prj04.ġ. Click OK in the Export dialog box, and then click File, Print Report from the menu to print your report. Type Chap6-4-PD.rtf in the File name text box, and then click Save. In the Export dialog box, click the RTF Format option button, click Browse, and navigate to and double-click your work folder. In the tree view, click Report, and then click the Export toolbar button. Click the check box next to the one file that doesn’t have an extension, and then click Add to Report.Ĩ. In the Search 2 tab of the search results, click the Filter button, and then click kitty. Under Select the Disk(s)/Image(s) you want to search in, click the.
In the Search for the pattern(s) text box, type kitty and kitten on separate lines. In the Search dialog box, click the Content Search tab, if necessary. (Close the Add Comment dialog box, if it opens.) When you’re finished, click Add to Report.Ħ. Read the files, and then click the Selection button and click Select All. In the Search 1 tab of the search results, click the Filter button, and then 6 click project2400. In the Search for the pattern(s) text box, type project2400 on one line and craigslist on a second line. Search terms have been created for the M57 case. If necessary, click Yes in the ProDiscover message box that opens.Ĥ. Click to expand the image file, expand the C drive, and then click All Files. In the tree view, click to expand Content View and then Images. In the Open dialog box, navigate to your work folder, click charlie-.E01, and then click Open. In the tree view, click to expand Add, and then click Image File. (Note: If you get an error when starting a new project, exit ProDiscover and start it again.)Ģ.
In the New Project dialog box, type C6Prj04PD for the project number and project filename, and then click OK. To start your analysis, click the New Project toolbar button. Charlie’s hard drive file from the M57 Patents case (available at ) extracted to your work folder First, you use ProDiscover Basic to examine the file:ġ.OSForensics installed on your workstation.ProDiscover Basic installed on your workstation.To com- pare OSForensics and ProDiscover Basic, you need the following: Keep in mind that even though tools have different strengths, they should yield similar results. In this project, you test two competing digital forensics analysis tools to see how they compare in locating and recovering data.
PRODISCOVER BASIC SEARCHING FOR EMAILS SOFTWARE
When complex software applications are updated, they might create new problems and function failures the vendor wasn’t aware of. You should test new or updated digital forensics tools to make sure they’re per- forming correctly.
0 kommentar(er)
