$1.$ Copy the GCFIi$-$datacarve$-$FAT.dd file to your Linux virtual machine with Sleuth Kit and

Autopsy installed. Start Sleuth Kit and Autopsy. In the main window, click New Case. In

the Create a New Case dialog box, fill in your information $($using GCFI$-$ datacarve$-$FAT for

the case name$),$ and then click New Case.

$2.$ In the Creating Case dialog box, click Add Host, and in the Add a New Host dialog

box, enter your information, and click Add Host.

$3.$ In the Adding host dialog box, click Add Image to continue. In the Open Image dialog box,

click Add Image File. In the Add a New Image dialog box, type the full pathname and the

GCFIi$-$datacarve$-$FAT.dd image filename in the Location text box, click the Partition option

button, click the Copy option button for the import method, and then click Next.

$4.$ In the Image File Details section, click Add, and in the Testing partitions dialog box, click

OK$.$ In the $$Select a volume to analyze or add a new image file$$ dialog box, click the

Analyze button.

$5.$ In the Analysis dialog box, click File Analysis, and then click Generate MD$5$ List of

Files. In the MD$5$ results window, save the list as GCFIi$-$datacarve$-$FAT$-$MD$5.$txt in

your work folder, and close the MD$5$ results window.

$6.$ Next, in the Analysis dialog box, click File Type, click Sort Files by Type, and then click

OK$.$ When the analysis is finished, print the Results Summary frame of the Web page.

$7.$ Click Image Details, and in the General File System Details dialog box, print the

frame containing the results