DO THIS FIRST:

Use the files below to save to your desktop FIRST - save these files into a folder named C1Prj01.E01

Josh's Bank Docs.pd Download Josh's Bank Docs.pdfKim's Private Docs.pdf Download Kim's Private Docs.pdf

The case in this project involves a suspicious death. Joshua Zarkan found his girlfriends dead body in her apartment and reported it. The first responding law enforcement officer seized a USB drive. A crime scene evidence technician skilled in data acquisition made an image of the USB drive with FTK Imager and named it C1Prj01.E01. Following the acquisition, the technician transported and secured the USB drive and placed it in a secure evidence locker at the police station. You have received the image file from the detective assigned to this case. He directs you to examine it and identify any evidentiary artifacts that might relate to this case. To process this case, follow these steps to evaluate whats on the image of the USB drive:

1. Start Autopsy for Windows, and click the Create New Case icon. In the New Case Information window, enter C1Prj01 in the Case Name text box, and click Browse next to the Base Directory text box. Navigate to and click your work folder, and then click Next.

2. In the Additional Information window, type C1Prj01 in the Case Number text box and your name in the Examiner text box, and then click Finish.

3. In the Select Data Source window, click the Select data source type list arrow, and click Disk Image or VM file. Click the Browse button next to the Browse for an image file text box, navigate to and click your work folder and the C1Prj01.E01 file, and then click Open. Click Next.

4. In the Configure Ingest Modules window, click Select All. Click Next and then Finish.

5. In the Tree Viewer pane, expand Views, File Types, By Extension, and Documents.

6. Examine each subfolder under Documents. Determine which folder might contain files of interest to this case.

7. If you found any files related to the case, select the files as a group, right-click the selection, and click Extract File(s). In the Save dialog box, click Save to save the files automatically in Autopsys case subfolder: Work\Chap01\Projects\C1Prj01\Export.

8. Write a short report, no more than a few sentences, including facts from any contents you found. When youre finished, close out Autopsy.

PreviousNext