Lab 2 - Assessment Worksheet and Lab Report

Documenting a Workstation Configuration using Common Forensic Tools

Part 1. Lab Assessment Questions

1. What is the main purpose of a software tool like WinAudit in computer forensics?

2. Which item(s) generated by WinAudit would be of critical importance in a computer forensic investigation?

3. Could you run WinAudit from a flash drive or any other external media? If so, why is this important during a computer forensic investigation?

4. Why would you use a tool like DevManView while performing a computer forensic investigation?

5. Which item(s) available from DevManView would be of critical importance in a computer forensic investigation?

6. What tool similar to DevManView is already present in Microsoft Windows systems?

7. Why would someone use a Hex editor during a forensic investigation?

8. What clue in the Frhed examination of challenge.123 led you to the correct extension for that file?

9. Describe the contents of the target.jpg file, and the application in which it opens.

10. Why do you need to keep evidence unaltered?

Provide the following additional information:

record the number of connected devices identified by DevManView

record the total number of devices identified by DevManView