Obtaining a Digital Hash using FTK imager PROVIDE SCREEN SHOT PLEZ

In this task, you create a file on your USB drive and calculate its hash values in FTK Imager Lite. Then you change the filename and extension and calculate the hash values again to compare them. You need a Windows computer and a USB drive.

1. Create a folder on your USB drive, and then start Notepad. 2. In a new text file, type This project shows that the file, not the filename, has to change for the hash value to change. 3. Click File, Save As from the menu, and save the file in yourfolder.txt on your USB drive. 4. Exit Notepad, and start FTK Imager Lite (clicking OK or Yes in the UAC message box, if necessary). 5. Click File, Add Evidence Item from the menu. In the Select Source dialog box, click the Logical Drive option button, and then click Next. 6. In the Select Drive dialog box, click the Source Drive Selection list arrow, click to select your USB drive, and then click Finish. 7. In the upper-left pane, click to expand your USB drive and continue expanding until you can click your folder. In the upper-right pane, you should see your file you created. 8. Right-click the file and click Export File Hash List. Save the file as original hash value in your folder on your USB drive. FTK Imager Lite saves it as a .csv file. 9. Click to select your USB drive in the upper-left pane, if necessary, and then click File, Remove Evidence Item from the menu. Exit FTK Imager Lite. 10. Open File Explorer. Right-click your file on your USB drive, and rename it as yourfile.doc. In the warning message about the change in extension, click Yes. 11. Start FTK Imager Lite. Follow Steps 4 to 8, but this time when you export the file hash list, save the file as changed hash value. Exit FTK Imager Lite. 12. Open original hash value and changed hash value in Excel or another spreadsheet program. Compare the hash values in both files to see whether theyre different, and then exit Excel.