W8 Mon 17092018

Live search is more through and takes longer than index search. Data hiding using bit shifting.

 

Workshop 8

5.            Click the first file within the listing and press Ctrl + A to select all the files in the Table tab. Right-click on any of the files, and then Left-click on “Extract File(s)”. The NTFS file system in Windows has a built-in EXIF viewer. The use this tool, simply navigate to the folder where you exported the files, Right-click any graphics file and click Properties. Click the Details tab to see EXIF data.

a.            How many different camera models were used within the evidence?

-              Two, CYBERSHOT and HDR-SR10.

b.            What was the file system of the jo-favorites-usb-2009-12-11.E01 image?

-              FAT32.

c.             How many deleted files did Autopsy identify in total?

-              64.

d.            How many meaningful/useful email addresses were discovered by Autopsy?

-              0.

 

14.          Click the Videos folder in the File System Browser to view the video files. A file containing the ._ symbol indicate file attributes rather than the actual file. Use the opportunity to explore the functionality of OSForensics. Using the knowledge you gained from the previous steps, repeat the steps to enable you to answer the following questions.

a.            What purpose would segregating and adding individual items under case specific headings serve?

b.            What date was the first video created on?

-              18/11/2009

c.             How many QuickTime videos were recovered from the USB image?

-              2

d.            How many hash generator options does OSForensics support?

-              4

e.            What is the SHA-1 hash value for the MontereyKittyHQ.m4v file?

-              a42c5cfe9b28fb372b3158c8a60e4327a68fbef8