Exercises

Takeallscreenshotsoftheprocessyoutaketogettheresults.

UploadyourreportinPDF.

1.Downloadimagefilesfrombelowlinksandunzipthem.(samefileswe

downloadedforPractice3)

https://cfreds-archive.nist.gov/FileCarving/Images/L0_Graphic.dd.bz2

https://cfreds-archive.nist.gov/FileCarving/Images/L2_Graphic.dd.bz2

(Extract.bz2using7-zip)

2.DownloadandinstallAutopsyprogramfromhttps://www.autopsy.com/download/

onyourcomputer

Shortanswersarenotacceptable.Screenshotsofyourstepsmustbeattached.

ImporttwoddimagefilestoAutopsyas'unallocatedspacediskimage'andconfigure

‘Runingestmoduleson:AllFiles,Directories,andUnallocatedSpace’with

‘PhotoRecCarver’enabled.

a)Listallcarvedfilesfromeachddimagefile.

b)Chooseacarvedfilefrombothddimagesthathasthesameextensionandfilesize.

c)ShowtheheadervalueindicatingfilesizeinHex.Showitssizeindecimalusinga

converter.

d)Doyouthinkwhetherthese2filesareoriginallythesameornot?Why?