Click the Move Up button until Modified Date is immediately under File Extension, and then click OK. In the right pane of the Field Chooser dialog box, scroll down and click Modified Date. In the work area, right-click any column header, such as Select or File Name, and then click Field Chooser. If necessary, click Yes in the ProDiscover message box that opens. In the tree view, click to expand Content View and then Images. In the Open dialog box, navigate to your work folder, click gcfi-datacarve-ntfs.dd, and then click Open. In the tree view, click to expand Add and then click Image File. In the New Project dialog box, type C7Prj05PD for the project number and project filename, and then click OK (Note: If you get an error when starting a new project, exit ProDiscover and start it again.) 4. To start your analysis, click the New Project toolbar button. Navigate to your work folder and click GCFI-datacarve-NTFS.eve. In the Convert ProDiscover Image to “DD” Image dialog box, click Browse next to the Source ProDiscover Image text box. Start ProDiscover Basic, click Tools from the menu, point to Image Conversion Tools, and then click Convert ProDiscover Image to “DD”. The GCFI-datacarve-NTFS.eve file you extracted to your work folder In the following steps, you use ProDiscover to convert the image file to raw (.dd) format and then analyze the two images: 1.
ProDiscover Basic installed on your workstation.To prepare for this project, testing FTK against ProDiscover Basic, you need the following: Developing a good sample test image takes experience in knowing what to look for on a suspect drive. You should know the contents of these drive images so that you can determine how efficient the tools are at locating data. To test these tools, you need one or more controlled sample drive images. In this project, you test two competing computer forensics analysis tools to see how they compare in locating and recovering data. When complex software applications are updated, they might create new problems and function failures the vendor wasn’t aware of. This problem has been solved: Solutions for Chapter 7 Problem 5HOP: You should test new or updated computer forensics tools to make sure they’re performing correctly.
0 kommentar(er)
