In the Creating Case dialog box, click Add Host, and in the Add A New Host dialog box, enter your information, and click Add Host. In the Create A New Case dialog box, fill in your information (using GCFI-datacarve-FAT for the case name), and then click New Case. Start Sleuth Kit and Autopsy, as you did earlier in this chapter. Copy the converted file to a Linux or UNIX system with Sleuth Kit and Autopsy installed. In the Convert ProDiscover Image to ‘DD’ Image dialog box, click the Browse button, navigate to and click the location in your work folder where you saved GCFI-datacarve-FAT.eve, and then click OK. To convert the GCFI-datacarve-FAT.eve file to GCFI-datacarve-FAT.dd on a PC, click Tools, Image Conversion Tools from the menu and then click Convert ProDiscover Image to ‘DD’. Start ProDiscover Basic with the Run as administrator option. Instructions on using the computer forensics tools in this chapter and Chapters 2 and 4 Follow these steps: 1.Disk storage of at least 200 MB to convert the.
A Linux or UNIX system with Sleuth Kit and Autopsy installed.
LIST FEATURES OF PRODISCOVER BASIC PC
For this project, you convert the image file GCFI-datacarve-FAT.eve from Chapter 4 to a raw dd image by using ProDiscover Basic, and then analyze it with Sleuth Kit and Autopsy. You’re encouraged to work in teams for this project and share your findings with other students. The best way to learn a tool, especially one that isn’t well documented, is to explore its functions. (You might need to create this folder on your system before starting the projects it’s referred to as “your work folder” in steps.) The purpose of this project is to become more familiar with Sleuth Kit and Autopsy. This problem has been solved: Solutions for Chapter 8 Problem 4HOP: If necessary, extract all data files in the Chap08\Projects folder on the book’s DVD to the Work\Chap08\Projects folder on your system.
0 kommentar(er)
