Week 6 Practical Assignment
CVF 1065 Introduction to Computer Forensics & Investigations
FAT File System Case Practice Lab for FAT (100 Points)
CASE INFORMATION
You are a forensic examiner for a regional counter-terr
...
Week 6 Practical Assignment
CVF 1065 Introduction to Computer Forensics & Investigations
FAT File System Case Practice Lab for FAT (100 Points)
CASE INFORMATION
You are a forensic examiner for a regional counter-terrorism unit. An agent brings you a floppy disk they
seized during a search warrant earlier this morning at a residence belonging to a suspected Animal
Liberation Front member, Brian Hovan. When the agents entered the house, Brian was seen frantically
using his laptop and taking out a floppy disk from his disk drive and throwing it across the room into a
wall. Agents said he threw it so hard it almost broke, but still was intact. The screen that was up on the
laptop had a Windows Explorer up for the A: drive with several Shakespeare pictures and text files
visible. No other files were visible.
Agents told you that they have been receiving lots of “chatter” recently from informants in the Animal
Liberation Front about a major planned attack somewhere on the West Coast. Agents said the exact
location is still unknown but they feel the attack is imminent. You are requested to perform a forensic
examination on the seized disk and report all findings to the field agents.
NOTE: The image file "FATLAB1.img" is to be used for this exercise. FTK Imager should be used to
conduct the examination. This program is available on D2L. The answers to these questions should be
included below each question and this entire finished assignment submitted to the Chapter 6 drop box.
Make sure to put your name on your sheet!
File (Compressed) FATLAB1.zip 835dcc3faae9747a36ba922208d18c21
File (Decompressed) FATLAB1.dd b0c0ec6a34e747ab63a4eed50a8d460d
Instructions: Open the FATLAB1.img and confirm its MD5 hash: b0c0ec6a34e747ab63a4eed50a8d460d
and include a screen shot of your verification hash. The answer the following questions:
[Show More]