Summary C 840 Task 2 Forensic Lab Report Western Governors University

TASK 2 FORENSIC LAB REPORT 1




Task 2 Forensic Lab Report

Western Governors University




A – Process Used to Isolate Suspected Evidence

,TASK 2 FORENSIC LAB REPORT 2



When conducting a forensic examination on digital evidence, it is important to avoid

altering the actual evidence. (uCertify, 2018) Therefore, it is important to make a copy of the

suspected storage device and then perform the examination on the copy rather than on the

original evidence. (uCertify, 2018)

To begin this examination, I launched a program called “AccessData FTK Imager” which

is the program that I used to make a copy of the suspect drive. Once the program opened, I chose

the option “Create Disk Image” from the “file” menu and then chose the drive titled “G:\

LAPTOP” as the source drive (see figure 1.)




(figure 1)

After selecting the source drive, I set the image destination as the “H:\” drive. The image

type was set to “Raw – dd” and the image name was set to “image.” The image fragment size

was set to “0” which would prevent the image from fragmenting into several smaller files and

would instead make the image one single file. The option to use “AD Encryption” was also

deselected (see figure 2.)

, TASK 2 FORENSIC LAB REPORT 3




(figure 2)

After the proper options were selected, I began making a bit-by-bit image of the suspect

drive (see figure 3.) When the process was completed, I opened up the FTK-generated log file to

verify the MD5 checksum and the SHA1 checksum of the image to ensure that no data was

changed during the imaging process (see figure 4.)




(figure 3)