Ccsi410Lab7

CCSI 410 Forensic Lab Report

1) Investigator’s Name:

2) Date of Investigation: 10/18/2013

3) Lab Number and Title: Lab 7 – File and Data Recovery

4) Summary of Findings:

I successfully logged into the lab and followed each of the steps required for completing the lab. I examined the floppy disk image and there appears to be enough evidentiary information to proceed with further investigation if needed and that the suspect has been blackmailing people. I proceeded to answer questions 1, 2, & 3 that were required and provided answers in section 6 of this report. All other information contained in the report is detailed below in the different sections.

5) Details of Investigation

Thursday – 10/17/2013

11:30 am - Logged into the lab session and logged into the forensic computer.

11:38 am - Reviewed the available drive letters available to me and noted: Drive C: the main drive for the forensic workstation, Drive E: suspect’s drive, Drive F: target drive, which already has the floppy1.img file that will be used for examination purposes.

11:50 am - Opened up the FTK program .

12:15 pm – Searching for evidentiary information related to blackmail.

12:40 pm – The program detected 3 items that appeared to be associated to a deleted file named letter.doc. The information contained within the letter.doc appeared to be related to a blackmail attempt on Mrs. Thomas. This was in relation for her to pay $10,000 or else her love letters would be given to her husband. The letter appeared to be signed by the “The Love Letter Bandit”.

1:10 pm – There was another file found named letter.txt which appeared to be related to someone having Mr. Travis’s cat. The demand was for $2,000.00 and the cat would be returned. This letter.txt was signed by “The Cat Napper”.

1:28 pm – The files both were having the victim meet them under a bridge at midnight.

1:36 pm – The files that were found and to be of...