follow the forensic steps | Online Homework Aiders

I’m working on a Law exercise and need support.

Click on the EnronFTKReport.zip hyperlink (a duplicate copy of the file can be found in the Chapter Four course materials). In this assignment we will analyze information found within the Enron FTK forensic report utilizing a forensic tool called “AccessData FTK Forensic Toolkit” to search and store searches in a litigation case.

For this project, you will compare the information in a computer forensics report with the information you reviewed in the chapter two lecture notes relating to metadata. As you may recall, Metadata, is literally “data about data” (the history of a document written with invisible ink) and is usually expressed as attributes. Attributes are data about data, in context to the data itself. Metadata is not a separate piece of data, but rather embedded or “attached” to the piece of data in which it was retrieved from.

Prior to starting the assignment, be sure to copy the contents of the EnronFTKReport file onto your desktop.

1. Using a Windows machine and Internet Explorer as your default browser open the sample report generated from the Forensic Toolkit, extract the contents of the Enron FTK Report into a folder entitled” Hands-On Project C4L3”. Navigate to and double-click the ’index.html’ file to open it.

2. Navigate through the links in the navigation pane on the left and review the information briefly. Now, in the Bookmarks section, click the ‘Money_ASCII_Search’ link to see this part of the report, which describes each document found during the search for “money”. The first document you should see is files[Fwd_Social Security].html.

Each Bookmark file includes the path where it was located, its size, dates the file was created, modified, and accessed, and other OS information. Since our PST is no longer on the host OS network, our dates aren’t available in this example. However, in the path line, you can see that the document comes from the Notes inbox folder of Ken Lay’s PST file.

This file shows you what an FTK computer forensics report looks like, using the Enron PST as an example.

3. Scroll down to the 03-06-01 minutes.doc file, and read information in this part of the report. At the bottom of the document description, right-click the files3-06-01.minutes.doc link and click ‘Open in new window’. In the Opening dialog box, click the ‘Open’ option button (which should indicate opening the file with Microsoft Word by default), and then click ‘OK’. Using the F5 (or Find) key or other methods, search this document for the word “money”. Note how long it takes to find all occurrences.

FTK inserts a unique identifying number inside brackets in the filename, as in 03-05-01 minutes [1572].doc so that duplicate files aren’t overwritten.

4. Close the Internet Explorer window. Right-click files3-06-01.minutes.doc and click ‘Save target as’. Save the file in your working directory, and minimize the FTK Report window. In Windows Explorer, open the file. In Word, click ‘File’, ‘Info’, and then click the ‘Properties’ list arrow in the right pane. In the drop-down list, click ‘Advanced Properties’. Review the information in the General and Statistics tabs. Figure 4.3 shows both tab and their relationship to the application Word, OS and hard drive metadata.

Figure 4.4 shows the hidden streams and objects that are linked and embedded called “object linking and embedding [OLE]” in this file, focusing on the ‘Summary Information’ stream. Streams and objects contain code used as an interface between the application (in this case, Word) and the OS, this OLE information remains in the document from the original computer. Files containing streams and objects, such as Word files, are called “compound (COM) files” or “structured storage”.

5. Close the Properties dialog box and the 03-06-01.minutes.doc file. If prompted to save the changes, click ‘No’. Maximize the FTK Report window. Continue to explore the FTK report to see what information is available. Because forensics examiners use the FTK tool, you’ll find many types of information. Remember that numerous items were found in the “money” search, so clicking every link to review each item separately usually isn’t practical. Importing these items from the report into a litigation database such as iPro, Summation, Relativity, Concordance, etc., is often better for further review..

An FTK report is like a typical Web page, so several supporting files are generated in the EnronFTKReport folder. Close the FTK report. Now browse to and click the files folder to open it. Sort the documents by clicking the ‘Type’ column heading. If the Type heading isn’t showing, right click the column and click ‘Type’.

6. Copy one of the Word files in the files folder to a new location on your computer. Open the document you’ve selected. Click ‘File’, ‘Info’, and then click the ‘Properties’ list arrow in the right pane. In the drop-down list, click ‘Advanced Properties’. See whether any information in the Statistics or General tabs has changed, notate this information and then close the Properties dialog box.

7. Next, remove the read-only lock on the document by clicking, ‘File’, ‘Info’, if necessary. Click the ‘Properties’ list arrow in the right pane. In the drop-down list, click ‘Advanced Properties’. In the ‘General’ tab of the Properties dialog box, click to clear the ‘Read only’ check box. Now try different ways of moving files on your computer (such dragging and right-clicking) and to a flash drive to see whether any metadata changes. Finally, try changing one letter in the Word document, save it, reopen it and check the ‘General’ and ‘Statistics’ tabs in Properties dialog box again.

These actions make you aware of how easily metadata changes in documents. Pay particular attention to the creation date. At some point, it should be newer than the other dates shown, which indicates the file could have been created on another computer and moved later. This information can be important in a criminal case and perhaps in a civil case. When embedded file metadata is available, comparing it with OS metadata in key case documents can reveal useful activity indicators.

8. After modifying the (Greater Houston Partnership BOD) Word document, save and send the document to me, using the following naming convention to name your document: first name, last name – C4L3 Hands-On Projects.doc.

Don’t forget to include your findings for questions 3 & 6 along with your modified Word document.