Homework 5 (10 points)

This assignment is designed to give you an opportunity to work with AccessData FTK to analyze forensic images and observe how hash values are changed when a filename or file is changed.

Assignment
• Chapter 4 Acquiring Evidence with OSForensics Exercises (Pages 168-172)
• Start by reading the section titled "Reviewing Background Information for a Case" on Page 168
• Use either the forensic computers in the lab, or the demo version of OSForensics included with your book to complete this part of the assignment.
• The four M57 evidence files are available for download here.
• Chapter 4 Hands-On Project 4-3 (Pages 177-178)
• Chapter 4 Hands-On Project 4-4 (Pages 178-179)
• Chapter 4 Hands-On Project 4-5 (Pages 179-180)

Assignment Deliverables
• Export and submit the log generated on page 172. Here are directions for exporting and saving the log. Feel free to email the log instead of printing it for submission.
• Submit a professional memo outlining your findings as directed at the end of Hands-On Project 4-3. It is also advisable to include an appendix of supporting files and evidentiary artifacts in addition to the memo.
• Submit a brief write-up (no more than 1 page) summarizing the results of Hands-on Projects 4-4 and 4-5 and the significance of those results relative to digital forensics.