In this project, you make a ProDiscover image file of the data load in HandsOn Project 4-1. To prepare, you need to do the following:

• Make sure you have the suspect drive containing the data load from Hands-On Project 4-1.

• Use a hardware write-blocker or the USB write-protection Registry method for the suspect drive.

• Review the steps in “Using ProDiscover’s Raw Acquisition Format” for creating an image file.

• Verify that you have enough free space on your computer’s internal drive to receive the image file (about 120 MB). To make this acquisition on a USB or FireWire drive using the USB writeprotection Registry method, follow these steps:

1. Turn on your acquisition workstation, if necessary.

2. Double-click the Write Protect USB ON icon on your desktop to protect the suspect drive. If necessary, click Yes and then OK in the two confirmation dialog boxes that follow.

3. Connect the suspect drive to the USB or FireWire cable, and then connect the cable to your acquisition workstation.

4. Start ProDiscover Basic. Follow the steps in this chapter for making a raw format acquisition in ProDiscover, making sure you click UNIX style dd in the Image Format drop-down list box. Then click OK in the Capture Image dialog box.

5. When the acquisition is finished, exit ProDiscover. Dismount the USB or FireWire device, remove the suspect drive, and secure it as evidence.

6. Next, click the Write Protect USB OFF icon on your desktop, and then shut down the acquisition workstation. To make this acquisition on an internally connected drive, follow these steps:

1. Use a write-blocking hardware device to protect the suspect drive.

2. Turn on your acquisition workstation.

3. Start ProDiscover. Follow the steps in this chapter for making a raw format acquisition, making sure you click UNIX style dd in the Image Format drop-down list box. Then click OK in the Capture Image dialog box.

4. When the acquisition is finished, exit ProDiscover. Shut down the acquisition workstation, remove the suspect drive, and secure it as evidence.

Hands-On Project 4-1

In this project, you learn how to restore an image file to a drive. Subsequent projects in this book require using these steps. To prepare for this project, you need the following items:

• A USB or FireWire drive that can hold up to 100 MB or a secondary internally connected drive

• ProDiscover Basic installed on your workstation

• The GCFI-datacarve-FAT.eve data file extracted from Chap04\Projects on the book’s DVD The first task is to transfer data from the GCFI-datacarve-FAT.eve file to the target drive. Follow these steps:

1. Boot your acquisition workstation.

2. Connect a hot-swappable media storage device to receive the data, such as a 100+ MB USB drive, a FireWire drive, or an internally connected drive. This device is referred to as the target drive.

3. Start ProDiscover Basic, and in the main window, click Tools, Copy Disk from the menu.

4. In the Copy source disk or image to destination disk dialog box, click the Image to Disk tab.

5. Click Browse next to the Image File text box, and navigate to the location where you copied this chapter’s data files (Work\Chap04\Projects). Click the GCFI-datacarve- FAT.eve file, and then click Open.

6. In the Copy source disk or image to destination disk dialog box, click in the space under the Disk Name column at the bottom, as shown in Figure 4-15.

7. Click the Disk Name list arrow, click the target drive, and then click OK.

8. In the Copy dialog box that opens, click the Write All 0’s option button (see Figure 4-16), and then click OK to start the data loading.

9. Click OK in the completion dialog box to terminate the loading.

10. Exit ProDiscover Basic, shut down your acquisition workstation, and remove the target drive.

Alpha Geek

(8)

Status NEW Posted 08 May 2017 10:05 AM My Price 7.00

-----------

Attachments

file 1494238204-Answer.docx preview (724 words )

I-----------n t-----------his----------- pr-----------oje-----------ct,----------- yo-----------u m-----------ake----------- a -----------Pro-----------Dis-----------cov-----------er -----------ima-----------ge -----------fil-----------e o-----------f t-----------he -----------dat-----------a l-----------oad----------- in----------- Ha-----------nds-----------On -----------Pro-----------jec-----------t 4------------1.----------- To----------- pr-----------epa-----------re,----------- yo-----------u n-----------eed----------- to----------- do----------- th-----------e f-----------oll-----------owi-----------ng:----------- �-----------�� -----------Mak-----------e s-----------ure----------- yo-----------u h-----------ave----------- th-----------e s-----------usp-----------ect----------- dr-----------ive----------- co-----------nta-----------ini-----------ng -----------the----------- da-----------ta -----------loa-----------d f-----------rom----------- Ha-----------nds------------On----------- Pr-----------oje-----------ct -----------4-1-----------. -----------•----------- Us-----------e a----------- ha-----------rdw-----------are----------- wr-----------ite------------bl-----------ock-----------er -----------or -----------the----------- US-----------B w-----------rit-----------e-p-----------rot-----------ect-----------ion----------- Re-----------gis-----------try----------- me-----------tho-----------d f-----------or -----------the----------- su-----------spe-----------ct -----------dri-----------ve.----------- �-----------�� -----------Rev-----------iew----------- th-----------e s-----------tep-----------s i-----------n �-----------��U-----------sin-----------g P-----------roD-----------isc-----------ove-----------r�-----------�s -----------Raw----------- Ac-----------qui-----------sit-----------ion----------- Fo-----------rma-----------t�-----------� f-----------or -----------cre-----------ati-----------ng -----------an -----------ima-----------ge -----------fil-----------e.

Not Rated(0)

• Buy Answer