The case in this project involves a suspicious death. Joshua Zarkan found his girlfriend’s dead body in her apartment and reported it. The first responding law enforcement officer seized a USB drive. A crime scene evidence technician skilled in data acquisition made an image of the USB drive with ProDiscover and named it C2Prj01.eve. Following the acquisition, the technician transported and secured the USB drive and placed it in a secure evidence locker at the police station. You have received the image file from the detective assigned to this case. He directs you to examine it and identify any evidentiary artifacts that might relate to this case. To process this case, follow these steps to evaluate what’s on the image of the USB drive:

 

1. Start ProDiscover Basic. (If you’re using Windows Vista, right-click the ProDiscover desktop icon and click Run as administrator.)

2. In the Launch Dialog dialog box, click the New Project tab, if necessary. Enter a project number. If your company doesn’t have a standard numbering scheme, you can use the date followed by the number representing the case that day in sequence, such as 20090129_1.

3. Enter C2Prj01 as the project name, enter a brief description of the case, and then click Open.

4. To add an image file, click Action from the menu, point to Add, and click Image File.

5. Navigate to your work folder, click C2Prj01.eve, and then click Open. If the Auto Image Checksum message box opens, click Yes.

6. In the tree view, click to expand Content View. Click to expand Images, and then click the pathname containing the image file. In the work area, notice the files that are listed.

7. Right-click any file and click View to start the associated program, such as Word or Excel. View the file, and then exit the program.

8. If you decide to export a file, right-click the file and click Copy File. (Note: Creating a separate folder for exports is a good idea to keep your files 62 Chapter 2 2 organized.) In the Save As dialog box that opens, navigate to the location where you want to save the file, and then click Save.

9. To save the project to view later, click File, Save Project from the menu. The default project name is the one you entered in Step 3. Select the drive and folder (Work\Chap02\Projects, for example), and then click Save. After you have finished examining the files, exit ProDiscover Basic and save the project again, if prompted. You need to export any files in this image and present them to the investigator. In addition, write a brief report (no more than two paragraphs) including any facts from the contents of the recovered data.