Im working on a Law exercise and need support.
Click on the EnronFTKReport.zip hyperlink (a duplicate copy of the file can be found in the Chapter Four course materials). In this assignment we will analyze information found within the Enron FTK forensic report utilizing a forensic tool called AccessData FTK Forensic Toolkit to search and store searches in a litigation case.
For this project, you will compare the information in a computer forensics report with the information you reviewed in the chapter two lecture notes relating to metadata. As you may recall, Metadata, is literally data about data (the history of a document written with invisible ink) and is usually expressed as attributes. Attributes are data about data, in context to the data itself. Metadata is not a separate piece of data, but rather embedded or attached to the piece of data in which it was retrieved from.
Prior to starting the assignment, be sure to copy the contents of the EnronFTKReport file onto your desktop.
1. Using a Windows machine and Internet Explorer as your default browser open the sample report generated from the Forensic Toolkit, extract the contents of the Enron FTK Report into a folder entitled Hands-On Project C4L3. Navigate to and double-click the index.html file to open it.
2. Navigate through the links in the navigation pane on the left and review the information briefly. Now, in the Bookmarks section, click the Money_ASCII_Search link to see this part of the report, which describes each document found during the search for money. The first document you should see is files[Fwd_Social Security].html.
Each Bookmark file includes the path where it was located, its size, dates the file was created, modified, and accessed, and other OS information. Since our PST is no longer on the host OS network, our dates arent available in this example. However, in the path line, you can see that the document comes from the Notes inbox folder of Ken Lays PST file.
This file shows you what an FTK computer forensics report looks like, using the Enron PST as an example.
3. Scroll down to the 03-06-01 minutes.doc file, and read information in this part of the report. At the bottom of the document description, right-click the files 3-06-01.minutes.doc link and click Open in new window. In the Opening dialog box, click the Open option button (which should indicate opening the file with Microsoft Word by default), and then click OK. Using the F5 (or Find) key or other methods, search this document for the word money. Note how long it takes to find all occurrences.
FTK inserts a unique identifying number inside brackets in the filename, as in 03-05-01 minutes .doc so that duplicate files arent overwritten.
4. Close the Internet Explorer window. Right-click files 3-06-01.minutes.doc and click Save target as. Save the file in your working directory, and minimize the FTK Report window. In Windows Explorer, open the file. In Word, click File, Info, and then click the Properties list arrow in the right pane. In the drop-down list, click Advanced Properties. Review the information in the General and Statistics tabs. Figure 4.3 shows both tab and their relationship to the application Word, OS and hard drive metadata.
Figure 4.4 shows the hidden streams and objects that are linked and embedded called object linking and embedding [OLE] in this file, focusing on the Summary Information stream. Streams and objects contain code used as an interface between the application (in this case, Word) and the OS, this OLE information remains in the document from the original computer. Files containing streams and objects, such as Word files, are called compound (COM) files or structured storage.
5. Close the Properties dialog box and the 03-06-01.minutes.doc file. If prompted to save the changes, click No. Maximize the FTK Report window. Continue to explore the FTK report to see what information is available. Because forensics examiners use the FTK tool, youll find many types of information. Remember that numerous items were found in the money search, so clicking every link to review each item separately usually isnt practical. Importing these items from the report into a litigation database such as iPro, Summation, Relativity, Concordance, etc., is often better for further review..
An FTK report is like a typical Web page, so several supporting files are generated in the EnronFTKReport folder. Close the FTK report. Now browse to and click the files folder to open it. Sort the documents by clicking the Type column heading. If the Type heading isnt showing, right click the column and click Type.
6. Copy one of the Word files in the files folder to a new location on your computer. Open the document youve selected. Click File, Info, and then click the Properties list arrow in the right pane. In the drop-down list, click Advanced Properties. See whether any information in the Statistics or General tabs has changed, notate this information and then close the Properties dialog box.
7. Next, remove the read-only lock on the document by clicking, File, Info, if necessary. Click the Properties list arrow in the right pane. In the drop-down list, click Advanced Properties. In the General tab of the Properties dialog box, click to clear the Read only check box. Now try different ways of moving files on your computer (such dragging and right-clicking) and to a flash drive to see whether any metadata changes. Finally, try changing one letter in the Word document, save it, reopen it and check the General and Statistics tabs in Properties dialog box again.
These actions make you aware of how easily metadata changes in documents. Pay particular attention to the creation date. At some point, it should be newer than the other dates shown, which indicates the file could have been created on another computer and moved later. This information can be important in a criminal case and perhaps in a civil case. When embedded file metadata is available, comparing it with OS metadata in key case documents can reveal useful activity indicators.
8. After modifying the (Greater Houston Partnership BOD) Word document, save and send the document to me, using the following naming convention to name your document: first name, last name – C4L3 Hands-On Projects.doc.
Dont forget to include your findings for questions 3 & 6 along with your modified Word document.
Why Choose Us
Top quality papers
We always make sure that writers follow all your instructions precisely. You can choose your academic level: high school, college/university or professional, and we will assign a writer who has a respective degree.
Professional academic writers
We have hired a team of professional writers experienced in academic and business writing. Most of them are native speakers and PhD holders able to take care of any assignment you need help with.
If you feel that we missed something, send the order for a free revision. You will have 10 days to send the order for revision after you receive the final paper. You can either do it on your own after signing in to your personal account or by contacting our support.
All papers are always delivered on time. In case we need more time to master your paper, we may contact you regarding the deadline extension. In case you cannot provide us with more time, a 100% refund is guaranteed.
Original & confidential
We use several checkers to make sure that all papers you receive are plagiarism-free. Our editors carefully go through all in-text citations. We also promise full confidentiality in all our services.
24/7 Customer Support
Our support agents are available 24 hours a day 7 days a week and committed to providing you with the best customer experience. Get in touch whenever you need any assistance.
Try it now!
How it works?
Follow these simple steps to get your paper done
Place your order
Fill in the order form and provide all details of your assignment.
Proceed with the payment
Choose the payment system that suits you most.
Receive the final file
Once your paper is ready, we will email it to you.
No need to work on your paper at night. Sleep tight, we will cover your back. We offer all kinds of writing services.
You are welcome to choose your academic level and the type of your paper. Our academic experts will gladly help you with essays, case studies, research papers and other assignments.
Admission help & business writing
You can be positive that we will be here 24/7 to help you get accepted to the Master’s program at the TOP-universities or help you get a well-paid position.
Editing your paper
Our academic writers and editors will help you submit a well-structured and organized paper just on time. We will ensure that your final paper is of the highest quality and absolutely free of mistakes.
Revising your paper
Our academic writers and editors will help you with unlimited number of revisions in case you need any customization of your academic papers