follow the forensic steps | Homework Essay Helpers

I’m working on a Law exercise and need support.

Don't use plagiarized sources. Get Your Custom Essay on
follow the forensic steps | Homework Essay Helpers
Get an essay WRITTEN FOR YOU, Plagiarism free, and by an EXPERT!
Order Essay

Click on the hyperlink (a duplicate copy of the file can be found in the Chapter Four course materials). In this assignment we will analyze information found within the Enron FTK forensic report utilizing a forensic tool called “AccessData FTK Forensic Toolkit” to search and store searches in a litigation case.

For this project, you will compare the information in a computer forensics report with the information you reviewed in the chapter two lecture notes relating to metadata. As you may recall, Metadata, is literally “data about data” (the history of a document written with invisible ink) and is usually expressed as attributes. Attributes are data about data, in context to the data itself. Metadata is not a separate piece of data, but rather embedded or “attached” to the piece of data in which it was retrieved from.

Prior to starting the assignment, be sure to copy the contents of the EnronFTKReport file onto your desktop.

1. Using a Windows machine and Internet Explorer as your default browser open the sample report generated from the Forensic Toolkit, extract the contents of the Enron FTK Report into a folder entitled” Hands-On Project C4L3”. Navigate to and double-click the ’index.html’ file to open it.


2. Navigate through the links in the navigation pane on the left and review the information briefly. Now, in the Bookmarks section, click the ‘Money_ASCII_Search’ link to see this part of the report, which describes each document found during the search for “money”. The first document you should see is files[Fwd_Social Security].html.


Each Bookmark file includes the path where it was located, its size, dates the file was created, modified, and accessed, and other OS information. Since our PST is no longer on the host OS network, our dates aren’t available in this example. However, in the path line, you can see that the document comes from the Notes inbox folder of Ken Lay’s PST file.

This file shows you what an FTK computer forensics report looks like, using the Enron PST as an example.

3. Scroll down to the 03-06-01 minutes.doc file, and read information in this part of the report. At the bottom of the document description, right-click the files3-06-01.minutes.doc link and click ‘Open in new window’. In the Opening dialog box, click the ‘Open’ option button (which should indicate opening the file with Microsoft Word by default), and then click ‘OK’. Using the F5 (or Find) key or other methods, search this document for the word “money”. Note how long it takes to find all occurrences.

FTK inserts a unique identifying number inside brackets in the filename, as in 03-05-01 minutes [1572].doc so that duplicate files aren’t overwritten.

4. Close the Internet Explorer window. Right-click files3-06-01.minutes.doc and click ‘Save target as’. Save the file in your working directory, and minimize the FTK Report window. In Windows Explorer, open the file. In Word, click ‘File’, ‘Info’, and then click the ‘Properties’ list arrow in the right pane. In the drop-down list, click ‘Advanced Properties’. Review the information in the General and Statistics tabs. Figure 4.3 shows both tab and their relationship to the application Word, OS and hard drive metadata.


Figure 4.4 shows the hidden streams and objects that are linked and embedded called “object linking and embedding [OLE]” in this file, focusing on the ‘Summary Information’ stream. Streams and objects contain code used as an interface between the application (in this case, Word) and the OS, this OLE information remains in the document from the original computer. Files containing streams and objects, such as Word files, are called “compound (COM) files” or “structured storage”.


5. Close the Properties dialog box and the 03-06-01.minutes.doc file. If prompted to save the changes, click ‘No’. Maximize the FTK Report window. Continue to explore the FTK report to see what information is available. Because forensics examiners use the FTK tool, you’ll find many types of information. Remember that numerous items were found in the “money” search, so clicking every link to review each item separately usually isn’t practical. Importing these items from the report into a litigation database such as iPro, Summation, Relativity, Concordance, etc., is often better for further review..

An FTK report is like a typical Web page, so several supporting files are generated in the EnronFTKReport folder. Close the FTK report. Now browse to and click the files folder to open it. Sort the documents by clicking the ‘Type’ column heading. If the Type heading isn’t showing, right click the column and click ‘Type’.

6. Copy one of the Word files in the files folder to a new location on your computer. Open the document you’ve selected. Click ‘File’, ‘Info’, and then click the ‘Properties’ list arrow in the right pane. In the drop-down list, click ‘Advanced Properties’. See whether any information in the Statistics or General tabs has changed, notate this information and then close the Properties dialog box.

7. Next, remove the read-only lock on the document by clicking, ‘File’, ‘Info’, if necessary. Click the ‘Properties’ list arrow in the right pane. In the drop-down list, click ‘Advanced Properties’. In the ‘General’ tab of the Properties dialog box, click to clear the ‘Read only’ check box. Now try different ways of moving files on your computer (such dragging and right-clicking) and to a flash drive to see whether any metadata changes. Finally, try changing one letter in the Word document, save it, reopen it and check the ‘General’ and ‘Statistics’ tabs in Properties dialog box again.

These actions make you aware of how easily metadata changes in documents. Pay particular attention to the creation date. At some point, it should be newer than the other dates shown, which indicates the file could have been created on another computer and moved later. This information can be important in a criminal case and perhaps in a civil case. When embedded file metadata is available, comparing it with OS metadata in key case documents can reveal useful activity indicators.

8. After modifying the (Greater Houston Partnership BOD) Word document, save and send the document to me, using the following naming convention to name your document: first name, last name – C4L3 Hands-On Projects.doc.

Don’t forget to include your findings for questions 3 & 6 along with your modified Word document.

Calculate your paper price
Pages (550 words)
Approximate price: -

Why Choose Us

Top quality papers

We always make sure that writers follow all your instructions precisely. You can choose your academic level: high school, college/university or professional, and we will assign a writer who has a respective degree.

Professional academic writers

We have hired a team of professional writers experienced in academic and business writing. Most of them are native speakers and PhD holders able to take care of any assignment you need help with.

Free revisions

If you feel that we missed something, send the order for a free revision. You will have 10 days to send the order for revision after you receive the final paper. You can either do it on your own after signing in to your personal account or by contacting our support.

On-time delivery

All papers are always delivered on time. In case we need more time to master your paper, we may contact you regarding the deadline extension. In case you cannot provide us with more time, a 100% refund is guaranteed.

Original & confidential

We use several checkers to make sure that all papers you receive are plagiarism-free. Our editors carefully go through all in-text citations. We also promise full confidentiality in all our services.

24/7 Customer Support

Our support agents are available 24 hours a day 7 days a week and committed to providing you with the best customer experience. Get in touch whenever you need any assistance.

Try it now!

Calculate the price of your order

Total price:

How it works?

Follow these simple steps to get your paper done

Place your order

Fill in the order form and provide all details of your assignment.

Proceed with the payment

Choose the payment system that suits you most.

Receive the final file

Once your paper is ready, we will email it to you.

Our Services

No need to work on your paper at night. Sleep tight, we will cover your back. We offer all kinds of writing services.


Essay Writing Service

You are welcome to choose your academic level and the type of your paper. Our academic experts will gladly help you with essays, case studies, research papers and other assignments.


Admission help & business writing

You can be positive that we will be here 24/7 to help you get accepted to the Master’s program at the TOP-universities or help you get a well-paid position.


Editing your paper

Our academic writers and editors will help you submit a well-structured and organized paper just on time. We will ensure that your final paper is of the highest quality and absolutely free of mistakes.


Revising your paper

Our academic writers and editors will help you with unlimited number of revisions in case you need any customization of your academic papers