Normal 0 false false false EN-US X-NONE X-NONE /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes;

How to get started:

1. Review Lecture 5 – report writing guidelines

2. Review the assignment and expectations

3. Make sure FTK and Imager (the versions that are posted on Blackboard) or Autopsy (https://www.sleuthkit.org/autopsy/) are installed

4. Download project image and hash values from blackboard

5. Open the image with FTK Imager – verify it to make sure the hash values match what was given

6. Open the image in FTK/Autopsy to start your analysis

7. Document each step!!

Hints/reminders for the project:

1. Your report should document each step in your analysis and explain what you did, what you found, how, where, what the technical aspects mean

2. Don’t interpret the file content – that is out of the scope of your job!

3. You can’t say a specific person did something – make sure you differentiate between PEOPLE and USERNAMES

4. Stick to the facts

5. Write in first person

6. Include LOTS of screenshots – but these go in the appendix, not the body of your report!

7. Don’t forget to include the basics in your report – who are you? Your authority? What case is this? Background?

Need help?

• HELP! Folder on blackboard

• Labs 2 and 3

• Lecture 5, 6, and 7

• Ask!