Overview:
For each of the Project 1 sections, complete the appropriate filling in with lab results and answers to specific questions.
Processed Evidence Search:
- Using the Hex tab in the evidence window, what are the first four hex values displayed?
I clicked on the “evidence” window and then pressed Bushell. On the bottom of the page, the headings “Files, Reports, and Text” were listed. Underneath these headings at the bottom of the page, under “Options, Codepage, and Text Style,” I could see a list of values needed to answer this question. HEX value 0000 & 0028.
- Using the Permissions tab in the evidence window, what are the unique Names listed? (e.g Administrators…)
Once I pressed the “Permissions” tab, I could view a list of unique names on the bottom half of the screen. Under “Name, ID, Property, and Permissions,” various pieces of information were displayed. Under the “Name” heading sat all the different names, such as “Users, Administrators, Domain Users, System, and Authenticated Users.” These are the needed answers.
- Using the Attributes tab in the evidence window, what is the Full Serial Number?
After I clicked on the attributes tab, it was easy to find the answer. On the left-hand side of the page, on the bottom, was the serial number, the full serial number, and driver information. Hence, the answer was listed under the “full serial number” of 20D8B6BBD8B68E92.
Time zone of Image
- What is the time zone listed for the image?
On the left side of the computer screen rested a slew of choices. Located between “Terminal Server” and “usbflags” was “Time Zone Information.” When I highlighted Time Zone Information, then on the bottom page read the phrase “Turkey Standard Time,” my final answer.
Image Search Results:
- What type (e.g. Guns, Knifes, Rocket Launchers…) of weapons do you immediately see when you browse the 9RD3Y03V folder.
Under the Bushell tab is “Recovered Folders” on the left-hand side. When I clicked on the 9RD3Y03V folder, a picture of various weapons surfaced on the right-hand side of the page. These included guns, gun case, pocket knives, lab workers, gun holder, and the eHow Logo Sign. These are the answers.
- Which folder contains a Mastercard image?
Under “Recovered Files,” I had several choices. I clicked on H34XEMZ7, H5YQLSE8, Local low and roaming before I found what I was looking for under the file TD06QBFX. In the second row, in the middle of the page, were images 73, 74, 75, 76, 77, and 78. The images 77 and 78 both displayed pictures that contained MasterCard images, the answer for this question.
- Which folder contains a Login with Facebook image?
When you click on “Recovered Folders,” the same files that are in Question 2 popped up. I utilized the same process of sifting through each file until I located the answer. I clicked on H34XEMZ7, H5YQLSE8, and Roaming before I found what I needed. It was Image 15 that showed the “Login with Facebook” login, in folder “NEN1MQSJ”
- Which folder contains at least two images of people?
In the “Recovered Folders” section is a list of files. When I clicked on PGQ57MZE, I found what I needed. In the middle/right section sat Image 2- 131547. . . of a balding man. In the third row is Image 15, number 18633. The image showed a dark-haired man wearing an orange shirt. Those were the only images that featured people.
Keyword Search Results:
- Go to the first hit of the Guns-> Items. This is most likely named search[1].htm. Review the transcript. What does the central theme of this search seem to be? Provide some specific text examples of the transcript that align with this central theme.
When I clicked on guns and items, a search list in the transcript section at the bottom of the page surfaced. Contained in this list were different images, links, and videos on different firearms. The most crucial piece of information included the “How to Mask a Firearm Smell” link for Bing, the central theme for this question.
- Go to Password-> Items and find search[2].htm file. Look at the transcript of this resource. Review the transcript. What does the central theme of this search seem to be? Provide some specific text examples of the transcript that align with this central theme.
After I clicked on passwords and items, I studied the “Transcript” on the bottom of the computer page. In this section, I found filetype.pdf for Bing, as well as images and videos for the cleaner program. Hence, the central theme appeared to be a “ccleaner program,” the answer to this question.
