Digital Forensics Tutorials Viewing Image Contents in Windows

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Digital Forensics Tutorials Viewing Image Contents in Windows"

Transcription

1 Digital Forensics Tutorials Viewing Image Contents in Windows Explanation Section About Disk Analysis Once the proper steps have been taken to secure and verify the disk image, the actual contents of the image must be analyzed for suspicious or incriminating evidence. When looking at the contents of an image, it is necessary to not only look at the clearly visible contents such as folders on the desktop and images in user files, but the image must also be checked for hidden, encrypted, or deleted files. It is always better to assume that a suspect may have known that they were to be investigated and took steps to hide, delete, or otherwise make it difficult to find the information they had been storing on their USB or computer. About FTK One of the tools we will be using in this tutorial will be FTK (Forensic Toolkit). This is a program released by AccessData for digitally-based forensic investigations. The more robust versions are highly expensive, but allow for password recovery, encryption protection, and analysis for both Windows and MAC OS images. We are using a free version which is much more limited, but is still ideal for finding deleted and hidden files or partitions within a disk image. Though the free version has limited reporting capabilities, FTK is still ideal for working with disk image files on Windows systems. Note that the demo version of this software is no longer offered by AccessData, and so the version we are using is relatively old. About ProDiscover Basic ProDiscover Basic is a free version of this program which is used for both creating disk images and viewing disk image contents. In the scope of this tutorial we will be using it for the purpose of viewing image contents. Just note that it can easily be used to create a disk image as well, like FTK with some limitations. While ProDiscover Basic has advanced reporting tools and is excellent for generating reports, it does not have the abilities to show most deleted file or hidden partitions. However, it is helpful to understand how to use it, as it is a relatively up-to-date piece of free forensics software, which is why it is a decent alternative to the rather outdated FTK software. In This Tutorial Once a disk image has been created, hashed, and write-blocked to prevent changes, it is necessary to analyze the image. During the analysis process, the investigator must search for information pertinent to the case being compiled. This means not only looking for current contents on the drive, but also searching for deleted files, missing or hidden information, and hidden partitions that may not appear at first glance. Oftentimes a suspect will attempt to hide and delete information as a precaution. Using FTK and ProDiscover can help uncover information that might otherwise never be found. In this particular tutorial, we will be using the disk image created in an earlier tutorial, Georges Drive Image.001. This is the disk image we created in FTK Imager using Z: Georges Drive as the target. We will be reviewing the various options available in FTK and ProDiscover Basic, with the emphasis being on FTK, which is the more thorough of the two tools.

2 Tutorial Section LEARNING OBJECTIVES: Successfully open a disk image file View the immediately available current contents of the disk image file Search the contents for deleted information or hidden information Take a successful copy of information for further analysis Hash each individual piece of evidence and keep a log Recalculate the hash value of the image file to verify it has not been compromised Part 1 Analyzing the Disk Image File in ProDiscover Basic 1. Login to the Virtual Lab website ( and enter the NEST Digital Forensics vapp. Click on the Windows 8 machine to open the VM. 2. At the login screen of the Windows 8 machine use the password letmein. 3. Launch ProDiscover Basic from the desktop. A screen will open asking for information about a new or existing project. Since this is a new project, we will fill out the information for the number and name. Then click Open.

3 4. The new project will open. At this point there is nothing to analyze since the project is empty. 5. To add Georges Drive Image.001 to the project for analysis, navigate to Action>>Add>>Image File. Open the Y:\ Investigative Drive, and select Georges Drive Image.001. Then click Open. The drive has now been added to the project. Click on Images which is nested beneath Content View in the left navigation menu. You will see the disk image. 6. To look at the contents of Georges Drive Image, expand the + symbol to the left of Images until reaching C:. The contents of the disk appear in the right side analysis window. You can click into each folder to see its contents. 7. It looks like George has some images on his drive. In this folder, Vacation Photos, we can see he has four images.

4 8. What if we want to take a better look at those photos in a viewer-friendly program? We can t change anything within the disk image file, as that would damage the integrity of the evidence. Also, we have the disk image set to read-only, so we can t make any changes anyway. So we need to make a copy of the individual photos. Remember that each individual piece of evidence must be hashed. To copy eiffel-tower-paris-2.jpg to the Investigative Drive, right click over the file and select Copy File. 9. You will be asked to save the photo to a location. Choose the Investigative Drive. Now we must hash the image. Open WinHex, then navigate to File>>Open. Open the photo from the Investigative

5 Drive. Then navigate to Tools>>Compute Hash. Select md5 and hash the file. Copy the hash value into a text document and save it to the Investigative Drive. This way you have a complete record that will be used as evidence that the photo is not altered during your analysis. 10. Now you can safely look at the photo in a photo viewer. 11. Go back to ProDiscover and look at other folders and files on the disk image. Do you see anything of interest? How about in the Deleted Files and Recycle Bin folders? Is there anything that looks suspicious? Is there anything that seems difficult to find or locate within ProDiscover Basic? Practice copying evidence files and hashing them. Keep track of everything you copy and hash. 12. When finished, save the project file (File>>Save Project) and close out of ProDiscover Basic. Part 2 Creating a Case in Forensic Toolkit (FTK) 1. FTK (Forensic Toolkit) is the better alternative to ProDiscover Basic. If files have been deleted, or attempts have been made to wipe or hide files, or if the drive contains hidden partitions, chances are that they will be much easier to find and recover in FTK. Right click on FTK and select Run as Administrator. Sometimes it refuses to run if not launched this way. Click OK for the library and Code Meter errors. Click OK to acknowledge you are using a demo version. 2. Click Start a new case in the window that appears. Click OK. You will be asked to enter information about the case as in ProDiscover Basic. You can choose to save the case to the Investigative Drive. Enter the information and click Next.

6 3. Enter the Forensic Examiner Information if desired and click Next.

7 4. Leave the defaults for Case Log Options. This will designate how logs of what you are doing are kept. These logs can be later used to print a report of the analysis. Click Next. 5. Leave the default options set on the Processes to Perform page. This gives you an idea of what will be done when the disk image is imported. FTK will create an md5 and sha1 hash The disk image will be tested for encryption A text index will be created for search purposes, Thumbnails will be created for all images for easier viewing EFS files with be automatically decrypted A database of all items on the disk image will be created If you wanted to also generate other reports and have FTK check for data carving (a way to hide data), you may check these options as well. Click Next. 6. Leave the defaults on the Refine Case page. This indicates what kinds of data will be included in the case. The defaults allow all data to be shown in the case except for files in KFF ignorable containers. Click Next. 7. Do the same for the Refine Index Page. The defaults will index the file slack space (space that is beyond the end of the logical file but within the area allocated to that file by the file system) as well as the free space (areas not allocated to a file but that might possibly contain deleted files). Click Next. 8. Add the disk image file by clicking Add Evidence. Select Acquired Image of Drive and navigate to and select Georges Drive Image.001. Give the image an identification name/number and click OK.

8 9. The disk image has now been added to the case. Click Next. 10. Click Finish to complete building the case. The case will take a few moments to index and complete the required processes. Once this has finished, the disk image will be available to analyze.

9 Part 3 Analyzing the Disk Image File in Forensic Toolkit 1. To analyze the contents of the disk image, click on the Explore tab near the top of the program. You can then browse through the contents of the disk image. 2. Note that you can see a new zip file. This file was hidden on the original drive as a means of protection. However, FTK displays hidden files, so it is now visible. Browse through the contents of the drive note that FTK is generally considered to be not only more thorough, but also more usefriendly in how disk image contents are displayed. 3. To copy a piece of evidence such as a photo or text file, right click the file. Select Extract This File, and save the file to the Investigative Drive. Before examining the photo, be sure to use the same hashing steps from Part 1.

10 4. FTK also allows for full text searches. Click the Search tab. Type in words that might appear on suspicious drives. For example, in this case, you might search for money, deal, buyer, etc. I am using million as my search term. After typing the term, click Add to add it as a search term. To view results of a search term, click View Item Results. Make sure that All Files is selected so that everything is searched. You can then browse the results on the right side of the screen. 5. Continue to browse through the contents and familiarize yourself with Forensic Toolkit. Conclusion You should now have a general idea of how to create a disk image file, hash the file, write block the file, and perform a first-level analysis of the disk image in a Windows environment. This is the basis of any digital forensics investigation. Knowing these basics will enable you to focus on learning more involved and advanced aspects of digital forensics. In later tutorials you will learn about some of the reporting tools available in Linux and Windows. Since reports and notes are often used in court and to verify the integrity of evidence, it is important to keep a log of any changes made or anything noted during the course of the investigation. These reports and logs will potentially be used in a court of law.

Digital Forensics Tutorials Acquiring an Image with FTK Imager

Digital Forensics Tutorials Acquiring an Image with FTK Imager Digital Forensics Tutorials Acquiring an Image with FTK Imager Explanation Section Digital Forensics Definition The use of scientifically derived and proven methods toward the preservation, collection,

More information

16.4.3 Optional Lab: Data Backup and Recovery in Windows 7

16.4.3 Optional Lab: Data Backup and Recovery in Windows 7 16.4.3 Optional Lab: Data Backup and Recovery in Windows 7 Introduction Print and complete this lab. In this lab, you will back up data. You will also perform a recovery of the data. Recommended Equipment

More information

10.3.1.4 Lab - Data Backup and Recovery in Windows 7

10.3.1.4 Lab - Data Backup and Recovery in Windows 7 5.0 10.3.1.4 Lab - Data Backup and Recovery in Windows 7 Introduction Print and complete this lab. In this lab, you will back up data. You will also perform a recovery of the data. Recommended Equipment

More information

Digital Forensics Tutorials Acquiring an Image with Kali dcfldd

Digital Forensics Tutorials Acquiring an Image with Kali dcfldd Digital Forensics Tutorials Acquiring an Image with Kali dcfldd Explanation Section Disk Imaging Definition Disk images are used to transfer a hard drive s contents for various reasons. A disk image can

More information

16.4.3 Lab: Data Backup and Recovery in Windows XP

16.4.3 Lab: Data Backup and Recovery in Windows XP 16.4.3 Lab: Data Backup and Recovery in Windows XP Introduction Print and complete this lab. In this lab, you will back up data. You will also perform a recovery of the data. Recommended Equipment The

More information

Digital Forensics. Tom Pigg Executive Director Tennessee CSEC

Digital Forensics. Tom Pigg Executive Director Tennessee CSEC Digital Forensics Tom Pigg Executive Director Tennessee CSEC Definitions Digital forensics Involves obtaining and analyzing digital information as evidence in civil, criminal, or administrative cases Analyze

More information

10.3.1.6 Lab - Data Backup and Recovery in Windows XP

10.3.1.6 Lab - Data Backup and Recovery in Windows XP 5.0 10.3.1.6 Lab - Data Backup and Recovery in Windows XP Introduction Print and complete this lab. In this lab, you will back up data. You will also perform a recovery of the data. Recommended Equipment

More information

ACE STUDY GUIDE. 3. Which Imager pane shows information specific to file systems such as HFS+, NTFS, and Ext2? - Properties Pane

ACE STUDY GUIDE. 3. Which Imager pane shows information specific to file systems such as HFS+, NTFS, and Ext2? - Properties Pane ACE STUDY GUIDE *Note* All of the actual exam questions are in multiple choice format. This Study Guide is designed to cover all of the material on the exam, 1. FTK Imager supports the encryption of forensic

More information

Forensically Determining the Presence and Use of Virtual Machines in Windows 7

Forensically Determining the Presence and Use of Virtual Machines in Windows 7 Forensically Determining the Presence and Use of Virtual Machines in Windows 7 Introduction Dustin Hurlbut Windows 7 has the ability to create and mount virtual machines based upon launching a single file.

More information

Legal Notices. AccessData Corp.

Legal Notices. AccessData Corp. Legal Notices AccessData Corp. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability

More information

Forensic Toolkit. Sales and Promotional Summary ACCESSDATA, ON YOUR RADAR

Forensic Toolkit. Sales and Promotional Summary ACCESSDATA, ON YOUR RADAR Forensic Toolkit Sales and Promotional Summary ACCESSDATA, ON YOUR RADAR What is AccessData s Forensic Toolkit? Also known as FTK, this application enables you to perform complete and thorough computer

More information

16.4.3 Optional Lab: Data Backup and Recovery in Windows Vista

16.4.3 Optional Lab: Data Backup and Recovery in Windows Vista 16.4.3 Optional Lab: Data Backup and Recovery in Windows Vista Introduction Print and complete this lab. In this lab, you will back up data. You will also perform a recovery of the data. Recommended Equipment

More information

Contents. Using Web Access... 1. Managing Shared Folders... 28. Managing Account Settings... 36. Index... 39

Contents. Using Web Access... 1. Managing Shared Folders... 28. Managing Account Settings... 36. Index... 39 Contents Using Web Access... 1 Using the Sign In Page... 1 Signing In to Seagate Global Access... 2 Creating a Seagate Global Access Account... 2 If You Forget Your Password... 5 Viewing Central Axis Details...

More information

Practice Exercise March 7, 2016

Practice Exercise March 7, 2016 DIGITAL FORENSICS Practice Exercise March 7, 2016 Prepared by Leidos CyberPatriot Forensics Challenge 1 Forensics Instruction Guide Introduction The goal of this event is to learn to identify key factors

More information

Determining VHD s in Windows 7 Dustin Hurlbut

Determining VHD s in Windows 7 Dustin Hurlbut Introduction Windows 7 has the ability to create and mount virtual machines based upon launching a single file. The Virtual Hard Disk (VHD) format permits creation of virtual drives that can be used for

More information

COEN 152 / 252 Lab Exercise 1. Imaging, Hex Editors & File Types

COEN 152 / 252 Lab Exercise 1. Imaging, Hex Editors & File Types COEN 152 / 252 Lab Exercise 1 Imaging, Hex Editors & File Types In this lab we will explore the concepts associated with creating a forensic image. Write-blocking will be accomplished utilizing a mounted

More information

Fuzzy Hashing for Digital Forensic Investigators Dustin Hurlbut - AccessData January 9, 2009

Fuzzy Hashing for Digital Forensic Investigators Dustin Hurlbut - AccessData January 9, 2009 Fuzzy Hashing for Digital Forensic Investigators Dustin Hurlbut - AccessData January 9, 2009 Abstract Fuzzy hashing allows the investigator to focus on potentially incriminating documents that may not

More information

Before You Begin. SharePoint How To s / Access and Storage 1of 7

Before You Begin. SharePoint How To s / Access and Storage 1of 7 SharePoint How To s / Access and Storage of 7 Manage access and storage on your SharePoint Server 007 sites. Manage Access Limit access to sensitive business information. Topics in this section: Give Users

More information

SecureDoc for Mac v6.1. User Manual

SecureDoc for Mac v6.1. User Manual SecureDoc for Mac v6.1 User Manual Copyright 1997-2012 by WinMagic Inc. All rights reserved. Printed in Canada Many products, software and technologies are subject to export control for both Canada and

More information

10.3.1.5 Lab - Data Backup and Recovery in Windows Vista

10.3.1.5 Lab - Data Backup and Recovery in Windows Vista 5.0 10.3.1.5 Lab - Data Backup and Recovery in Windows Vista Introduction Print and complete this lab. In this lab, you will back up data. You will also perform a recovery of the data. Recommended Equipment

More information

AccessData. Triage. Quick Start Guide. Published: December 2011

AccessData. Triage. Quick Start Guide. Published: December 2011 AccessData Triage Quick Start Guide Published: December 2011 1 Legal Information 2011 AccessData Group, LLC All rights reserved. No part of this publication may be reproduced, photocopied, stored on a

More information

Synergy. Synergy User Manual

Synergy. Synergy User Manual Synergy Synergy User Manual About Synergy Synergy provides a web-based, centralized and secure solution for accessing and sharing content such as documents, files and presentations. Accessing Synergy To

More information

Last modified: November 22, 2013 This manual was updated for the TeamDrive Android client version 3.0.216

Last modified: November 22, 2013 This manual was updated for the TeamDrive Android client version 3.0.216 Last modified: November 22, 2013 This manual was updated for the TeamDrive Android client version 3.0.216 2013 TeamDrive Systems GmbH Page 1 Table of Contents 1 Starting TeamDrive for Android for the First

More information

How to Use JCWHosting Reseller Cloud Storage Solution

How to Use JCWHosting Reseller Cloud Storage Solution How to Use JCWHosting Reseller Cloud Storage Solution Go to https://www.internetspace.co.za and log in with your Cloud Reseller account username and password. How to Use create a cloud account for your

More information

Computer Intrusion Forensics Literature Review

Computer Intrusion Forensics Literature Review Computer Intrusion Forensics Literature Review Nathan Balon CIS 544 October 20, 2003 Title Computer Forensics: Incident Response Essentials by Warren G. Kruse II and Jay G. Heiser Reviewed by Nathan Balon

More information

Incident Response and Computer Forensics

Incident Response and Computer Forensics Incident Response and Computer Forensics James L. Antonakos WhiteHat Forensics Incident Response Topics Why does an organization need a CSIRT? Who s on the team? Initial Steps Detailed Project Plan Incident

More information

ECT362 Installing Linux Virtual Machine in KL322

ECT362 Installing Linux Virtual Machine in KL322 ECT362 Installing Linux Virtual Machine in KL322 The steps below outline how to install Linux under Windows as a virtual machine. This install uses the Ubuntu 10.04 distribution of Linux along with the

More information

Acronis Backup & Recovery 11

Acronis Backup & Recovery 11 Acronis Backup & Recovery 11 Quick Start Guide Applies to the following editions: Advanced Server Virtual Edition Advanced Server SBS Edition Advanced Workstation Server for Linux Server for Windows Workstation

More information

Getting Started with Companyweb

Getting Started with Companyweb Getting Started with Companyweb By Robert Crane Computer Information Agency http://www.ciaops.com Index What is Companyweb? Page 2 What does this document contain? Page 3 How can I use Companyweb? Page

More information

Customize the Quick Launch menu

Customize the Quick Launch menu Customize the Quick Launch menu SharePoint provides several ways in which you can customize the navigation of your site. This tutorial is intended for site owners and designers. You can also choose to

More information

PGP Zip Self-Decrypting Archive (SDA) 5/29/2012 Version 1.1

PGP Zip Self-Decrypting Archive (SDA) 5/29/2012 Version 1.1 PGP Zip Self-Decrypting Archive (SDA) 5/29/2012 Version 1.1 Table of Contents 1 Self Decrypting Archives (SDA)... 1-2 2 Setting Windows to Display File Extensions... 2-3 3 Creating PGP Zip SDA... 3-4

More information

End User Manual. SharePoint. Please send feedback or suggestions for updates to the following email address IT.Training@lse.ac.uk

End User Manual. SharePoint. Please send feedback or suggestions for updates to the following email address IT.Training@lse.ac.uk SharePoint End User Manual Please send feedback or suggestions for updates to the following email address IT.Training@lse.ac.uk London School of Economics & Political Science 1 02/12/2014/lse.ac.uk/IMT/training

More information

Cloudifile Getting Started

Cloudifile Getting Started Cloudifile Getting Started 1 Contents About... 3 System Requirements... 3 Cloudifile Recommendations for Use... 4 Cloudifile: How It Works?... 6 [Windows] Getting Started... 8 [Mac OS X] Getting Started...

More information

How to enable Disk Encryption on a laptop

How to enable Disk Encryption on a laptop How to enable Disk Encryption on a laptop Skills and pre-requisites Intermediate IT skills required. You need to: have access to, and know how to change settings in the BIOS be confident that your data

More information

Most of your tasks in Windows XP will involve working with information

Most of your tasks in Windows XP will involve working with information OFFICE 1 File Management Files and Folders Most of your tasks in Windows XP will involve working with information stored on your computer. This material briefly explains how information is stored in Windows

More information

How to Password Protect Files & Folders in Mac OS X with Disk Images

How to Password Protect Files & Folders in Mac OS X with Disk Images The best way to secure sensitive information from malware is to encrypt it. Encryption works by using a complex formula to securely scramble (or encrypt) individual files and folders, entire disks and

More information

Backing up Microsoft Outlook Email For the PC Using MS Outlook 2000 Keith Roberts

Backing up Microsoft Outlook Email For the PC Using MS Outlook 2000 Keith Roberts WIN1020 November 2003 Backing up Microsoft Outlook Email For the PC Using MS Outlook 2000 Keith Roberts INTRODUCTION... 1 PREPARATION... 1 BACKING UP EMAIL... 2 RESTORING EMAIL FROM A PERSONAL FILE FOLDER...

More information

Driver Upgrade Instructions

Driver Upgrade Instructions Driver Upgrade Instructions Table of Content Installing updated drivers in Microsoft Windows 2 Uninstall Procedure 2 Uninstall Procedure for Windows 7 3 Install Procedure 4 Installing updated drivers in

More information

Step-by-Step Archiving with pictures

Step-by-Step Archiving with pictures Step-by-Step Archiving with pictures First, make sure that your status bar is visible in Outlook. - Click on View and make sure that Status Bar has a check by it. If it does not click on it. In Outlook,

More information

Stellar Phoenix Exchange Server Backup

Stellar Phoenix Exchange Server Backup Stellar Phoenix Exchange Server Backup Version 1.0 Installation Guide Introduction This is the first release of Stellar Phoenix Exchange Server Backup tool documentation. The contents will be updated periodically

More information

Resource Owner. Resource Owner. Resource Owner. Anyone given access

Resource Owner. Resource Owner. Resource Owner. Anyone given access Managing Accounts 1 s in Office 365 A account is an object in the Outlook Calendar that represents a room or a piece of equipment. These room resources are typically small conference rooms belonging to

More information

USING STUFFIT DELUXE THE STUFFIT START PAGE CREATING ARCHIVES (COMPRESSED FILES)

USING STUFFIT DELUXE THE STUFFIT START PAGE CREATING ARCHIVES (COMPRESSED FILES) USING STUFFIT DELUXE StuffIt Deluxe provides many ways for you to create zipped file or archives. The benefit of using the New Archive Wizard is that it provides a way to access some of the more powerful

More information

Job Aid: Password Reset

Job Aid: Password Reset Job Aid: Password Reset Purpose The purpose of this Job Aid is to guide users through the step-by-step process of enabling security questions and resetting their passwords. In this Job Aid, you will learn

More information

General Computing Network (GCN) Guide for Mac OS X

General Computing Network (GCN) Guide for Mac OS X General Computing Network (GCN) Guide for Mac OS X In the new GCN Environment for Mac and Linux machines, you will have to login with your UNCG user name and password. Machines will not be set to automatically

More information

Eclipse installation, configuration and operation

Eclipse installation, configuration and operation Eclipse installation, configuration and operation This document aims to walk through the procedures to setup eclipse on different platforms for java programming and to load in the course libraries for

More information

MAC/OSX - How to Encrypt Data using TrueCrypt. v.05201011

MAC/OSX - How to Encrypt Data using TrueCrypt. v.05201011 MAC/OSX - How to Encrypt Data using TrueCrypt v.05201011 This chapter contains step-by-step instructions on how to create, mount, and use a TrueCrypt volume. We strongly recommend that you read the entire

More information

Identity Finder: Managing Your Results

Identity Finder: Managing Your Results Identity Finder: Managing Your Results The most important part of running Identity Finder is determining the most effective and secure way of managing the search results. Be sure to carefully read and

More information

PC Angel. Recovery. Page 1

PC Angel. Recovery. Page 1 PC Angel Recovery Page 1 Table of Contents Introduction... 3 What is the purpose of PC Angel Recovery?... 3 What can you find in this manual?... 4 What should I do to get back my system?... 5 What should

More information

Contents. Getting Started...1. Managing Your Drives...9. Backing Up & Restoring Folders Synchronizing Folders...55

Contents. Getting Started...1. Managing Your Drives...9. Backing Up & Restoring Folders Synchronizing Folders...55 Contents Getting Started.....................................................1 Installing the Software...........................................1 Using the Maxtor System Tray Icon................................6

More information

Setting up VMware ESXi for 2X VirtualDesktopServer Manual

Setting up VMware ESXi for 2X VirtualDesktopServer Manual Setting up VMware ESXi for 2X VirtualDesktopServer Manual URL: www.2x.com E-mail: info@2x.com Information in this document is subject to change without notice. Companies, names, and data used in examples

More information

Identity Finder Setup

Identity Finder Setup Identity Finder Information Sheet for MAC This document will walk you through how to install, scan, and secure any SI found on your computer, or storage devices using the Identity Finder Software. This

More information

A computer running Windows Vista or Mac OS X

A computer running Windows Vista or Mac OS X lab File Management Objectives: Upon successful completion of Lab 2, you will be able to Define the terms file and folder Understand file and memory storage capacity concepts including byte, kilobyte,

More information

USING THE LEWIS UNIVERSITY VPN

USING THE LEWIS UNIVERSITY VPN USING THE LEWIS UNIVERSITY VPN This document will explain how to connect to and use the Lewis University Virtual Private Network (VPN). LOGGING INTO THE VPN: 1. Launch Internet Explorer by double clicking

More information

Online Backup Client User Manual

Online Backup Client User Manual For Mac OS X Software version 4.1.7 Version 2.2 Disclaimer This document is compiled with the greatest possible care. However, errors might have been introduced caused by human mistakes or by other means.

More information

2! Bit-stream copy. Acquisition and Tools. Planning Your Investigation. Understanding Bit-Stream Copies. Bit-stream Copies (contd.

2! Bit-stream copy. Acquisition and Tools. Planning Your Investigation. Understanding Bit-Stream Copies. Bit-stream Copies (contd. Acquisition and Tools COMP 2555: Principles of Computer Forensics Autumn 2014 http://www.cs.du.edu/2555 1 Planning Your Investigation! A basic investigation plan should include the following activities:!

More information

Online File Folder. Getting Started Guide. Become an Expert at Managing Your Files Online. wind. Online File Folder // Getting Started Guide

Online File Folder. Getting Started Guide. Become an Expert at Managing Your Files Online. wind. Online File Folder // Getting Started Guide Getting Started Guide Online File Folder Become an Expert at Managing Your Files Online Getting Started Guide Page 1 Getting Started Guide: Online File Folder Version 2.1 (2.22.11) Copyright 2010. All

More information

Yale Software Library. PGP 9.6 for Windows

Yale Software Library. PGP 9.6 for Windows PGP 9.6 for Windows How to Add keys to the All Keys key ring: 1. Run the PGP application from Start->All Programs->PGP. 2. In the PGP main application window, click on Search for keys. 3. In the Search

More information

Lesson Plans Microsoft s Managing and Maintaining a Microsoft Windows Server 2003 Environment

Lesson Plans Microsoft s Managing and Maintaining a Microsoft Windows Server 2003 Environment Lesson Plans Microsoft s Managing and Maintaining a Microsoft Windows Server 2003 Environment (Exam 70-290) Table of Contents Table of Contents... 1 Course Overview... 2 Section 0-1: Introduction... 4

More information

Image Backup and Recovery Procedures

Image Backup and Recovery Procedures Image Backup and Recovery Procedures Thank you for purchasing a Fujitsu computer. Fujitsu is committed to bringing you the best computing experience with your new system. It is very important that you

More information

(b) slack file space.

(b) slack file space. Hidden Files A Computer Forensics Case Study Question Paper 1. Outline the meaning of the following terms: (a) cookie, [2 marks] A cookie is data stored locally that is used by some websites for data that

More information

Quick Start Guide. Version R91. English

Quick Start Guide. Version R91. English Using StorageCraft Recovery Environment Quick Start Guide Version R91 English May 20, 2015 Agreement The purchase and use of all Software and Services is subject to the Agreement as defined in Kaseya s

More information

IT Academy Lesson Plan

IT Academy Lesson Plan 10 IT Academy Lesson Plan Microsoft Sharepoint Turn potential into success Microsoft Office SharePoint 2010: Lesson Plans Introduction Preparing to teach courses on Microsoft SharePoint 2010 for the first

More information

Windows Data Recovery Home 6.0

Windows Data Recovery Home 6.0 Installation Guide Stellar Phoenix Windows Data Recovery Home 6.0 Overview Stellar Phoenix Windows Data Recovery - Home edition is a complete solution to recover lost data from your hard disks and removable

More information

Online Backup by Mozy. Restore Common Questions

Online Backup by Mozy. Restore Common Questions Online Backup by Mozy Restore Common Questions Document Revision Date: June 29, 2012 Online Backup by Mozy Common Questions 1 How do I restore my data? There are five ways of restoring your data: 1) Performing

More information

Guide to Computer Forensics and Investigations, Second Edition

Guide to Computer Forensics and Investigations, Second Edition Guide to Computer Forensics and Investigations, Second Edition Chapter 4 Current Computer Forensics Tools Objectives Understand how to identify needs for computer forensics tools Evaluate the requirements

More information

Seagate File Recovery for MAC. Seagate Recovery Services

Seagate File Recovery for MAC. Seagate Recovery Services Seagate File Recovery for MAC Seagate Recovery Services The Seagate File Recovery for Mac support includes:: - these specific error messages: broken file name; file already exists; bad sectors option;

More information

Getting Started with Explorer Document Management for Alfresco Community Edition 3.2

Getting Started with Explorer Document Management for Alfresco Community Edition 3.2 Getting Started with Explorer Document Management for Alfresco Community Edition 3.2 Contents Copyright... 1 Introduction... 2 Important notes... 2 Starting with Explorer... 3 Toolbar...3 Sidebar...4

More information

Amazon WorkDocs. User Guide Version 1.0

Amazon WorkDocs. User Guide Version 1.0 Amazon WorkDocs User Guide Amazon WorkDocs: User Guide Copyright 2016 Amazon Web Services, Inc. and/or its affiliates. All rights reserved. Amazon's trademarks and trade dress may not be used in connection

More information

Managing Memory on your Macintosh

Managing Memory on your Macintosh Managing Memory on your Macintosh This is not the be-all and end-all of technical Mac memory discussions. Rather, it attempts to explain, in layperson s terms, how memory works and how you can make it

More information

Outlook basics. Identify user interface elements that you can use to accomplish basic tasks.

Outlook basics. Identify user interface elements that you can use to accomplish basic tasks. Outlook basics Outlook is a powerful tool for managing your e-mail, contacts, calendars, and tasks. To use it most effectively, you first have to understand the basics. This tutorial introduces some of

More information

Symantec Endpoint Encryption (SEE Client) Installation Instructions. Version 8.2

Symantec Endpoint Encryption (SEE Client) Installation Instructions. Version 8.2 Symantec Endpoint Encryption (SEE Client) Installation Instructions Version 8.2 Warning: This software is labor intensive, therefore it is important to validate that the hard drive is healthy by first

More information

Introduction to MS WINDOWS XP

Introduction to MS WINDOWS XP Introduction to MS WINDOWS XP Mouse Desktop Windows Applications File handling Introduction to MS Windows XP 2 Table of Contents What is Windows XP?... 3 Windows within Windows... 3 The Desktop... 3 The

More information

Part 3: Accessing Local drives and printers from the Terminal Server

Part 3: Accessing Local drives and printers from the Terminal Server In this guide: Part 1: What are Terminal Services / Remote Desktop? Part 2: Connecting to the HUSPSS Terminal Servers Part 3: Accessing Local drives and printers from the Terminal Server Part 4: Accessing

More information

Final data recovery software

Final data recovery software Final data recovery software ** This is a draft made on 3/24/09. It will be revised as needed. PSU uses Final Data Enterprise 2.0 for data recovery from failing or problematic hard drives, although it

More information

ACS EPF Download Manager Technical Guide. Table of Contents

ACS EPF Download Manager Technical Guide. Table of Contents Table of Contents Introduction... 3 Administration... 3 Disclaimer... 3 System Requirements... 3 Software Download... 3 Software Installation... 4 Preparing for the Installation... 4 Unzip the Software

More information

Windows XP Home Edition / Windows XP Professional

Windows XP Home Edition / Windows XP Professional Windows XP Home Edition / Windows XP Professional COOLPIX5000/995/885/775 This manual is for those users of the COOLPIX5000/995/885/ 775 who are running Nikon View 4 (Version4.3.1) under Windows XP Home

More information

VMware Horizon FLEX User Guide

VMware Horizon FLEX User Guide Horizon FLEX 1.5 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions of this

More information

Restoring a Windows 8.1 system from complete HDD failure - drivesnapshot

Restoring a Windows 8.1 system from complete HDD failure - drivesnapshot Restoring a Windows 8.1 system from complete HDD failure - drivesnapshot Drivesnapshot is available at http://www.drivesnapshot.de/ http://www.drivesnapshot.de/en/down.htm is the download page. If you

More information

VMWare Workstation 11 Installation MICROSOFT WINDOWS SERVER 2008 R2 STANDARD ENTERPRISE ED.

VMWare Workstation 11 Installation MICROSOFT WINDOWS SERVER 2008 R2 STANDARD ENTERPRISE ED. VMWare Workstation 11 Installation MICROSOFT WINDOWS SERVER 2008 R2 STANDARD ENTERPRISE ED. Starting Vmware Workstation Go to the start menu and start the VMware Workstation program. *If you are using

More information

MTA Course: 10753 Windows Operating System Fundamentals Topic: Understand backup and recovery methods File name: 10753_WindowsOS_SA_6.

MTA Course: 10753 Windows Operating System Fundamentals Topic: Understand backup and recovery methods File name: 10753_WindowsOS_SA_6. STUDENT ACTIVITY 6.1: UNDERSTAND BACKUP AND RECOVERY METHODS MTA Course: 10753 Windows Operating System Fundamentals Topic: Understand backup and recovery methods File name: 10753_WindowsOS_SA_6.1 Lesson

More information

File Management and File Storage

File Management and File Storage File Management and File Storage http://training.usask.ca Information Technology Services Division Table of Contents File Management at the University of Saskatchewan...3 Introduction...3 Creating Files

More information

Windows XP Home Edition / Windows XP Professional

Windows XP Home Edition / Windows XP Professional Windows XP Home Edition / Windows XP Professional COOLPIX990/880 This manual is for those users of the COOLPIX 990/880 who are running Nikon View 4 (Version4.3.1) under Windows XP Home Edition / Professional.

More information

Help. F-Secure Online Backup

Help. F-Secure Online Backup Help F-Secure Online Backup F-Secure Online Backup Help... 3 Introduction... 3 What is F-Secure Online Backup?... 3 How does the program work?... 3 Using the service for the first time... 3 Activating

More information

Windows Forensics Vista

Windows Forensics Vista Windows Forensics Vista Forensic Toolkit, FTK Imager and Registry Viewer Advanced Three-day Instructor-led Workshop T his advanced workshop provides the knowledge and skills necessary to analyze Microsoft

More information

IS L06 Protect Servers and Defend Against APTs with Symantec Critical System Protection

IS L06 Protect Servers and Defend Against APTs with Symantec Critical System Protection IS L06 Protect Servers and Defend Against APTs with Symantec Critical System Protection Description Lab flow At the end of this lab, you should be able to Discover how to harness the power and capabilities

More information

EnCase v7 Essential Training. Sherif Eldeeb https://eldeeb.net

EnCase v7 Essential Training. Sherif Eldeeb https://eldeeb.net هللامسب EnCase v7 Essential Training What s in this course Explore the most notable features of the new version. Everything you need to know about EnCase v7 to conduct basic investigations. Create Cases

More information

Online Sharing User Manual

Online Sharing User Manual Online Sharing User Manual June 13, 2007 If discrepancies between this document and Online Sharing are discovered, please contact backupfeedback@verizon.net. Copyrights and Proprietary Notices The information

More information

Getting Started with SharePoint Online for Small Business

Getting Started with SharePoint Online for Small Business Getting Started with SharePoint Online for Small Business By Robert Crane Computer Information Agency http://www.ciaops.com Terms This Guide from the Computer Information Agency is provided as is. Every

More information

PolyU Staff Email Service. Outlook 2011 Client. For Mac. Setup Guide

PolyU Staff Email Service. Outlook 2011 Client. For Mac. Setup Guide PolyU Staff Email Service Outlook 2011 Client For Mac Setup Guide Version 1.3 Last Update: 16 January 2013 PolyU Staff Email: www.polyu.edu.hk/email ITS HelpCenter Support: www.polyu.edu.hk/hots ITS Help

More information

The following features have been added to FTK with this release:

The following features have been added to FTK with this release: FTK 2.0.2 Readme The following sections present information on the new features, resolved issues, and known issues with the FTK 2.0.2 release. NEW FEATURES The following features have been added to FTK

More information

This manual will also describe how to get Photo Supreme SQLServer up and running with an existing instance of SQLServer.

This manual will also describe how to get Photo Supreme SQLServer up and running with an existing instance of SQLServer. 1 Installation Manual SQL Server 2012 Photo Supreme Introduction Important note up front: this manual describes the installation of Photo Supreme with SQLServer. There is a free SQLServer version called

More information

Using Your Department Shared Folder

Using Your Department Shared Folder Using Your Department Shared Folder What Is A Domain? A domain is an internal network of computers where the users can share space on a server for storing files and sharing access to printers. Sunysb.edu

More information

Retrieving Internet chat history with the same ease as a squirrel cracks nuts

Retrieving Internet chat history with the same ease as a squirrel cracks nuts Retrieving Internet chat history with the same ease as a squirrel Yuri Gubanov CEO, Belkasoft http://belkasoft.com SANS Forensic Summit September 21, 2011 London, Great Britain What is Instant Messenger!

More information

How to create a portable encrypted USB Key using TrueCrypt

How to create a portable encrypted USB Key using TrueCrypt How to create a portable encrypted USB Key using TrueCrypt INTRODUCTION TrueCrypt Traveler Mode provides secure encryption for programs/files on portable devices such as USB Memory keys. It uses strong

More information

FILEVAULT USER GUIDE

FILEVAULT USER GUIDE FILEVAULT USER GUIDE Click on http://filevault.ttuhsc.edu/ or copy the URL into your browser to access the FileVault site. Below is the initial login screen for the FileVault site. Login Credentials will

More information

Installation Instructions

Installation Instructions Avira Secure Backup Installation Instructions Trademarks and Copyright Trademarks Windows is a registered trademark of the Microsoft Corporation in the United States and other countries. All other brand

More information

Backing up with Windows 7

Backing up with Windows 7 Backing up your data should be a high priority; it is far too easy for computer failure to result in the loss of data. All hard drives will eventually fail, and (at the minimum) you should be prepared

More information

Acquisition of the Microsoft Surface RT

Acquisition of the Microsoft Surface RT Acquisition of the Microsoft Surface RT Author: Darren Freestone Lock and Code Pty Ltd darren@lockandcode.com Date: 7 April 2013 Revision 1.01 Contents Acquisition of the Microsoft Surface RT... 1 Step-by-Step

More information

Suffolk Sourcing E-Tendering System SUBMITTING A TENDER

Suffolk Sourcing E-Tendering System  SUBMITTING A TENDER SUBMITTING A TENDER Please read this guide before responding to a tender or quotation. For technical issues, contact the Suffolk Sourcing Helpdesk on 01473 260232 or suffolk.sourcing@suffolk.gov.uk Questions

More information

Carry it Easy. User Guide

Carry it Easy. User Guide Carry it Easy User Guide User Manual Version 3.2 2004-2010 CoSoSys Ltd. Carry it Easy User Manual Table of Contents Table of Contents... I 1. Introduction... 1 2. System Requirements... 1 3. Installation...

More information