DIGITAL FORENSICS: How to gather Forensics Investigation Evidence using ProDiscover Forensics
ProDiscover Forensics is a simple digital forensic investigation tool that allows you to image, analyse and report on evidence found on a drive. Once you add a forensic image you can view the data by content or by looking at the clusters that hold the data. You can also search for data using the Search node based on the criteria you specify.
This activity completes your analysis of the USB drive.
1. Double ProDiscover on desktop.
ProDiscover Compute Forensics Software |
2.In the main window, click Action menu, click Capture Image.
The following steps will show how to acquire an image of drive E called USB. Please note that this drive is not an actual USB drive but a fixed drive on the computer.
Note: On the USB drive, locate the write-protect switch (if one is available) and place the drive in write-protect mode. Then connect the USB drive to your computer.
3. In the Capture Image dialog box, click the Source Drive list arrow, and select the drive E:\[USB] Click the >> button next to the Destination text box and click Choose Local Path.
Click Save to save the file.
4.When ProDiscover is finished, click OK in the completion message box.
Using ProDiscovery to analyze evidence
5.In the tree view of the main window, click to expand the Add item, and then click Image File.
click the InChp01-prac.eve file.Click Open.
6.Click to expand Images, and click the image filename path C:\Work\Chap01\Chapter\InChp01-prac.eve.
7.In the upper-right pane (the work area), click the tracking.log file to view its contents in the data area.
Analyzing data
8.In the Search dialog box, click the Content Search tab, if necessary.
Next, in the text box under the Search for the pattern(s) option button, type: win810
9.Under Select the Disk(s)/Image(s) you want to search in section, click C:\Work\Chap01\Chapter\InChp01-prac.eve (substituting the path to your work folder), and then click OK to start the search.
For each search you do in a case, ProDiscover adds a new tab to help catalog your searches.
Click tracking.
No comments:
Post a Comment