Guide to Computer Forensics

Guide to Computer Forensics and Inves�ga�ons 7e Bill Nelson, Amelia Phillips, Christopher Steuart (Solu�ons Manual All Chapters, 100% Original Verified, A+ Grade)

Part 1: Page 1-298

Part 2: Page 299-538 1 / 4

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steua rt, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884;

Module 1: Understanding the Digital Forensics Profession and Investigations

1 © 2025 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.Solution and Answer Guide

BILL NELSON, AMELIA PHILLIPS, CHRIS STEUART, ROBERT S. WILSON,

GUIDE TO COMPUTER FORENSICS AND INVESTIGATIONS, 7TH EDITION, ISBN: 9780357672884;

MODULE 1: UNDERSTANDING THE DIGITAL FORENSICS PROFESSION AND INVESTIGATIONS

Table of Contents Activities - Solutions .......................................................................................................... 2 Activity 1-1 .................................................................................................................................. 2 Review Questions - Answers ............................................................................................. 3 Hands- On Projects - Solutions .......................................................................................... 7 Project 1-1 .................................................................................................................................. 7 Project 1-2.................................................................................................................................. 9 Project 1-3................................................................................................................................. 11 Project 1-4 ................................................................................................................................ 13 Case Projects - Solutions ................................................................ .................................. 15 Case Project 1-1 ....................................................................................................................... 15 Case Project 1-2 ....................................................................................................................... 16 Case Project 1-3 ....................................................................................................................... 16 Case Project 1-4 ....................................................................................................................... 17 Part 1 2 / 4

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884;

Module 1: Understanding the Digital Forensics Profession and Investigations

2 © 2025 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.Activities - Solutions

ACTIVITY 1-1

Estimated Time: 30 minutes

Objective: Configure Autopsy for a new case and analyze the image file of George Montgomery’s USB drive.

Before You Begin:

•Download and install Autopsy as described in Note 15.•Create Work folder C:\Work\Module_01\Activity_01-1 (referred to as your Work folder in the steps).

•Download to your Work folder the following files provided with the module:

•Activity_01-1.001

To perform the analysis, complete the following steps:

1.Start Autopsy for Windows.

2.In Autopsy’s Welcome window, click the New Case button. In the New Case Information window, enter Activity_01-1 in the Case Name text box (see Figure 1-15), and click Browse next to the Base Directory text box. Navigate to and click your Work folder. Make sure the Single-User option button is selected for Case Type, and then click Next.[Figure 1-15 New Case Information window of Autopsy] 3.On the Optional Information pane, type Activity_01-1 in the Case Number text box and your full name in the Name text box in the Examiner section (see Figure 1-16), and then click Finish to start the Add Data Source Wizard.

4.In the Select Type of Data Source to Add area of the Add Data Source window, click the Disk Image or VM File button (see Figure 1-17), and then click Next.

5.In the Select Data Source pane of the next window, click the Browse button next to the Path text box, navigate to and click your Work folder, click the Activity_01-1.001 file, and then click Open. Click Next.

6.Keep the default settings in the Configure Ingest Modules window. Click Next and then click Finish.[Figure 1-16 Optional Information pane of Autopsy] [Figure 1-17 Add Data Source window of Autopsy]

Next, complete these steps to display the contents of the acquired data:

1.In the Tree Viewer pane on the left, expand Views, File Types, By Extension, and Documents by clicking the plus sign next to each folder (see Figure 1-18).

2.Under Documents, click Office. In the Result Viewer (upper-right pane), click the last file, Contract with Martha.docx, to display its contents in the Content Viewer (lower-right pane).

3.Right-click Contract with Martha.docx, select Add File Tag, and click Tag and Comment. 3 / 4

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884;

Module 1: Understanding the Digital Forensics Profession and Investigations

3 © 2025 Cengage. All Rights Reserved. May not be scanned, copied or duplicated, or posted to a publicly accessible website, in whole or in part.

• In the Select Tag dialog box, click the New Tag button. In the New Tag section of the

Create Tag dialog box, type Recovered Office Documents in the Tag Name text box (see Figure 1-19), click OK, and then click OK again.

• Right-click Contract with Martha.docx again, and then click Extract File(s). In the Save

window, click Save, and then click OK.[Figure 1-18 Expanded tree view of files in Autopsy] [Figure 1-19 Create Tag dialog box in Autopsy]

• In the Tree Viewer pane, click the plus sign to expand the Deleted Files folder, and then

click the All (2) folder. Next, you will select the files and explore what is there.

• In the Result Viewer pane, click ~$George Presentation.pptx. In the Content Viewer pane,

make note of George’s last name, then click File, and then click Exit to close Autopsy.

• Open Notepad, and type George’s first and last names as they appeared in the Content

Viewer pane in step 7. Save this file as Activity_01-1_George to your Work folder and exit Notepad.

• Start File Explorer and navigate to subfolder Activity_01-1\Export in your Work folder and

copy the file Contract with Martha.docx to your Work folder.

10. Submit to your instructor the following files:

• Activity_01-1_George.txt • Contract_with_Martha.docx Solution Guidance: This activity is a brief introduction to Autopsy for Windows. By completing the steps in this activity, students should learn how to initiate a digital forensics examination and how to navigate and use some of the features available in Autopsy. To show successful completion of this activity, students should submit the two documents listed in the final step. For examples of the contents of these

documents, see the following solution files:

• Solution_Activity_01-1_George.pdf • Solution_Contract with Martha.pdf Review Questions - Answers

• Digital forensics and data recovery refer to the same activities. True or False?

Answer: False

Explanation: In data recovery, you typically know what you’re looking for. Digital forensics is the task of recovering data that users have hidden or deleted, with the goal of ensuring that the recovered data is valid so it can be used as evidence.

• / 4