Access over 20 million homework & study documents
search

Recovering Deleted Data Using Autopsy Study Notes

Content type

User Generated

Subject

Informatics

Type

Other

Rating

Showing Page:
1/5
Recovering Deleted Data using Autopsy
Download Sleuth Kit/Autopsy (https://www.sleuthkit.org/). After
downloading the software, then follow these steps in order to recover
deleted data. Autopsy is a great way to analyze data, but not the best
software for acquiring data.
Worth 100 points
Prepping Your Base Directory:
Go out to Windows Explorer and build a new folder. Title this Folder
“Deleted Data”. This will be your destination folder for the data/files
your recover. So remember where you built the folder.
*In a real case, you would want this base directory to be on either an
external drive or a separate HD on your forensic workstation. Not the
best to use the C: drive, but for our lab, you can either use the C: drive
or another USB/External Drive on your computer.
Prepping Your USB:
For this lab, use an empty, small (USB
Take your USB and load the 3 files (Dog.jpg, Cyber.jpg, and Artifact
Reference.pdf) from Canvas screen. Provide a screenshot of the 3 files
loaded on your USB.

Sign up to view the full document!

lock_open Sign Up
Showing Page:
2/5
Go out and get the hash values for the 3 files and save them to a .txt
in your Deleted Data folder. Provide a screenshot of your hash values.
Now go out and delete the 3 files on your USB.
After deleting your files provide a screenshot of your empty USB.

Sign up to view the full document!

lock_open Sign Up
Showing Page:
3/5

Sign up to view the full document!

lock_open Sign Up

Unformatted Attachment Preview

Recovering Deleted Data using Autopsy Download Sleuth Kit/Autopsy (https://www.sleuthkit.org/). After downloading the software, then follow these steps in order to recover deleted data. Autopsy is a great way to analyze data, but not the best software for acquiring data. Worth 100 points Prepping Your Base Directory: ☐ Go out to Windows Explorer and build a new folder. Title this Folder “Deleted Data”. This will be your destination folder for the data/files your recover. So remember where you built the folder. *In a real case, you would want this base directory to be on either an external drive or a separate HD on your forensic workstation. Not the best to use the C: drive, but for our lab, you can either use the C: drive or another USB/External Drive on your computer. Prepping Your USB: ☐ For this lab, use an empty, small (USB ☐ Take your USB and load the 3 files (Dog.jpg, Cyber.jpg, and Artifact Reference.pdf) from Canvas screen. Provide a screenshot of the 3 files loaded on your USB. ☐ Go out and get the hash values for the 3 files and save them to a .txt in your Deleted Data folder. Provide a screenshot of your hash values. ☐ Now go out and delete the 3 files on your USB. ☐ After deleting your files provide a screenshot of your empty USB. Launching Autopsy ☐ Find your Autopsy app on your desktop (or wherever you stored it). The icon looks like this: Click on to launch the program. ☐ Create a new case. Make sure you fill out the information (make ...
Purchase document to see full attachment
User generated content is uploaded by users for the purposes of learning and should be used following Studypool's honor code & terms of service.

Anonymous
I was having a hard time with this subject, and this was a great help.

Studypool
4.7
Trustpilot
4.5
Sitejabber
4.4