80%(5)4 out of 5 people found this document helpful
This preview shows page 21 - 27 out of 29 pages.
Analysis and Discussion1)In your own words, explain why is it important to use tools like WinAudit, DevManView,and Frhed.2)In the lab, you used Frhed to investigate a file, but Frhed can also be used to investigate disk drives. Open a remote connection to TargetWindows01 and use Fhred to investigate the 10GB disk drive. Identify the partition format and its hex code. Make a screen captureshowing your results.
3)Open a remote connection to the TargetWindows01 machine and use Frhed to open the cert_efs.pfx certificate file (C:\ISSA_TOOLS\ForensicsTools\cert_efs.pfx). Identify the encryption format and the user account the encrypted certificate was issued by. Make a screen capture showing your findings.
Lab #2 - Assessment WorksheetDocumenting a Workstation Configuration using CommonForensic ToolsCourse Name and Number:___ITN 276_______________________________________________________Student Name:_____Haris Ahmad Haidari__________________________________________Instructor Name:___________H. RazaqM.S.________________________________________Lab Due Date:____