Lab4USB10a001 WinHex Lost Directories Used the Find Text search function to

Lab4usb10a001 winhex lost directories used the find

This preview shows page 2 - 4 out of 4 pages.

and found to include a password that was used to decrypt files. Lab4_USB10a.001 – WinHex - Lost Directories Used the “Find Text” search function to look for “..” which indicates a sub-directory. Upon discovery of a valid sub-directory, records are decoded using WinHex’s template manager function. Time stamps for files were recorded and an anomaly was discovered with one file. One file was created a year earlier than the rest of the files. Lab4_USB10a.001 – WinHex - Lost Directories Files found in the Instructor directory were inspected and attempts were made to correlate files if the offset of files matched. Discoveries included files with mismatched extensions, changing these extensions allowed for further examination of containing information. These files were exported to the case folder for later use Conclusion: After thorough analysis of data found on the evidence items, we can answer the following questions: Page 2 of 4
Image of page 2
What information has been hidden in this reference image?
Image of page 3
Image of page 4

You've reached the end of your free preview.

Want to read all 4 pages?

  • Fall '14
  • Computer file formats, Filename extension, Computer file

  • Left Quote Icon

    Student Picture

  • Left Quote Icon

    Student Picture

  • Left Quote Icon

    Student Picture