and found to include a password that was used to decrypt files. Lab4_USB10a.001 – WinHex - Lost Directories Used the “Find Text” search function to look for “..” which indicates a sub-directory. Upon discovery of a valid sub-directory, records are decoded using WinHex’s template manager function. Time stamps for files were recorded and an anomaly was discovered with one file. One file was created a year earlier than the rest of the files. Lab4_USB10a.001 – WinHex - Lost Directories Files found in the Instructor directory were inspected and attempts were made to correlate files if the offset of files matched. Discoveries included files with mismatched extensions, changing these extensions allowed for further examination of containing information. These files were exported to the case folder for later use Conclusion: After thorough analysis of data found on the evidence items, we can answer the following questions: Page 2 of 4
What information has been hidden in this reference image?
You've reached the end of your free preview.
Want to read all 4 pages?
- Fall '14
- Computer file formats, Filename extension, Computer file