Question

Which files were discovered by the hash set? Do they look familiar? 2. Review the list of suspicious processes found running on Pat’s computer in Module 2. Can their corresponding program(s) be found on Pat’s hard drive? 3. Based on the evidence so far, what action(s) did Terry take that may be relevant to the M57 Patents investigation? 4. Is Pat guilty of any crimes? If so, which?

          Which files were discovered by the hash set? Do they look familiar?
2. Review the list of suspicious processes found running on Pat’s computer in Module
2. Can their corresponding program(s) be found on Pat’s hard drive?
3. Based on the evidence so far, what action(s) did Terry take that may be relevant to
the M57 Patents investigation?
4. Is Pat guilty of any crimes? If so, which?

Show more…

Added by Barbara O.

Computer Science and Information Technology

Trishna Knowledge Systems 2018 Edition

Instant Answer

Solved by Expert Donna Densmore

Step 1

- Review the hash set results to determine which files were flagged. - Compare these files against known databases to see if they are recognized or familiar. Show more…

Show all steps

lock

Please give Ace some feedback

Your feedback will help us improve your experience

Thanks for your feedback!

Which files were discovered by the hash set? Do they look familiar? 2. Review the list of suspicious processes found running on Pat’s computer in Module 2. Can their corresponding program(s) be found on Pat’s hard drive? 3. Based on the evidence so far, what action(s) did Terry take that may be relevant to the M57 Patents investigation? 4. Is Pat guilty of any crimes? If so, which?

Play audio

Feedback

Powered by NumerAI

Donna Densmore and 87 other subject AP CS educators are ready to help you.

Ask a new question

Labs

Want to see this concept in action?

NEW

Explore this concept interactively to see how it behaves as you change inputs.

View Labs

Key Concepts

Key Concept

Premium Feature

Explore the core concept behind this problem.

Key Concept

Premium Feature

Explore the core concept behind this problem.

Recommended Videos

texts-190-chapter-4-processing-crime-and-incident-scenes-hands-on-project-4-3-in-this-project-you-examine-a-usb-drive-belonging-to-terry-the-it-person-for-m57-patents-your-job-is-to-ascertai-13678

Hands-On Project 4-3 In this project, you examine a USB drive belonging to Terry, the IT person for M57 Patents. Your job is to ascertain whether Terry is involved in anything illicit or against company policy. 1. Start OSForensics. If necessary, click OK or Yes in the UAC message box. In the OSForensics message box, click Continue Using Trial Version. 2. Click Start in the left pane, if necessary. In the right pane, click Create Case. 3. In the New Case dialog box, enter your name in the Investigator text box. In the Case Name text box, type M57-Terrys USB drive. Fill in the contact details and the organization, and then click Investigate Disk(s) from Another Machine. 4. Click Custom Location for the case folder. Click the Browse button on the lower right, navigate to and click your work folder, and then click OK twice. You should see the Manage Case window. 5. Click the Add Device button to open the "Select device to add" dialog box, and then click the Image File option button. Click the browse button, navigate to the folder you copied images to, and click terry-work-usb-2009-12-11.E01. Click Open. 6. In the message box asking which partition to use, leave the default setting for using the entire image file, and then click OK. Click OK to close the "Select device to add" dialog box. 7. Click the terry-work-usb-2009-12-11.E01 filename at the lower right, and then click the Open button to the left to open the File System Browser window. 8. Click the File Name Search icon in the File System Browser window or the left pane of the main window. In the Search String text box, type kitty*. On the far right, click the Search button. Notice that the "kitty porn" isn't on his USB drive. 9. Click the Create Index button in the left pane. (Note: You might have to click New Index if the window is showing the results from the index of Charlie's USB drive.) In the Step 1 of 5 window, click the Use Pre-defined File Types option button, click all the file types listed, and then click Next. 10. In the Step 2 of 5 window, click Charlie's USB image and click Remove to delete it from the list box, if necessary. Click Add, click terry-work-usb-2009-12-11.E01, click OK, and then click Next. 11. In the Step 3 of 5 window, type Index all file types in the Index Title text box, and then click Start Indexing. When the indexing is finished, which might take up to an hour, click OK in the message box. 12. Click the Open Log button at the lower right, and examine the log. Notice whether any errors were reported and the number of files processed, and then close the log. 13. Click the Manage Case button in the left pane. In the lower-right pane, double-click Terrys USB under the Devices heading, open any text or picture files, and examine them. 14. Scroll to the bottom of the left pane, and click the Exit button. Write a one- to two-page paper explaining the importance of the files you examined. How might they affect a patent case? When you're finished, exit OSForensics.

Akash M.

projectforensic-investigation-part-2-analvzing-an-emall-archive-for-an-electronic-discovery-investigaiion-scenarlo-db-is-conducting-a-very-large-electronic-discovery-ediscovery-investigation-77485

Project: Forensic Investigation Part 2: Analyzing an Email Archive for an Electronic Discovery Investigation Scenario D&B is conducting a very large electronic discovery (eDiscovery) investigation for a major client. This case is so large that dozens of investigators and analysts are working on specific portions of the evidence in parallel to save time and improve efficiency. Since this is the first time you will be working on this type of investigation for D&B, your manager gives you a "test" (a sample email archive) so she can assess whether you need additional training before you begin working with the rest of the team on the eDiscovery case. Your manager tells you that this archive was extracted from a hard drive image marked "suspect," but at present, nothing more is known about the user. She expects you to examine the archive and document all findings that might be of interest to a forensic investigator. She explains that she will use your report to evaluate your investigation skills, logic and reasoning abilities, and reporting methods. Tasks: • Review the information about email forensics and Paraben P2 Commander E-mail Examiner (EMX) in the chapter titled "Email Forensics" in the course textbook. • Using P2 Commander E-mail Examiner, create a case file, select Add Evidence, and import the email archive (filename: Outlook.pst). P2 Commander will automatically begin sorting and indexing if you choose that option. • Search for information about the user; your goal is to learn as much as possible about who the user is and what he or she has been doing. You may find evidence in the inbox or other mailboxes. You can use E-mail Examiner features to help you keep track of the evidence you identify, for instance, by bookmarking sections of interest and exporting attachments. • Write a report in which you: ◦ Document your investigation methods. ◦ Document your findings. Explain what you found that may be of interest to a forensic investigator, and provide your rationale for including each selection.

Akash M.

is-jo-the-owner-of-the-files-you-found-from-the-usb-drives-what-evidence-is-there-to-confirm-or-reject-this-how-dlid-the-computer-come-t0-be-sold-on-the-secondary-marketcraigslist-who-if-any-64437

Akash M.

Recommended Textbooks

Computer Science and Information Technology

Computer Science and Information Technology

Trishna Knowledge Systems 2018 Edition

achievement

1,682 solutions

Introduction to Programming Using Python

Introduction to Programming Using Python

Y. Daniel Liang 1st Edition

achievement

1,588 solutions

Computer Science - An Overview

Computer Science - An Overview

Glenn Brookshear, Dennis Brylow 12th Edition

achievement

1,872 solutions

Need help? Use Ace

Ace is your personal tutor. It breaks down any question with clear steps so you can learn.

Start Using Ace

Ace is your personal tutor for learning

Step-by-step explanations

Instant summaries

Summarize YouTube videos

Understand textbook images or PDFs

Study tools like quizzes and flashcards

Listen to your notes as a podcast

Continue solving this problem

Create a free account to:

View full step-by-step solution
Ask follow-up questions with Ace AI
Save progress and study later

Join the community

18,000,000+

Students on Numerade

Trusted by students at 8,000+ universities

Get step-by-step video solution
from top educators

Start your free 7-day trial, Sign up now.

Continue with Clever

or

Name

Email

Password

By creating an account, you agree to the Terms of Service and Privacy Policy

Already have an account? Log In

A free answer
just for you

Watch the video solution with this free unlock.

Log in to watch this video
...and 100,000,000 more!

EMAIL

PASSWORD

OR

Continue with Clever