Data recovering with accessdata ftk imager

DATA RECOVERING WITH ACCESSDATA FTK IMAGER WINDOWS

He had hundreds of nude pictures of children obviously under the age of 18. Later, the forensic examiner found that Johnson had been trading child pornography over the Internet. Though the e-mails were not explicit, the investigators could prove that Johnson and the student had been having a sexual relationship. Johnson had reportedly set up an e-mail account for the girl in his wifeвЂ™s name. The investigators were able to verify that Johnson and the student exchanged e-mails. During the search, they seized his laptop and desktopcomputer. Johnson continued to deny the girlвЂ™s claims concerning their sexual relationship. JohnsonвЂ™s bedroom matched the description given by the student in an interview with a female police officer. This triggered an investigation by the Adams County SheriffвЂ™s Department. Several months later, the student told her cousins about the relationship. Since school officials had no evidence of the relationship, they could only issue a warning. During his tenure as a teacher, there were rumors around the school campus about an inappropriate relationship between him and a female student. Jeremy Johnson, 26, was hired by Adams Central School District as a teacher. User Datagram Protocol (UDP)a nonreliable protocol that implements a best-effort set of rules that allow for network communication where exact delivery of each packet is not critical, such as for streaming video Transmission Control Protocol (TCP)a protocol that implements a core set of rules that allow reliable connection-oriented connections between host computers over a network Sparse data copya copy that an investigator makes of only part of a large set of data in which only the data pertinent to the investigation is included, in order to reduce the overall size of the evidence file this technique is often used when copying data from RAID arrays, when dealing with terabytes or petabytes of information, or when only specific evidence is needed

DATA RECOVERING WITH ACCESSDATA FTK IMAGER WINDOWS

в– Select Windows Securityfrom the Utilities (Figure 1-52).ДЇigure 1-52Select Windows Securityfrom the Utilities.ДЄfter completing this chapter, you should be able to:Дetermine the best data acquisition methodsДata acquisitionthe act of taking possession of or obtaining control of data and adding it to a collection of evidenceДata duplicationthe act of making a copy of data already acquired to preserve the original evidence in pristine condition Browse the image file and message file, and click the Encryptbutton (Figure 1-51).ДЇigure 1-51Browse the image and message files, and click the Encryptbutton. в– Select Steganography 2.8from the Utilities menu. в– Install and launch the FortKnox program.ДЇigure 1-50Explore the various options in FortKnox. Use the FortKnox program to hide data within another file.в– To extract embedded data from stg.jpg, use the following command: steghide extract -sf в– To embed emb.txt in cvr.jpg, use the following command: steghide embed -cf cvr.jpg -ef emb.txt. в– Open the StegHide program in the command shell (Figure 1-49).ДЇigure 1-49Open the StegHide program in the command shell.

Use the StegHide program to hide text in images.

в– Right-click the hidden datawindow and select Save(Figure 1-48).ДЇigure 1-48Right-click the hidden datawindow and save the file. в– Select a file to be hidden and drag that file inside the window of the WAV file в– Drag a WAV file from Windows Explorer to the Actionswindow (Figure 1-45).ДЇigure 1-45Drag a WAV file to the Actionswindow. в– Install and launch the S-Tools program (Figure 1-44).ДЇigure 1-44Install and launch the S-Tools program. в– Navigate to Chapter 1 of the Student Resource Center. Use the S-Tools program to hide a file inside a WAV file.

Data recovering with accessdata ftk imager