ITSY 2343 - South Plains College - Lab Assignment Chapter 8

ITSY 2343 - South Plains College - Lab Assignment Chapter 8 Maria Botello ITSY 2343.271 Professor Walton January 26, 2020 LAB 8.1 1. How many deleted files are in the Videos folder?  24  14  12  8 2. How many different cameras (denoted as “device models“) did you find in the evidence?  2  125  14  84 3. What file system is used in the jo-favorites-usb-.E01 image? FAT32 4. Autopsy doesn’t provide camera information, such as exposure time or flash use. True or False? 5. Autopsy displays hash values for video files. True or False? LAB 8.2 6. What date was the first video created? 11/20/2009 7. How many QuickTime videos (.mov files) are listed in the jo-favorites-usb-.E01 Videos folder? 4 8. OSForensics has a built-in viewer to play video files. True or False? 9. According to the HTML report you created, what’s the create date for the MontereyKitty.m4v file? (Hint: Look under Other Artifacts, Files.)  11/21/2009, 4:36:30  11/20/2009, 8:57:26  11/11/2009, 9:16:56  11/18/2009, 4:36:30 10. In this lab, you viewed information about the DSC.JPG file in the File Info tab of the File and Hex Viewer window. What’s the starting logical cluster number (LCN) for this file?  16,692  335,872  334,501  15,592 LAB 8.3 11. How many duplicate JPG files are in the jo-favorites-usb-.E01 image?  55  98  84  49 12. What’s the MD5 hash value of the C file?  994FBFDDE904FCC1B7  AF72ABAF3E16CFB9758C8F82524C0C55 13. How many deleted MOV and M4V files are in jo-favorites-usb-.E01?  12  13  18  6 14. All the JPG and M4V files in the jo-favorites-usb-.E01 image were last modified on the same date. True or False? 15. The jo-favorites-usb-.E01 image contains a system file named shutdown_time. What folder is it in, and when was it last modified?  .Spotlight-V100Store-V1StoresBC650BA8-C5B5-4A64-8BDB-18A9522BF1D, 11/20/2009 at 09:30:24  .Spotlight-V100Store-V1StoresBC650BA8-C5B5-4A64-8BDB-18A9522BF1D, 11/17/2009 at 16:45:45  .Spotlight-V100Store-V1StoresBC650BA8-C5B5-4A64-8BDB-18A9522BF1D, 11/20/2009 at 09:31:00  .Spotlight-V100Store-V1StoresBC650BA8-C5B5-4A64-8BDB-18A9522BF1D, 11/17/2009 at 16:46:55