Quiz Computer Forensic & Investigation Essay

Hanley Strappman, 37, was trying to catch out about the Computer and Digital Forensics program at Champlain College. He was open to obtain some archives, which he put on a floppy disk. To disguise his espionage, he decided to smuggle the floppy back fundament after altering the files so that they couldnt be read using the ordinary DOS/Windows file manager.His deception was discovered, however, and the floppy has been recovered. Some of your counterparts pay off already tried to examine the disk to no avail. Upon discussions with Hanley, he has boasted that on that point argon three files on the disk but that Youll never whap what I got You are being admitd with a forensically true and accurate replicate of Hanleys floppy disk. You are asked to examine the floppy disk and provide answers to a few questions about the integrity of the data that was recovered (in price of maintaining the evidentiary chain), the recovery of certain information, and any actions that the suspect may thrust taken to intentionally delete, hide and/or alter data on the floppy disk. Good LuckUsing the software tools provided to you in class, analyze the disk and conduct a full analysis of any artifacts comprise on the media. The following questions must be completed in the measure allottedThe Questions 1. What is the name and address of the person to whom Hanley wrote a letter?Dr. bum Watson 8295 Martha Lane Los Alamitos, CA 907202. Who is in the picture that Hanley obtained?Lewis Carroll, Edith, Lorina and Alice Lidell3. What is the information that Hanley supplied in a password-protected form?A file named curriculum in Microsoft Excel format.4. What are the names of the files on the floppy? Each was hidden or obscured in a different way indicate how you found the files and how you recovered the information.The file name is cc_stuff.exe Change the format to the .zip format and enter the password to pass away the information5. Where did you find the password?By using PRT K software, inside the record image at the pwd