This chapter introduced the MS7Patents case, which is a hypothetical case create

Question

This chapter introduced the MS7Patents case, which is a hypothetical case created for new investigators to practice on real data. In this project, you examine the USB drive of Terry, the IT person. Your job is to ascertain whether Terry is involved in anything illicit or against company policy. Start OSForensics. If prompted to allow the program to make changes to your computer, click OK or Yes. In the OSForensics message box, click Continue Using Free Version. Click Start in the left pane, if necessary. In the right pane, click Create Case. In the New Case dialog box, enter your name in the Investigator text box. In the Case Name text box, type MS7-Terrys USB drive. Fill in the contact details and the organization, and then click Investigate Disk(s) from Another Machine. Click Custom Location for the case folder, Click the Browse button on the lower right, navigate to and click your WorkChap 04 Projects folder, and then click OK twice. You should see the Manage Case window Click the Add Device button to open the "Select device to add" dialog box, and then dick the Image File option button. Click the browse button, navigate to the folder you copied images to, and click terry-work-unb-2009-12-11.K01. Click. Open. In the message box asking which partition to use, leave the default setting use entire image file, and then dick OK. Click OK to close the "Select device to add dialog box. Click the terry-work-unb-2009-12-11.K01 filename at the lower right, and then click the Open button to the left to open the File System Browser window. Click the File Name Search icon in the File System Browser window or the left pane of the main window. In the Search String text box, type kitty. On the far right, click the Search button. Notice that the "kitty porn" isn't on his USB drive. Click the Create Index button in the left pane. In the Step 1 of 5 window, click the Pre-determined File Types option button, click all the file types listed, and then click Next. In the Step 2 of 5 window, click Charlie's USB image and click Remove to delete it from the list box, if necessary Click Add, click terry-work-unb-2009-12-11 click OK, and then click Next. In the Step 3 of 5 window, type Index all file types in the Index Title text box, and then dick Start Indexing. When the indexing is finished, which might take up to an hour, click OK in the message box. Click the Open Log button at the lower right, and examine the log. Notice whether any errors were reported and the number of files processed, and then close the log. Click the Manage Case button in the left pane. In the lower right pane, double-click Terrys USB under the Devices heading, open any text or picture files, and examine them. Scroll to the bottom of the left pane, and click the Exit button. Write a one to two-page paper explaining the importance of the files you examined. How might they affect a patent case?

Explanation / Answer

We have done the investigation of the data of Terrys Pendrive. Pendrive contains following data.

1) Pictures: In pendrive we have observed Terry's personal and family photos. Pendrive can have pics to no problem in it.

2.) Third Party Softwares: In pendrive i have also observed some of the third party softwares executable files. These executable files are not wanted because these are third party software executable and these files can have malicious code or the virus.

3.) Video Files: I have also observed some of the video contents with in the pendrive. These are the personal video of Terry's family. So no problem with these video.

4.) Company Documents: I have also observed some of the company related presentations and the documents inside the pendrive. These documents are confidential and are allowed to access only on company computers. As these documents are on Terry's pendrive, so its not ok at all.

5.) Pdf files: I have also seen pdf files in the pendrive. These pdf files are realted to latest technologies and some education topics. No problem with these pdf files. As these pdf files are open sources and free available to every one for access.

For the contents we got from Terry's pendrive, we can draw conclusion that Terry's is accused for storing company related confidential data in the pendrive. If this pendrive goes to any other organziation then it can harm the present company alot.

Related Questions

Navigate

• Browse (All)
• Browse T
• Subjects

---

---

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.