Hands-On Project 6-1 In this project, you create and delete Word and Excel files

Question

Hands-On Project 6-1

In this project, you create and delete Word and Excel files on a USB drive (or small disk partition, if you don’t have a USB drive), and then use OSForensics to examine the drive. Follow these steps:

1. Create a C6Prj01 folders on your USB drive or disk partition.

2. Open a new document in Word, and type This is to test deletings files and then wiping them. Save th file in the C6Prj01 folder as Test 6-1.docx, and exit Word.

3. Open a new workbook in Excel. Type a few numbers, and then save the workbook in the C6Prj01 folder as Test 6-2.xlsx. Exit Excel.

4. Use Windows Explorer or My Computer to delete both files from the USB or disk drive.

5. Start OSForensics, and start a new case. Type C6Prj01 for the case name, and enter Ailen for the investigator. Leave the Acquisition Type option as Live Acquisition of Current Machine, and specify the work folder you created for this chapter. Create a subfolder called C6Prj01, and click OK.

6. If necessary, click Manage Case in the left pane, and then click the Add Device button in the right pane. Click the drive letter of your USB device, make sure the Forensics mode option button is selected, and click OK.

7. Make sure the case you just created has a green check mark next to it; if not, double-click the case name, and then click Start in the left pane. Using the scroll bar on the far right, scroll down and click the Deleted Files & Data Carving icon. In the Deleted Files Search window, click the Disk list arrow, and then click the USB drive in the list of options. Click the Search button. Because you're searching for deleted files, you don't need to enter a file string or filter.

8. Double-click the Test 6-1.docx file in the lower pane to view its contents. You can also click the File Info tab to verify the file's MAC time. Repeat this process with the Test 6-2.xlsx file.

9. Close all open windows, and exit OSForensics.

Explanation / Answer

Creating a USB recovery drive

Surface comes with a built-in tool to create a USB recovery drive. You must use an external USB drive formatted to FAT32 (not NTFS), with enough available space for all your recovery data.

Creating a Surface recovery drive will erase everything that’s stored on your USB drive. Make sure to transfer any important data on your USB drive to another storage device before using it to create a recovery drive.

For steps on how to create a USB recovery drive, go to Create a recovery drive.

Once you’ve finished creating the recovery drive, be sure to eject the drive using the Safely Remove Hardware and Eject Media icon on the Windows taskbar.

If you choose to delete your recovery partition, you’ll need your USB recovery drive if you ever have to refresh or reset your Surface. Be sure to keep it in a safe place. It's best not to use the recovery drive to store other files or data.

How to start your Surface using your USB recovery drive

Step 1: Make sure your Surface is turned off and plugged in, and then insert your USB recovery drive into the USB port on your Surface. Step 2: Press and hold the volume-down button while you press and release the power button on your Surface. Step 3: When the Microsoft or Surface logo appears, release the volume button.

Note You can also boot from the recovery drive through Windows. To do this: Step 1: Insert the USB recovery drive into the USB port and then go to Start, select Settings > Update & security > Recovery. Step 2: Under Advanced startup, select Restart Now.

Related Questions

Navigate

• Browse (All)
• Browse H
• Subjects

---

---

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.