Digital Forensics Report Analysis

This assignment involves analyzing a detailed digital forensics report that outlines the procedures used to recover and analyze data from seized computer hard drives. The report details the software tools employed (AccessData® FTK®, ProDiscover, OSForensics), their functionalities, and comparisons. It also includes information about the recovered evidence, the case's context, and potential legal implications.

CYBER FORENSICS REPORT

2
Abstract
The following case file documents the investigation that was done on the machine that was owned
by Aaron Greene who bought it from the second hand market. The machine originally belonged to
Jo, a M57 employee, and the machine was a workstation in the M57 organization. Aaron Greene, the
current owner of the machine, found suspicious elements in the machine and surrendered the
machine to the police for investigation. On investigation, certain files were found in the machine
that could suggest that Jo was involved in dealing and production of amphetamine and
methamphetamine. Two hard drive images of the machine were made of two different dates and
investigators analysed, examined and used with various software to look into the digital copies of
the hard drive without tampering the original machine. The investigation shows the recording of an
excel sheet which suggests that the suspect may have been involved in the negotiation of a
transaction regarding the sale of the drugs. The suspect may have also been involved in the
production of methamphetamine and amphetamine. Further investigation has lighted on a certain
amount of tampering that has occurred on the digital copy of the hard drive made on the second day
that could indicate ‘foul play’ on the part of the police, negligence done either intentionally or
accidental, and the involvement of suspect in an attempt to destroy digital evidence. Information
has been extracted for the second hard drive that could suggest that the suspect was trying to
destroy physical evidence as well by the use of certain chemicals. The investigation procedure is
followed in the way to either prove or disprove the charges set against the suspects involved in this
case.

3
Table of Contents
1. Abstract 2
2. Body of Report 4
a. Character Profile 4
i. Main Character Profile 4
1. Profile – Jo 4
ii. Minor Character Profile 4
1. Company Profile – M57 4
2. Public Department Profile – Police Department 4
3. Public Department Profile – Police Department 4
b. Case Background 5
c. The Investigation Procedure 6
d. Investigation Findings – Inculpatory Evidence 9
i. Suspicion in dealing with Amphetamine and Methamphetamine
ii. Production of Amphetamine and Methamphetamine 12
iii. Suspicion in Selling of Amphetamine and Methamphetamine
14
iv. Tampering of Physical Evidence 17
e. Time Line of Events 27
f. Case Summary 28
3. Conclusion 29
4. References 30
5. Appendices 31
1. Body of Report
a. Character Profile

4
i. Main Character Profile
1. Profile – Jo
Name: Jo
E-mail Address: N/A
Role: Original owner of the suspect’s computer.
Suspicions: Production of illegal substances, purchase and sales of illegal substances,
tampering of evidence.
Presumed IP Address: 10.2.84.4.[1]
Organization M57
Notes: [1] Obtained from browser cookies that was stored while the computer
was in Jo’s possession.
ii. Minor Character Profile
2. Company Profile – M57
Name: M57
E-mail Address: N/A
Role: Employer of the suspect/seized computer was the workstation of this
organization
Suspicions: Involvement in purchase and sales of illegal substances, drug production,
drug trade, harbouring a drug-seller and drug-producer
Job Patent search Company
Notes: The seized computer belonged to the M57 organization and the use of
such computer for any purpose was done in the organization itself.
3. Public Department Profile – Police Department
Name: Police Department
E-mail Address: N/A
Role: Tampering of evidence, probably out of negligence
Suspicions: Collusion with the suspect, wilful negligence in job, tampering of
evidence due to intentional negligence

5
Job Law-enforcement
Notes: The two hard drive images extracted from the seized computer has been
compared to be different with the second image being tampered with.
Such tampering has been noted to be done due to the negligence of the
police, but that suggests a ‘foul-play’ involved on the police’s part and
needs to be investigated further to arrive at a proper conclusion.
b. Case Background
The machine that has been possessed and investigated is lately owned by Aaron Greene who had
bought the device in question from a second-hand market. After the transference of ownership of
the device, the current owner of the machine, Aaron Greene, discovers that the previous data of the
computer has not been erased. On analysis of the said data, Aaron Greene finds out suspicious
documents and videos on the drive that could be related to the buying, creating, possessing and
selling of methamphetamines, an illegal drug that is slowly becoming a bane to the society. Aaron
reports his findings to the police and the machine in question is handed over for further
investigation into the matter.
From the analysis of the machine, it has been found out that the computer can be traced back to be
used as a former workstation by Jo, a M57 employee, as a work machine. The machine was thus
originally belonged to the m57.biz, a new patent search company that researches patent
information of its clients. After such a major discovery, the CEO of M57, Pat McGoo was contacted
by the police who granted the permission for the imaging of all the computers that was being used
or has been used before by the M57 organization to support additional investigation.
However, there are evidences that suggest that the evidence extraction has not been flawless. There
are certain evidences such as the differences between the images of the hard drive that points out
that the police assigned to collect the evidence have somehow tampered with the evidence.
However, the forensics experts have tried to document such differences in the evidence, retraced
back some of the tampered evidence to bring about a more genuine case that might follow the real
events that might have been transpired through the machine in question (Berger & Heath , 2007).
Such a foul-play has also been taken into account as a negligible act on the part of the police, but it is
yet to be seen whether the negligence committed by the police was unintentional or not. The
investigators had tried to use hex editing and other software functions to try and find out how the
‘foul-play’ has occurred, the lost information and whether the tampering of the said information was

6
intentional or not. Hence, the contamination of the evidence and the comparison of the two image
files of the original machine extracted from the device in question is also an important part of the
case.
The police as in pursuit of the thumb drive of the suspect, Jo, who is an employee of the
organization, M57. After the permission granted by the CEO of the organization, the police shall be
imaging the remaining workstation of the said organization and in the process, try to find out how
the specific organization or the workstation of that specific organization, or the employee employed
in the organization had come about to become involved in this specific case regarding the exchange
and use of drugs.
c. The Investigation Procedure
After creating a digital copy of the machine, all the investigation procedure has been conducted on
the copy of the ‘live’ data or the original machine, thereby preventing any accidental tampering of
evidence in the process so as to preserve the integrity of the evidence as it is.
The investigation on the machine was conducted by the use of various software which are as
follows:
- Access Data® FTK® Imager Version 4.1.1.1
- ProDiscover Version 7.0.0.3
- OSForensics
These software has been used to investigate the materials extracted from the device in question.
The materials found are
 Hard drive image 2009-11-19.E01 (of the original sold computer) – E01
 Second drive image purporting to be of the same computer – AD1, AD2
 Hard drive image 2009-12-01.E01 (of the suspect’s replacement computer seize from M57) –
E01
 Second drive image purporting to be of the same computer – AD1, AD2, AD3
The hard drive images were extracted by using FTK Imager by the use of Forensic Acquisition feature,
thereby creating a physical image of the drive in question.
The investigation process is mainly comprised sifting through the files of the computer and making
sure to gather inculpatory evidences that could be used as a base to set up an argument for or
against the owner of the computer, Jo, the employee of M57 organization. The sifting procedure has

7
been done using the FTK Imager software to mount and read the hard drive images that have been
extracted from the device and the use of ProDiscover to sift through the files of the suspect
computer and make a timeline out of it. The OSForensics software has been used to create a hash
lookup and make the system files in the hard drive image invisible so that it would be possible for
the investigators to concentration on the specific files that has been presented in the drive image.
The Windows 7 hash set has been used to hide the system files of windows and provide the normal
documents for the work to be done. Fig 1 shows the use of the hash set to bring out the necessary
files downloaded by the user of or related to methamphetamine of amphetamine. There has been
only one encrypted file process in the drive that could inculpate the suspect as a seller of the drugs
that has been searched for using the device in question (Duan, Gu & Whinston, 2008).
Additionally, file slack tools and file slack analysis tools from the OSForensics software has been used
to locate files whose extensions have been changed to conceal the file from the eyes of the
investigators. Other tools to reveal concealed hidden folders and files, encrypted data and protected
documents have been used during the investigation procedure so as to go through a thorough
analysis of the drive image and make sure that none of the evidence is overlooked during the
investigation process.
The use of these software and method have allowed the investigator to go through the device and
form a proper narrative that could be assumed to be closer to the reality of the past events and so
that the investigation could be performed in a swift and accurate manner with the least amount of
contamination creeping into the drive images that have been extracted from the device in question.
Such methods have also been used to make comparison between the two separate file images that
have been collected by the investigators and to try and point out the changes that has taken place
between the two imaged due or the ‘tampering’ of the evidence by the ‘foul play’ of the police. The
investigators have also tried by these methods to restore the conditions of the files that has been
tampered with to the best of their ability and to document the tampering and try to set up a proper
investigative narrative to discuss the nature of the tampering that has taken place.

8
Fig 1: The use of hash set to bring out the files that have been downloaded by the user of the
computer, related to the case in question.

9
Fig 1.1: The use of hex viewer from OSForensics to view the hex of the email file sends out
by the suspect
d. Investigation Finding – Inculpatory Evidences:
i. Suspicion in dealing with Amphetamine and Methamphetamine:
The investigation discovered that on 14-04-2008, Jo has searched and downloaded several
video documents on Amphetamine and Methamphetamine. The first step was to look into
the nature of such video and try to find out the reason why such videos were downloaded in
the machine. Such video documents the uses of Amphetamine and Methamphetamine, the
side-effects, the contraindications and an overview of the drugs that has been searched for.
It is clear from the following videos that Jo had taken some steps to involve himself with the
knowledge of the said drugs and use of the drugs in question (Fisher, 2010). The files which
has the names ‘Amphetamine and Methamphetamine Part 1’, ‘Amphetamine and
Methamphetamine Part 2’ and ‘Pseudoephedrine Hcl – Uses, Reviews, Side-effects, and
Contraindications’ all point out to an intense research conducted regarding the said drugs.

10
Suspect involved in the case: Jo.
The second step of the investigation was to connect the video document downloaded on the
same day regarding pseudoephedrine Hcl and how it could come about in the investigation.
The video suggests that the suspect may have been involved in the production of
methamphetamine and amphetamine, which could be derived from the video detailing on
Pseudoephedrine Hcl, a drug that could be used as one of the chief ingredient for the
production of both methamphetamine and the production of amphetamine (Kim &
Srivastava, 2007). The production of both the drugs has also been lined up with the
prospective transaction that the suspect may have done with an unidentified seller, referred
to as ‘target’ in an encrypted file, thereby, suggesting the production and sale of illegal
products by the owner.

11
Fig 2.1 – Video files that records the use and effects of Amphetamine and Methamphetamine
along with the overview of the drugs. Extracted from Hard drive image AD1
Fig 2.1.1 – Distorted images of pills extracted from thumb drive image E01 on 19-11-2009
using ProDiscover

12
Grounds, Reason or evidence:
Suspect: Jo
Video evidence that how the download
of files related to use ad effects of
methamphetamine ad amphetamine
Claim:
Jo conducted research o the use ad
effects of methamphetamine ad
amphetamine to begin a drug market of
his own.
Rebuttal:
Jo has conducted research o the use and
effects of methamphetamine ad
amphetamine for casual and educational
use.
Warrant:
The later tampering of the
image has erased the files
preset i the first hard drive
image which shows a attempt
to conceal the files ad a action
Toulmin’s Model:
ii. Production of Amphetamine and Methamphetamine:
The last video files that has been extracted from the suspect’s computer is related to the benefits
and side-effects of Pseudoephedrine Hcl which is an ingredient that can be used for the production
of amphetamines thereby it could be made out the suspect may have involved in the production of
methamphetamine and amphetamine. The first step was the identify the nature of the videos found.
Based on the research conducted and the connection that could be made between the videos of
amphetamine and methamphetamine and the use of pseudoephedrine Hcl, which is both a
stimulant which can be used as cough syrup and an active ingredient in the production of
amphetamines, the connected can be made that could put the suspect in the position of an aspiring
producer of amphetamines and methamphetamines (Leitner & Grechenig, 2008). The off-label
excess usage of Pseudoephedrine Hcl is also illegal since an excess use of this component could lead
to a narcotizing effect on the body as it acts as a stimulant and could have an adverse effect on the
central nervous system if it is taken in excess amount for long periods of time. On top of that,

13
Pseudoephedrine Hcl is under the surveillance of United Nations and is listed as a Table-I drug in the
United Nations Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances.
From the information extracted from the seized machine, two document files of recipe have been
found. The first step of the examination was to look into such documents and unravel what
information was written in them. Such document files shows the starting of a list of chemical
required for the preparation of the above mentioned drugs along with the list of equipment that
would be necessary for the preparation of the necessary drugs. The first file sets down the
ingredients and equipment necessary for the production of methamphetamine while the second
document file sets down the ingredients and equipment necessary for the production of
amphetamine. The files found could point out at an interest of production of methamphetamine and
amphetamine that could have been the goal for the creation of such a document. However, it is also
clear that there has been a modification made on these files which has removed all the ingredients
mentioned under the title which could not be traced back but which could have been an attempt to
remove important evidence.

14
Grounds, Reason or evidence:
Suspect: Jo
Document evidence that show that
recipes and equipment of
methamphetamine ad amphetamine
have created.
Claim:
Jo was conducting research on the
ingredients and equipments to e useful
for the production of methamphetamine
ad amphetamine.
Rebuttal:
Jo has conducted research o the use and
effects of methamphetamine ad
amphetamine for casual and educational
use.
Warrant:
The purchase of beach to a
later date could have been
used to destroy the physical
evidence of methamphetamine
ad amphetamine so that they
could e discovered hence an
indication of production of the
vaove drug.
Fig 2.2 – Document files that records the recipe and ingredients of Amphetamine and
Methamphetamine along with the overview of the drugs. Extracted from Second Hard drive image
AD1
Toulmin’s Model:
iii.
iii. Suspicion in Selling of Amphetamine and Methamphetamine:
The investigation has discovered that on 9-11-2009, Joe has recorded an encrypted
document which is an excel file which documents the transactions that was supposed to be
made with a prospective buyer of methamphetamines and amphetamines. The first step
was the decrypt the file which revealed records of the conditions of the trade, the quantity
asked from the suspect and the fixing of the price of the drug. This piece of evidence could
be connected with the video documents that have been recovered from the suspect’s
computer, thereby arguing in favour of the suspect, Jo, being involved in dealing with
methamphetamines and amphetamines, attempting to produce methamphetamines and
amphetamines and to provide a prospective customer of the drugs with the specific amount

15
that has been decided upon (Leitner & Grechenig, 2009). The second step was the conclude
whether the transaction was successful or not. However, it would be difficult to pinpoint
whether the transaction has actually been made as there is no conclusive evidence to put
into place that the transaction between the owner of the seized machine and the
unidentified buyer has been made or not, that is, there is no money receipts or transaction
slip to confirm the purchase being made.
Fig 2.3 – Encrypted file suggesting that an excel sheet has been maintained that could record the
transaction details, like price and quantity of the drug demanded by the buyer or agreed upon
with the seller. The file name ‘SendToTarget’ keeps the unidentified buyer anonymous but refers
to him as the target of the transaction.
The information extracted from the image has also found out a certain interest of the user in
finding out the rate of drug use increase in the surroundings and the rate at which the drug
use is affecting the people of that place. The analysis of such data has made the investigators
come to an assumption that the searches made by the original owner of the seized machine

16
was a way to judge the profitability of dealing with such drug use and a way to pinpoint the
specific group that could be targeted for the exchange of such drug (Lorenzo,
Constantinides, Geurts & Gómez, 2007). The user has also searched on the drug arrests that
has been made in the locality in question probably to find out the efficiency of the police of
the specific locality and in an attempt to plot or advice for a roundabout way to subvert any
police investigation that could happen if the drug exchange was caught. It is also clear that
there have been certain modifications made on these files which could not be traced back
but which could have been an attempt to remove important evidence.
Fig 2.4 –Files that show the drug problem of the locality especially related to methamphetamine.
Extracted from Hard drive image AD1

17
Grounds, Reason or evidence:
Suspect: Jo
Encrypted file of a certain excel sheet
that displays transaction information
price and quantity of the product sold.
Claim:
Jo was involved in the selling of
methamphetamine ad amphetamine.
Rebuttal:
Jo has not actually sold the product as
the accounts are incomplete and do not
record ay monetary receipts.
Warrant:
The further decryption ad
follow up of the file is required
to reveal any further
information o the transaction.
Toulmin’s Model:

18
Fig 2.5 –Files that show the drug problem of the locality especially related to other drugs. This also
documents the addiction rate and drug arrests in the locality. Extracted from Hard drive image
AD1
i. Tampering of Physical Evidence:
In the hard drive image A01 that has been taken on the next date 15-09-2008, there has been a clear
tampering of physical evidence wherein the video proof of the data that has been found in the
previous image was erased along with the other information regarding the increase of drug use in
the locality. The first step was to find the difference between the two images can be seen by looking
into Fig 2.4 and Fig 2.5, and seeing how the video files have been erased in the second drive which
was present in the first drive image (refer to Fig 2.1). However, this specific image reveals files that
show a sudden change in the direction of the research of the use towards car bleach and paint
bleach, to kinds of bleaches that could be used to destroy methamphetamine and amphetamine.
The second step was to look deeper into the file and it has been found that methamphetamine and
amphetamine when put into bleach for an elongated period of time could result in the slow
degradation of the product and the final destruction of the product, if such is the intention of the
user. Such a revelation could only occur if there was some kind of ‘foul play’ that had taken place

19
during the extraction process or before when the user of the seized machine had searched and
downloaded information. It is so that the user could get rid of the physical evidence kept in the form
of methamphetamine and amphetamine that could immediately indict him of the drug charges that
is being held against him by the investigators of this case. Due to the changes that it has been found
in the different locations of the hard drive images (Palmer, 2008). It could be said that the file has
been tampered with and the motive of the tampering is being argued by the investigators to be an
inside job of intentional negligence made to get rid of the digital evidence that could have been used
to form a case narrative that could prove or disprove the innocence of Jo, the suspect in this case.
The following files have also been found in the ‘purchases’ folder of the hard drive image thus it
could be that the following products have been purchased and used to remove the physical
evidence. However, there is a lack of complete information that could positively bring out that the
transaction of such products has been made or whether the suspect has just conducted a few
research on the following products to cover his tracks in the future. It could also be that the
chemicals are unrelated to the case in question. There have also been several modifications made on
these original files which could not be traced back but which could have carried significant amount
of information and data which has been removed or modified in the process, thus, there has been
significant tampering of evidence that has taken place on the seized machine. From the
investigation, it could be seen that the hard drive image E01 dated 19-11-2009 is the original hard
drive image that still harbours the evidence required and was not tampered with.
Suspects Involved: Jo, The Police (could be due to accidental negligence)

20
Fig 2.6 –Files that show the search and download of car bleach and paint bleach in the second hard
drive along with the tampering of the data.

21
Fig 2.7 –Video Files that was previously downloaded and stored in ‘My Documents folder has been
erased in the second hard drive image AD1

22
Fig 2.8 – Recovery of deleted files recovered from thumb drive image E01 on 19-11-2009

23
Fig 2.9– Recovery of deleted files recovered from thumb drive image E01 on 01-12-2009.
More deleted files suggest tampering of data.

24
Fig 2.10 – The view of all files shows the disappearance of image files of pills which was
found in thumb E01 on date 19-11-2009, thus, suggesting tampering of data.

25
Fig 2.11–Raw Disk Viewer shows the original hex view of the hard drive AD01 from the
first image of the hard drive taken

26
Fig 2.12 – Raw Disk Viewer shows the different hex view of the hard drive AD01 from the
second image of the hard drive taken, thus suggesting a significant amount of tampering
of data

27
Grounds, Reason or evidence:
Suspect: Jo
A tampering of evidence has occurred in
the second hard drive image. It has
erased all the previous video documents
ad recipe documents.
Claim:
Jo was involved in the tampering of
evidence.
Rebuttal:
Research conducted by Jo was for the
actual use of car leach ad paint bleach.
Warrant:
The tampering of the hard
drive is also prominent.
Toulmin’s Model:

28
b. Timeline of Events:
14-04-200817-05-20089-11-200801-01-20098-02-200911-04-2009

29
c. Case Summary
Case 1: Video documents in the first hard drive image shows a keen interest in the use and effects of
methamphetamine and amphetamine, along with the search for Pseudoephedrine Hcl, an ingredient
that could be used for the production of methamphetamine and amphetamine, thereby, suggesting
a dealing of the suspect with amphetamine and methamphetamine.
Case 2: Video document of the uses, effects, side-effects and contraindications of Pseudoephedrine
Hcl shows an interest in the drug, which can be used as a cough syrup but is a stimulant in large
doses, and is known to be a chief ingredient in the production of methamphetamine and
amphetamine. Along with that, there are two documents of recipe found in the hard drive image
which notes down the ingredients necessary and the equipment required for the production of
methamphetamine and amphetamine.
Case 3: An encrypted excel file that shows a transaction that took place between the owner of the
seized machine and an unidentified buyer has been found in the hard drive images, named
‘Senttotarget’, where target could refer to the unidentified buyer of the drugs. The file consists of
price and quantity of the drugs demanded by the buyer and agreed upon by the owner of the seized
computer, however, no certain evidence of the transaction being successful is recorded in the file.
There are also evidence that suggests that the owner of the seized machine had tried to educate
himself about the drug situation in his locality, probably to located target groups and to avoid arrest.
Case 4: There is significant evidence that shows that there has been some amount of tampering of
the hard drive images as the comparison of the two hard drives easily point out certain differences
between the two extracted digital copies of the hard drives. The video files discovered in the first
hard drive image has been erased in the second hard drive image, the hash of the files has been
altered, and there are new documents that suggest a research done regarding car bleach, paint
bleach and chemical cleaners. The above chemicals could effectively be used to dissipate any form of
physical evidence present in the suspect’s possession, since a prolonged soaking of
methamphetamine and amphetamine has been proven to destroy both the drugs, thereby
destroying the physical evidence. Thus, there is adequate evidence in the drives that suggest an
involvement of the police to tamper evidence, either negligibly or otherwise, and an attempt to
destroy physical evidence as well.

30
2. Conclusion
In conclusion, the investigation shows that the suspect Jo is guilty of the various crimes stated above
as the keen interest of his in the various forms of drugs and the ingredients of the drugs show that
the suspect was involved in the production and the purchase and sale of the aforementioned drugs.
The police may have been involved in an intentional ‘foul-play’ because the files found have been
modified on a later date, and the second hard drive image has been tampered with since certain
evidences that had been recovered from the device in question was removed on a later date. Thus,
there is evidence that suggests that Joe may have attempted to erase evidences indicting him of the
crime.

31
References
Berger, J. & Heath C., 2007. Where Consumers Diverge from Others: Identity Signalling and Product
Domains. Journal of Consumer Research: An Interdisciplinary Quarterly, 34(2), 121-134.
Duan, W., Gu, B., & Whinston, A. B., 2008. Do online reviews matter? - An empirical investigation of panel
data. Decis. Support Syst., 45(4), 1007-1016.
Fisher, S., 2010. Social Commerce Camp - Killer Social Commerce Experience. Retrieved from
http://www.slideshare.net/stevenfisher/soc ial-commerce-camp-killer-socialcommerce-experience
Kim, Y. A., & Srivastava, J., 2007. Impact of social influence in e-commerce decision making. In Proceedings of
the ninth international conference on Electronic commerce (pp. 293-302). Minneapolis, MN, USA:
ACM. doi:10.1145/1282100.1282157
Leitner, P., & Grechenig, T., 2008. Collaborative Shopping Networks: Sharing the Wisdom of Crowds in E-
Commerce Environments. In BLED 2008 (Vol. 21, p. 321).
Leitner, P., & Grechenig, T., 2009. Smart shopping spaces: connecting merchants and consumers by
innovative online marketplaces. Presented at the IADIS International Conference e-Commerce.
Lorenzo, C., Constantinides, E., Geurts, P., & Gómez, M., 2007. Impact of Web Experience on e-Consumer
Responses. In E-Commerce and Web Technologies (pp. 191-200). Retrieved from
http://dx.doi.org/10.1007/978-3-540- 74563-1_19
Palmer, M., 2008. Social shoppers find goods well recommended. Financial Times. Retrieved March 5, 2010,
from http://www.ft.com/cms/s/0/349ca1bac7c3-11dc-a0b4- 0000779fd2ac.html?nclick_check=1
Stephen, A. T., & Toubia, O., 2009. Deriving Value from Social Commerce Networks. SSRN eLibrary. Retrieved
from http://papers.ssrn.com/sol3/papers.cfm?a bstract_id=1150995

32
Appendices
The report made the use of the software:
 AccessData® FTK® Imager Version 4.1.1.1
 ProDiscover Version 7.0.0.3
 OSForensics
 EDraw Max Version 9.0
The comparison among the three software tools are detailed in terms of mout Image, carving,
searching files ability and the quality of user friendliness.
ProDiscover OSFOresics FTK Imager
Recover deleted files Yes Yes Yes
Price Highest Range Least range Medium Range
Ease of use yes No Yes
Forensic tool Yes Yes Yes
Advance File searching No yes Yes
Digital evidence Yes Yes Yes
Email search Yes Yes No
Faster searching No Yes yes
Database driven Yes Yes Yes
Table: Comparison Chart among the software tools
 The following report has also used references from
 Chapter 14 – Guidelines for Writing Reports

33
 Hard drive image 2009-11-19.E01 (of the original sold computer) – E01
 Second drive image purporting to be of the same computer – AD1, AD2
 Hard drive image 2009-12-01.E01 (of the suspect’s replacement computer seize from M57) –
E01
 Second drive image purporting to be of the same computer – AD1, AD2, AD3