This assignment details a practical digital forensics investigation using a USB drive. The student creates digital "clues" on a flash drive, including documents and images, and then images the drive using ProDiscover Basic. The report covers data acquisition methods, considerations for choosing acquisition methods, and data preservation techniques. It explains two acquisition methods: direct connection to a computer and network acquisition. The assignment involves using ProDiscover Basic to acquire an image of the USB drive, including screenshots of each step. It then covers recovering deleted images and files, again with screenshots, and discusses the importance of disk imaging and the methods for creating an image (USB, Netcat, SATA cable). The report emphasizes the significance of MD5 values for verifying data integrity and discusses various tools and techniques for evidence handling and analysis. References to relevant resources are also included.
![[object Object]](/_next/static/media/star-bottom.7253800d.svg)
