Computer Forensics - Date recovery plan

1. Assignment: Proper Methods for Recovering Data

Assignment: Create a Data Recovery Plan

Learning Objectives and Outcomes

· Describe data recovery methods on a Linux machine.

Assignment Requirements  You are an employee of Azorian Computer Forensics, a privately owned forensics investigations and data recovery firm in the Denver, Colorado area.

A client has experienced a severe malware attack in which files were deleted from a file and printer server, which had not been backed up. You will assist Pat, one of Azorian's lead investigators, in recovering the data using Scalpel. First Pat wants you to research Scalpel to understand how the tool works. Your research might be used in the next company newsletter.

For this assignment, write a report based on the following:

1. Research Scalpel on the Internet.

1. Describe the main steps and commands an investigator should take to use Scalpel to recover data.

1. Include a link and brief description of a video or short tutorial you found while conducting research on Scalpel.

1. At a high level, describe file carving in Scalpel. For this part, do not list the commands a person would run, but explain the process Scalpel takes to examine file headers and footers.

Required Resources

. Course textbook

. Internet access

Submission Requirements
Format:	Microsoft Word
Font:	Arial, 12-point, double-space
Citation Style:	Follow your school's preferred style guide
Length:	1-2 pages

Self-Assessment Checklist

. I researched Scalpel on the Internet.

. I described the main steps and commands an investigator should take to use Scalpel to recover data.

. I included a link and brief description of a video or short tutorial you found while conducting research on Scalpel.

. At a high level, I described file carving in Scalpel

2. Assignment: Data Recovery Plan

Assignment: Create a Data Recovery Plan

Learning Objectives and Outcomes

. Describe the general process for examining and recovering data from a hard disk.

. Create a data recovery plan for future use.

Assignment Requirements  You are an employee of DigiFirm Investigation Company. You received a call from Bill, an engineer at Skyscraper, Inc., a large commercial construction company. Bill reported that a disgruntled employee reformatted a hard disk that contained valuable blueprints for a current job. The computer is an ordinary laptop that was running Windows 7. No backup is available, and Bill wants the data to be recovered.  You can use a few built-in tools to recover deleted files from a Windows 7 operating system. There are also third-party tools that might be helpful. Before beginning any data recovery endeavor, it's a good idea to research your options and plan your approach.

For this assignment, write a report that includes a data recovery plan outline, listing the steps to be performed in recovering the data in the order of importance.

Required Resources

. Course textbook

. Internet access

Submission Requirements
Format:	Microsoft Word
Font:	Arial, 12-point, double-space
Citation Style:	Follow your school's preferred style guide
Length:	1-2 pages

Self-Assessment Checklist

. I researched and identified the appropriate steps for recovering data from a reformatted hard disk.

. I properly outlined each step in the data recovery process in correct order.