cyber crime
mosa madi
home2.docx
التدريب العملي 3
تبلغك السيدة جونز بأن الموظف السابق قد استخدم محرك أقراص إضافي. تطلب منك فحص محرك الأقراص الجديد هذا لتحديد ما إذا كان يحتوي على رقم حساب ربما يكون الموظف قد تمكن من الوصول إليه. رقم الحساب، 461562 ، ينتمي إلى نائب الرئيس الأول ويستخدم للوصول إلى الخدمات المصرفية للشركة عبر الإنترنت. لمعالجة هذه الحالة اتبع الخطوات التالية:
1- Download the evidence file from this link: LINK
2- Notice that the image file is a .dd file, not an .eve file.
3- Start ProDiscover Basic. (Right-click the ProDiscover desktop icon and click Run as administrator).
4- Create a new project and enter the project number, Project Name, and Description.
5- Click Action from the menu, point to Add, and click Image File.
6- Go to your work folder, click “C1Prj03.dd”, and then click Open.
7- To view graphics files on the drive, click to expand Content View in the tree view, click to expand Images, and then click the pathname containing the image file.
8- Click View, Gallery View from the menu.
9- Scroll through the graphics files (You’ll need to search through all folders).
10- If a file is of interest, click the check box next to it in the Select column.
11- In the Add Comment dialog box that opens, enter a description and click OK. These notes are added to the ProDiscover report.
12- This drive is related to the case in Hands-On Project 2, so you’re still looking for occurrences of the word “book.”
13- Open the Search dialog box, and repeat Steps for searching for the word “book”.
14- When you view the search results, click to select any files of interest, which opens the Add Comment dialog box where you can enter notes.
15- Next, search for the account number Ms. Jones gave you. Click the Search toolbar button. Click the Content Search tab, and type 461562 as the search keyword.
16- Click the Cluster Search tab, and repeat the search for the account number.
17- When you’re finished, click Report in the tree view.
18- Next, click the Export toolbar button. In the Export dialog box, click the RTF Format option button, type “example3Report” in the File Name text box, and then click OK.
