cyber crime

التدريب العملي 4

Sometimes discovery demands from law firms require you to recover only allocated data from a disk. This project shows you how to extract just the files that haven’t been deleted from an image.

1- Download the evidence file from this link: LINK

2- Start ProDiscover Basic. (Right-click the ProDiscover desktop icon and click Run as administrator).

3- Create a new project and enter the project number, Project Name, and Description.

4- Click Action from the menu, point to Add, and click Image File.

5- Go to your work folder, click “C1Prj04.eve”, and then click Open.

6- In the tree view, click to expand Content View. Click to expand Images, and then click the pathname containing the image file.

7- Click the column header Deleted to sort the files into YES and NO groups.

8- To extract the allocated files from the image to your work folder, right click each file containing NO in the Deleted column and click Copy File.