cyber crime

التدريب العملي 7

في هذا التدريب ، ستتعلم كيفية استعادة ملف image إلى محرك أقراص.

1- Download the evidence file from this link: LINK

2- Connect the USB to the computer.

3- Start ProDiscover Basic. (Right-click the ProDiscover desktop icon and click Run as administrator).

4- click Tools, Copy Disk from the menu.

5- In the Copy source disk or image to destination disk dialog box, click the Image to Disk tab.

6- Click Browse next to the Image File text box, and navigate to the location where you copied this chapter’s data files. Click the GCFI-datacarve-FAT.eve file, and then click Open.

7- In the Copy source disk or image to destination disk dialog box, click in the space under the Disk Name column at the bottom.

8- Click the Disk Name list arrow, click the target drive, and then click OK.

9- In the Copy dialog box that opens, click the Write All 0’s option button, and then click OK to start the data loading.

10- Click OK in the “Copy successful” message box to terminate the loading.

11- Upload the original image to ProDiscover

12- Compare what is copied to the USB with what is really exist on the image (are they the same)?

13- Exit ProDiscover.

14- Again, start ProDiscover and make a dd image of the USB that you have created.

15- What did you notice?