Placeholder

ISSC 457 Week 5 Interactive Lab

$8.00

Quantity:

Product Description

ISSC 457 Week 5 Interactive Lab

Hardware/Software Setup Required

Active@ UNERASER (available at http://www.uneraser.com/download.htm)

RecoverPlus Pro (available at http://www.arcksoft.com/)

Problem Description

Analyzing data from deleted files is an important task during a computer forensic investigation. In this lab, you will use UNERASER and RecoverPlus Pro to recover text data and images from deleted files on a USB Flash Drive.

First, you will create a new text file on the USB Flash Drive and write any content on it. Save it. Then, using Windows Explorer, delete it from the drive. Make sure the file is not sent to the Recycle Bin. Use UNERASER to recover the content of the deleted file and save it on a new file.

Next, copy some image files to the Flash Drive and use Windows Explorer to delete some of them. Finally, use RecoverPlus Pro to recover all deleted image files.

Week 5 Interactive Lab

Hardware/Software Setup Required

Active@ UNERASER (available at http://www.uneraser.com/download.htm)

RecoverPlus Pro (available at http://www.arcksoft.com/)

Problem Description

Analyzing data from deleted files is an important task during a computer forensic investigation. In this lab, you will use UNERASER and RecoverPlus Pro to recover text data and images from deleted files on a USB Flash Drive.

First, you will create a new text file on the USB Flash Drive and write any content on it. Save it. Then, using Windows Explorer, delete it from the drive. Make sure the file is not sent to the Recycle Bin. Use UNERASER to recover the content of the deleted file and save it on a new file.

Next, copy some image files to the Flash Drive and use Windows Explorer to delete some of them. Finally, use RecoverPlus Pro to recover all deleted image files.

Outcome

Report the steps you need to perform to recover a deleted file.

Validation/Evaluation

  • Is the QuickScan option enough to find the deleted file?
  • What are the options available when searching for a file?
  • Is the text of the recovered file the same as the original file?
  • How can you add more file types for the scanning process on RecoverPlus Pro?
  • Why should you recover deleted files to a different location instead of the original disk?

Lab Solution

The solution assumes that the file Test text.txt has been created on (and then deleted from) a USB Flash Drive with the following content:

“This is a test for recovering a file using Active@ UNERASER.”

Steps for recovering the text file

  1. Install Active@ File Recovery for Windows on your computer following the installation wizard.
  2. Install RecoverPlus Pro on your computer following the installation wizard.
  3. Connect the pendrive to the computer. Note: For this exercise, the pendrive was mounted on drive H:.
  4. Start Active@ File Recovery for Windows.
  5. Select NO NAME under Ut163 USB2FlashStorage and scan it using either the QuickScan or the SuperScan options.
  6. Use the Search button and write “Test text.txt” on the “Find what” field on the next window.
  7. Select the found file and click on the Recover button.
  8. Recover the file to the C:\
  9. Open the recovered file and check that the content is the same.
  10. Close all the windows.

Steps for recovering the image files

  1. Copy some image files to the pendrive.
  2. Use Windows Explorer to delete some of the copied files.
  3. Start RecoverPlus Pro.
  4. Select the corresponding drive to scan, in this case, H.
  5. Select all the file types that RecoverPlus Pro will scan for this time. Note: If the scanning process does not return the desired results, try selecting additional file types.
  6. Click the Scan button.
  7. Select “Yes” on the next window to scan only for deleted files and wait for the results.
  1. You can switch views from list to thumbs using the Toggle button.
  2. Now, to recover all deleted images to a new location, click on “Save All”.
  3. Select the destination folder on the next window and click OK.
  4. Use Windows Explorer to verify that the files have been successfully restored.
  5. Close the application.
  6. Answer the following question: Why should you select a different location to restore deleted files instead of the original disk?

Answer: If you restore deleted files to the same location, the file will be saved to the same disk. This process may overwrite other deleted files, making their recovery more difficult. Remember that when a file is deleted, the information is not actually deleted from the disk. The space on disk previously occupied by the file is marked as vacant, so new files can be written there. When recovering deleted files, make sure no new files are written to the disk so that the original information remains intact and can be recovered.