• NIST Computer Forensics Tool Testing Program. Disk Imaging
• Forensics File Formats
• FILE SIGNATURES TABLE Gary C. Kessler
• File Signature Search Engine

Windows Registry

• Microsoft knowledge article

• Registry Value Types

• Windows Registry from Wikipedia

• Accesss Data Suplemental Class Material

Practice Labs
• Registry Viewer Practice Lab 1
• Registry Viewer Practice Lab 2
• Registry Viewer Practice Lab 3

  Graded LAB

FTK

• File Signature Search
• Prefetch from ForensicsWiki
• Event Log
• Resource Interchange File Format
• Photo Dna
• DtSearch
• Credant Files
• Volatile Tab in FTK - Memory Analysis
  • Forensics Focus
  • Malware Memory Forensics
  • Analyzing a Stuxnet Infection Part 1
  • Analyzing a Stuxnet Infection Part 2
  • Analyzing a Stuxnet Infection Part 3
  • Live Memory Acquisition for Windows Operating Systems

Lab Practice - Monday/Wed

• Creating the Case - pages: 254, 258
• Managing Shared Objects - Page 276
• Case Processing Options - Page 306
• FTK Menu Bar Options - page 321
• Explore Tab and QuickPicks - page 327
• Practice Lab - Page 334 -337 (Overview Tab)
• Practice Lab - Page 340 (E-Mail Tab)
• Practice Lab - Page 342 (Graphics Tab)
• Practice Lab - Page 344 (Video Tab)
• Practice Lab - Page 346 (Bookmark Tab)
• Practice Lab - Page 350-351 (Live and Index Search)

FTK Practice Lab

FTK Graded Lab

Graphics TAB in FTK

• Exchangeable image file format (EXIF)

E-MAIL Tab in FTK

• Outlook Data Files (.PST and .OST)
• Outlook Express (.DBX containers)
• AOL Mail Personal Filing Cabinet files (PFC)
• Windows Live Mail
• IBM Notes (formerly Lotus Notes)
• Forensic email analysis: browser artifacts you may find on a PC or laptop from Magnet Forensics
• Analysis of e-mail and appointment falsification on Microsoft Outlook/Exchange SANS Digital Forensics and Incident Response
• E-mail Forensics in a Corporate Exchange Environment
• Email 'Message-IDs' helpful for forensic analysis? Satheesaan Pasupatheeswaran

Lab Practice FTK

• Compound Files: Pages 392 - 394
• Recycle Bin: Pages 400 - 402
• Lab on Page 420-421
• Lab: Decrypting Files: Page 424
• Data Carving: Lab Pages 438 - 440
• Verification of the Image Integrity: Pages 441-442
• EXIF DATA in Graphics: Page 461 Part 2 ONLY

Lab Practice - Friday March 23 Part I

• Regular Expressions:
  • Read Pages 545 - 563
  • Read Regular Expressions Summary
  • Answer Review Questions on Page 564. Document your answers in Word file and submit on Campus Cruiser
  • Create ONE SHORT regular expression of your choice that is NOT explained in the book and in the summary above. Explain what patterns of data your regular expression will find. The expression you will create will be for Live Search Tab (RegEx++). Limit the length of your regular expression to 20 chars. Write your answer in Word or Text file and submit on Campus Cruiser

Lab Practice Friday March 23 Part II: KFF - Known File Filter

• Read Pages 500 - 504
• Review National Software Reference Library
• Review National Drug Intelligence Center (NDIC) HashKeeper
• Answer Question 1 and Question 2 on Page 536
• Document your answers in Word file and submit on Campus Cruiser

Lab Practice Friday March 23 Part 3: Index Search

• Read Pages 516 - 520
• Read Regular Expressions dtSearch
• Read dtSearch FAQ

Additional Practice - Preparation for Data Carving

• Read Pagefile.sys Forensics Wiki

Filtering the Case

Algebra of Sets from Wikipedia

Lab Practice

• Lab pp: 580 - 581
• Read: pp 582-583
• Lab pp. 585-586, 588, 590
• Practice Page 599

FTK Graded Lab March 28

FTK Practice Lab April 4

Working with PRTK

• Practice Lab1 pp. 720 - 723
• Practice Lab2 pp. 724 - 725
• Answer Review Questions: pp. 718 - 719

Graded Labs

• Part I: read pp 729 - 752 and asnwer Review Questions on Page 752. Document your answers in Word file and submit on Campus Cruiser
• Part II

  ---

• PRTK GRADED LAB MONDAY APRIL 23

  ---

• PRACTICE LAB MONDAY APRIL 30
• March 16 Graded Lab for make up