If you are using a Windows computer, use FTK Imager
Question # 00004986 Posted By: Updated on: 12/09/2013 12:08 AM Due on: 12/09/2013
If you are using a Windows computer, use FTK Imager (or another forensic tool, if you prefer) to preview your local drive and examine the contents of your own user profile folder. If you are using a Macintosh computer, you can use the Macintosh OS X Finder to view your user profile. Now, pretend you are a digital forensic examiner analyzing the data of a suspect in a forgery case. Select a professional report format of your choice, report on the documents/files you find in your “My Documents” folder (or similar folder on a Mac). What could these documents tell a digital forensic examiner about you and your activities? Are the metadata for these files important? Are there any files of particular significance? Feel free to use screenshots or file data in your report, if it can be presented in a professional manner.