EnCase Investigations
In the form’s description box, provide information about the issue. Include details such as steps taken, system responses, and add screenshots or supporting documents.
The Washer image is a subset of a full computer image (like the Mantooth image), so processing time is reduced. While it is rich in artifacts, it is small enough to process in minutes rather than hours. You have full confidence that an investigation of the Washer image will approximate the investigation of a full computer image. EnCase allows you to view the contents of registry files. Passwords for certain files may be recoverable from other artifacts on the image as well.
The detectives have asked you to analyze the Washer and thumb drive images within EnCase to ferret out facts, including a list of detailed questions on Washer, including associates and other information from the computer and its files. You will include your answers to these questions:
- Explain the use of EnCase tools.
- What are the AIM usernames for Rasco Badguy and John Washer?
- What is the current zip code for the AOL IM account registered to Washer?
- When was AOL IM installed?