He wants to know whether any similar files on this drive match the files you recovered from the first USB drive. This image file is a new acquisition of another USB drive the EMTS manager retrieved. Find the C08carve.eve file in your work folder. These altered files had different extensions to hide the fact that they’re graphics files. In the in-chapter activity, you recovered three files containing “zzzz” for the first 4 bytes of altered JPEG files. Exit ProDiscover Basic, saving your project when prompted.Īctivity 2: In this activity, you continue the search for files Bob Aspen downloaded. You can also save your report by clicking the Export toolbar button,Īnd in the Export dialog box’s File name text box, type C08Prj01.rtf,Ħ. In the tree view, click Report, and then click File, Print Report from the jpg file, click the Apply to all items check box, and then click OK.ĥ. When the Add Comment dialog box opens, type Recovered hidden Click the check box next to each file with a JFIF jpgĮxtension, and in the data area, scroll through each file to find any occurrences Click each file in the work area’s search results that doesn’t have a. Select the Disk(s)/Image(s) you want to search in, click C08frag.eve.Ĥ. Under Search for the pattern(s), type JFIF, and under In the Search dialog box, click the Content Open dialog box, navigate to your work folder and click C10frag.eve.Ĭlick Open, and then click Yes, if necessary, in the Auto Image Checksumģ. In the tree view, click to expand Add, and then click Image File. In the New Project dialog box, typeĬ08frag in the Project Number and Project File Name text boxes, andĢ. Start ProDiscover Basic (with the Run as administrator option if you’re
Find the C08frag.eve file in your work folder, and then followġ. Some of these files are embedded in files with non-JPEG extensions.
Prodiscover basic usb format software#
The necessary software are available under “ Software for Labs” folder.Īctivity 1: In this project, you use ProDiscover Basic to locate and extract JPEG files with altered extensions. In this lab, you use ProDiscover Basic to locate and extract JPEG files with altered extensions. Submission on Moodle is mandatory as an evidence of participation. Marks will be given only to students who attend and participate during 2 hours laboratory class. Total Marks = 10 marks for 10 weeks (DIT and BNet) Submission Due: End of laboratory class, submit the file on Moodle at least 10 minutes before the end of laboratory class.
Laboratory 9 and 10 : Recovering Graphics Files