- Read and follow instructions below.
<Important files and folders to install>
- Download image files from
- Download and install Autopsy program from https://www.sleuthkit.org/autopsy/ on your computer
- Download TRID ( http://mark0.net/download/trid_w32.zip ) to your computer.
- You need the TRID package file http://mark0.net/download/triddefs.zip together with TRID.
- Download the attached file named “unnamed.zip”.
- Short answers are not acceptable.
- Screenshots of your findings are must.
- Explain what file signature and file header (refer to https://www.garykessler.net/library/file_sigs.html ).
- Explain Data Carving and its techniques.
- Import two dd image files extracted from bz2 files to Autopsy and run ‘Ingest Module’ on ‘PhotoRec Carver.'
- List all carved files from each dd image file.
- Choose a carved file from both dd images that has a same extension and file size. Show the header value indicating file size in Hex.
- Do you think that these 2 files are originally same or not? Why?
4.Using TRID, find each extension of all files extracted from 'unnamed.zip.'
Other samples, services and questions:
When you use PaperHelp, you save one valuable — TIME
You can spend it for more important things than paper writing.