Instructions for Assignment:
Your report must include:
Academic integrity means being honest in academic work and taking responsibility for learning the conventions of scholarship. The University requires its instructors and course participants to observe the highest ethical standards in all aspects of academic work.
You can demonstrate academic integrity by:
You are a digital forensic examiner. Your task is to process and perform a forensically sound acquisition of the following memory card:
Describe your steps in details, including specific forensic equipment, hardware and software that you will use, to complete forensic acquisition of the SSD device and create a forensic image. Use the following evidence form to document the evidence given to you.
The following is a MBR snapshots. Find the following information for each partition.
(Hints: watch this youtube video: https://www.youtube.com/watch?v=jRj_HzbHeWU)
Please examine the $MFT FILE Record below and report on its content.
Hints: Read chapter 5 of the textbook and week 6 lecture slides to prepare for your response.
For conversion you can use DCode software (https://www.digital-detective.net/dcode/)
Your answers need to include the detail description of the following attributes and their corresponding values.
In your Data run (0x80), show the calculations of starting cluster number, number of clusters. Carefully consider the VCN while calculating the starting position of cluster.