The Police has successfully been able to find the hideout of Yunral , who has been involved in a number of Phone , Email and Text Scams . They were able to recover a workstation and few portable hard drives and USBs lying around the house and few other things. If you were the Forensic expert, Where can you collect the forensic data from?

equirements: It may vary depending on the question. It shouldn’t be too long.

Q1: The Police has successfully been able to find the hideout of Yunral , who has been involved in a number of Phone , Email and Text Scams . They were able to recover a workstation and few portable hard drives and USBs lying around the house and few other things. If you were the Forensic expert, Where can you collect the forensic data from? 

Q2: The term “triage” comes from the field of Medicine in which it refers to situations when because of having limited resources , the injured people are ranked according to necessity to receive treatment . Such ranking ensures to receive least damage and efficient utilisation of resources Digital Triage comes in two forms Live Triage and Post-mortem. You have been given a new project of developing the Triage principles for acquiring and securing data for an organisation Can you draft the processes involved in the Live Triage and Post Mortem below ?

Q3: Write a note on the Structure and Operation of Windows File Structure.

Q4: Write a note on the Structure and Operation of the MAC Operating System (OS) File Structure.

Q5: Write a short note on the Structure and Operation of the Unix File Structure

Q6: About Windows Registry, usually termed as the treasure chest of Forensic information, what kind of Forensic evidence do you think could be stored ?

Q7:

Think of yourself to be part of the Digital Forensics Team and your project sub task is to find the connection and disconnection times of USBs used and the BYOD connection and disconnection . Please write a note on how will you go about finding the connection and disconnection times of a USB , where can you find that information on the Workstation ?

In case of a BYOD what are the tools or softwares that could be used to be able to extract that information and how ?

Q8: What about Disk File close and Open times ? When can you find that information on the Workstation?