Performing an Attended Installation of Windows xp

Project 15: Using EnCase 15 Points

What You Need for This Project

• 
  A Windows computer
  
• 
  The Encase Demo file (provided in class)
  
• 
  The instructions below assume you are using Windows 7 as set up in the S214 lab.
  

Extracting the EnCase RAR File

1. 
   On the VMs drive, in the Install folder, find the encasedemo.rar file. Copy it to your desktop.
   
2. 
   Right-click the encasedemo.rar file and click 7-zip, 'Extract to "encasedemo\"'. If there is no 7-zip option, you need to download 7-zip from 7-zip.org and install it.
   

Launching the EnCaseDemo

3. 
   Open the encasedemo file. Double-click EnCaseDemo.exe.
   
4. 
   A decorative box appears, as shown to the right on this page. Click the yellow dot to the left of the words "Run EnCase Demo".
   
5. 
   A window titled.
   
6. 
   In the encasedemo folder, find the "Hunter XP.E01" file. Drag it and drop it into the "EnCase Evaluation Version" window.
   
7. 
   In the "Case Options" box, enter your name as the "Examiner Name" and click "Finish".
   
8. 
   If one or more boxes pops up asking to create folders, allow that.
   
9. 
   In the encasedemo folder, find the "MS E-mail Files.E01" file. Drag it and drop it into the "EnCase Evaluation Version" window.
   

EnCase Layout

10. 
    There are four panes in the EnCase main window, as shown below:
    
    • 
      Table Pane -- this is where you select the device or folder to examine
      
    • 
      Tree Pane - shows files and folders in the current directory
      
    • 
      View Pane - shows the current file or folder in Text, Hex, or many other views
      
    • 
      Filter Pane - shows results from a search or filter
      

Views in the Tree Pane

11. 
    In the Table Pane, expand "Hunter XP" and click C to select the C: drive.
    
12. 
    The Tree Pane shows the files in the root of C:. Scroll down and click boot.ini.
    
13. 
    Try all the views in the Tree pane, Table, Report, Gallery, Timeline, Disk, and Code.
    

Searching for Email

14. 
    In the top center of the "EnCase Evaluation Version" window, click the Search button.
    
15. 
    In the Search box, on the right side, click the "Search for email" box, as shown to the right on this page. Click the Start button. The search runs, with two little progress bars showing in the lower right of the "EnCase Evaluation Version" window.
    

16. 
    When the search completes, a box pops up saying Completed as shown to the right on this page. Click OK.
    

Viewing the Search Results

17. 
    From the "EnCase Evaluation Version" menu bar, click View, "Cases Sub-Tabs", Records.
    
18. 
    You should see a tree of entries in the Table Pane. Use the keyboard down-arrow to look at each one and read the emails in the View Pane in the lower left. As you can see, this case involves a plot to kidnap a daughter.
    

Finding the License Plate Number

19. 
    S
    
    License Plate: _______________________
    earch through the emails and find a photograph of a person (perhaps the intended victim) putting gas in a car. Find the license plate number of that car and write it in the box below.
    

Searching the Internet History/Cache

20. 
    In the top center of the "EnCase Evaluation Version" window, click the Search button.
    
21. 
    In the Search box, on the right side, clear the "Search for email" box, as shown to the right on this page. At the bottom, check the "Search for internet history" box. Click the Start button.
    
22. 
    When the Searching box pops up, saying Completed, click OK.
    

Viewing the Search Results

23. 
    From the "EnCase Evaluation Version" menu bar, click View, "Cases Sub-Tabs", Records.
    
24. 
    In the Table Pane, expand "Hunter XP" and expand C. Expand "Internet Explorer (Windows)". Click Cache to select it.
    
25. 
    In the Tree Pane, click Gallery. A grid showing the images from the cache appears, as shown below on this page.
    

Finding the Map

26. 
    Search through the images and find the map shown to the right on this page. When you find it, select this image in the Tree Pane and select Picture in the View Pane, so you can see the small version of the map in the Tree Pane and the full size map in the View Pane.
    

Saving a Screen Image

27. 
    Make sure your screen shows the map image shown above on this page.
    
28. 
    Press the PrintScrn key. Open Paint and paste in the image. Save it with the filename Your Name Proj 15a. Select a Save as type of JPEG or PNG.
    

Turning in your Project

29. 
    Put the License Plate Number in the body of your email. Email the JPEG image to me as an email attachment. Send it to: [e-mail] with a subject line of Proj 15 From Your Name, replacing Your Name with your own first and last name. Send a Cc to yourself.
    

Last Modified: 11-8-10

CNIT 121 Bowne Page of