Advanced Computer Forensics Windows EnCase Forensics

Advanced Computer Forensics Windows EnCase Forensics Lab Due date: Please submit your work to Windows EnCase Lab dropbox by July 2nd, 2013. Lab Setup for using RLES vCloud This lab is designed to function on the RLES vCloud. The interface is available by navigating to https://rlesvcloud.rit.edu/cloud/org/NAT. If you did the Linux forensics lab on RLES vCloud, you should have created a vApp with the Linux VMware image. If you did not use the RLES vCloud for your first lab, please follow the instruction described in the Linux Forensics Lab to create a vApp. Now, you will add the vApp template, Windows 7 w/FTK 7 EnCase image, from the Public Catalogs to the same vApp following the instruction of Add Virtual Machines to a vApp (Page 8 in RLES vCloud User Guide) with the following setting: Set network to be Net_Network Select DHCP to create an IP address (when you use DHCP, fencing option is NOT necessary.) Note: If you get an error when trying to start a vApp (or a VM within a vApp), try these steps: Open up your vApp and click on the Virtual Machines tab.  Right-click your VM and choose "Properties". Click on the Hardware tab.  At the bottom of the page, click on the MAC address and choose "Reset". Click OK.  When it asks if you want to enable guest customization, click No. Give it a minute to update your VM, then try starting it. Power on the Windows Virtual machine and login to the system with: Username: Student Password: student EnCase 7 is installed on the virtual machine. When you start the EnCase application, you should see “EnCase Forensic (not Acquisition)” on the top of the application. EnCase 7 Tutorial The EnCase Forensics V7 User Guide posted in myCourses under Hands-on Labs. EnCase 7 Essentials webinar series at http://www.encaseondemand.com/EnCasev7Essentials/tabid/2617/index.aspx The following image files will be used for this lab and they are located in the local drive