HW#1 Preparation of USB Drive • Need to properly erase the content of USB drive unless you purchase a new one • File system (NTFS or FAT) • Disk Wiping tool Preparation of USB Drive • Example of Disk Wiping Tool – CCleaner • Open the tool and click on the Drive Wiper • Under the Wipe option, choose Entire Drive (All data will be erased) Preparation of USB Drive • Under the Security option, choose Advanced Overwrite (3 passes) • Under the Drives option, choose the name of USB drive • Click Wipe • When wipe operation completes, you will have a clean USB drive that is ready to hold digital evidence Usage of CCleaner • Step by Step explanation • http://www.piriform.com/docs/ccleaner/usin g-ccleaner/wiping-free-disk-space Usage of CCleaner - installation Select tools – Disk Wiper – Advanced Overwrite Select the Drive to be wiped – Your USB thumbdrive – Click Wipe to proceed Hidden File • A hidden file is a file that is not normally visible when examining the contents of the directory in which it resides • Ref: http://windows.microsoft.com/enhk/windows/what-is-hiddenfile#1TC=windows-7 Hidden File • To hide a file or folder on Windows, open a Windows Explorer or File Explorer window and locate the file or folder you want to hide • Right-click it and select Properties • Enable the Hidden checkbox on the General pane of the Properties window • Click OK or Apply and your file or folder will be hidden. Deleted File • When you a delete a file, it isn't really erased – it continues existing on your hard drive, even after you empty it from the Recycle Bin. • This allows you (and other people) to recover files you've deleted. Deleted File • Windows (and other operating systems) keep track of where files are on a hard drive through "pointers." • Each file and folder on your hard disk has a pointer that tells Windows where the file's data begins and ends. • When you delete a file, Windows removes the pointer and marks the sectors containing the file's data as available. Deleted File • From the file system's point of view, the file is no longer present on your hard drive and the sectors containing its data are considered free space. • However, until Windows actually writes new data over the sectors containing the contents of the file, the file is still recoverable. Deleted File • A file recovery program can scan a hard drive for these deleted files and restore them. If the file has been partially overwritten, the file recovery program can only recover part of the data. • How to delete a file? Email File • It may be impossible to export it from web interface directly. • Download to email application like outlook, outlook express, Mail, etc. Email File • Export the email to a text file • "Save as" another next file • Printscreen and convert it into an image file Password-protected File • When we say "password protecting" a file, we generally mean we encrypting the file so it can't be decrypted and understood without your encryption password. • That's the most secure way to password protect files. Password-protected File Password-protected File Compressed File • A compressed file is any file that contains one or more files or directory that is smaller than their original file size. • These files make downloading faster easier and allow more data to be stored on a removable media. Compressed File • Common compressed file extensions are .ZIP, .RAR, .ARJ, .TAR.GZ, and .TGZ. Browser History • Browsing history refers to the list of web pages a user has visited recently—and associated data such as page title and time of visit—which is recorded by web browser software as standard for a certain period of time. Browser History • The History page in Chrome is already an HTML page, as are all the other panes and pages in Chrome. • Simply right-click on an empty part of the page, select Save As... and save as full HTML. Browser History • http://erick5876.tumblr.com/post/525206549 1/how-to-export-history-from-firefox-chromeand-ie Wiped File • Wipe, in a computing context, means to render all data on a hard drive unreadable. • The term is often used in reference to making data stored on a computer, smartphone or tablet inaccessible before disposing of the device. Wiped File • http://www.howtogeek.com/72130/learnhow-to-securely-delete-files-in-windows/ Usage of File Shredder - Installation The Interface of File Shredder Select the file that you want to wipe by picking the "Add File" File added to the Shredder and click Shred file now Confirm the shredding by clicking "ok"