Recuva is a useful program that will scan the empty memory space on your computer to see if there are any files that can be recovered. Most users errantly believe that data is gone forever when they empty it from the Recycle Bin. This is incorrect. It merely marks the space as open to be written over if another file needs to be stored. Your operating system writes over these open spaces and subsequently “damages” the previously deleted file.
- From the Maryville Virtual Applications environment, Connect to the GUI of the Cyber Tools VM
- Type and select Recuva from the “Search Windows” bar. If prompted to install a new version, select No.
- From the Recuva Wizard, select Next.
- For the File Type, select All Files, select Next.
- Select the drive from which you want to recover files, select Next.
- Click Start. (The scan will take about 5 minutes since it is looking everywhere. You can reduce scan time by selecting a specific location in Step #4).
- After the scan completes, click on any of the recovered files listed that you find interesting (Click OK on the A: drive access error as this is not pertinent).
- Take a screenshot.
- Recover any file and save it to your desktop.
- Take a screenshot of the recovered file on your desktop.
Students should then complete a page summary of their findings and discuss the differences between a forensic disk image and a regular disk image specifically discussing free and slack space implications. Also, discuss how forensic recovery can be used to help with corporate or law enforcement investigations. This page should be at the beginning of your lab.
For a good video providing an overview of Recuva, please see the link below:
This is the next chapter of your lab book for the semester. Each Lab Assignment is a new chapter in your lab book.
Your lab book chapter each week should include:
- Cover Page
- Abstract
- Introduction of the lab assignment
- Screenshots that dialogue your lab experience/ what you learned during the exercise
- Conclusion of the lab assignment
- Independent Research – expanding the topic.. ( For example this week, we are focusing on memory forensics, so you could discuss business risks relating to data deletion and destruction, use of forensics in incident response, etc)
- References
A Helpful Message regarding the projects/ lab assignments…
Yes, we normally provide steps to follow and a general direction of what is necessary to complete the assignment….. but they are not recipes… they are diving boards for exploration. Sometimes things do not work perfectly… that’s OK.. note it in your lab book and continue. The intent is to provide the general direction… the assignment is intended for you to run with it and learn!!
Choose a submission type
Submission type Upload, currently selectedUploadMore submission optionsMore
Submit file using WebcamWebcamSubmit file using Canvas FilesCanvas Files
