BUILDING AN INVESTIGATION PRACTICAL EXERCISE # 5

Start OpenText EnCase Forensic (EnCase) and open the Cavin case, which has been processed.
Your instructor will provide the location of this case file if you did not run the processor
overnight.

1. If you were asked to provide information regarding the last time Cavin logged off his
computer system, what date/time would you provide and from what source?
___________________________________________________________________________

2. What objects/icons exist on Desktop?

___________________________________________________________________________

3. Locate the shortcut named within Recent folder.

Manually locate and interpret the data from within the LNK file.
a. What is the path to the target file as contained within the .lnk file:
________________________________________________________________________

b. What are the internal dates/times of the target file that are contained within the
shortcut?
________________________________________________________________________

c. What are the 4 bytes within the link file that represent the volume serial number of
the logical volume containing the target file?
________________________________________________________________________

d. What is the volume serial number of third volume? ___________________

e. Does it match the serial number contained within the shortcut file? _____________

Copyright © 2020 OpenText