Homework #2

Course Name: Digital Forensics

File Carving: Exercise#2

1. Create folder named "Digital Forensics" on the desktop.

2. Create file and call it "password.txt" on the "Digital Forensics" folder.
3. Edit the file and write some data.
4. Delete the file permanently form the folder.

What to do?

1. Find any tool that help you to recover the deleted file.
2. Use the LastActivityView to check about the existence of the file.
3. Use Hex Editor to find and to compare the metadata of the file before and after the
deletion.
4. Repeat the experiment by creating the file again, deleting it, waiting for one hour,
then trying to recover it again.
5. Repeat the experiment by creating the big file .

Write a report about all the steps, tools, and procedure that you used in order to recover
the file.