1. Data Recovery/Discovery Files Deleted Files Text Searches Slack Space Free Space Lab

2. Files on the Drive List all the files on the drive WinHex can show only one folder at a time Import file list into Excel Sort by file extension

3. Open Floppy Image

4. Interpret Image File as Disk

5. “Crtl A” Select All Files and Folders

6. Export File List

7. Choose the Fields to Export To choose the fields that you want hold the “Ctrl” key down and click on the desired fields

8. Pertinent Data Name Description Extension (file type) Path Size MAC date/times

9. Save in your Case Folder

10. Open it in Excel It may open it automatically If not –Go to your case folder –Start Excel –File -> Open –Find your Case Folder –Select All files –Open the.txt file

11. All Files

12. Run through formatting options

16. Make it Pretty Landscape format Smaller font Expand columns to show full date time Etc.

17. Pretty

18. Description Column Note an assessment of recoverability Find the file in WinHex “Recover/Copy” A deleted file has been recovered

19. Deleted Files With your spreadsheet you know what deleted files you can recover Recover them

20. Text Searches Search the entire disk/image for varioous words WinHex returns a list of hits You have look for the context on the words and determine if it is of probative value Select all hits and delete to clear the search list

21. Simultaneous Search

22. Enter Search Terms

23. High light a search hit

24. Lab Assignment List of files organized by file extension Highlight recoverable deleted files Recover the files and comment on their relevance to charges of cat porn Select keywords and search for them.