And autopsys case file headers and footers

Task:

1. Start FTK Imager and load the LG_6000_4d76e052.ad1 file found on Blackboard. Expand the evidence tree until you are able to view and access the Phonebook folder.

3. 3. How many photos were taken by this phone’s camera?

4. The next activity will make use of a sample Motorola smartphone storage device. Using Autopsy load the Motorola.E01 file and using your knowledge and skillset learnt through the unit thus far, attempt to answer the following questions.

   5. How many megapixels is the smartphone’s camera?

   6. Why do carved files contain no metadata?

3c: 6

4a: 32

4f: File metadata is stored within the management layer of a file system. Carved files do not make use of the management layer and instead rely solely on the ‘data’ area of a file system, and in Autopsy’s case – file headers and footers.