Name: -Rohan Sunar Roll no.
:- CS21028
Cyber Forensics
Practical No. 6
Aim :- Recovering and Inspecting deleted files
Check for Deleted Files
Recover the Deleted Files
Analyzing and Inspecting the recovered files
Perform this using recovery option in ENCASE and also Perform manually through
command line
Step 1 :- Download , Open Autopsy and Click on New Case
Step 2 :- Give a case name and browse the destination to save the autopsy file
Name: -Rohan Sunar Roll no.:- CS21028
Step 3 :- Then give the case number and the details as per the case number when performing the
FTK Imager Practical 1
Step 4 :- Select the option which is “Generate new host based on the source other data” and click
on Next
Step 5 :- Select on Disk Image or VM File and Click Next
Name: -Rohan
Rohan Sunar Roll no.:-
no.: CS21028
Step 6 :- Give the destination of the image and click next
Step 7 :- Select the ingest module and click next
Step 8 :- Then click the Next button
Name: -Rohan Sunar Roll no.:- CS21028
Step 9 :- Now we check the files recovered
Step 10 :- We see the Deleted Files
Now We Extract/Recover some deleted files
Name: -Rohan Sunar Roll no.:- CS21028
Step 11 :- Set a directory for the recovered files
Step 12 :- File is extracted
Name: -Rohan Sunar Roll no.:- CS21028
Step 13 :- Now we Generate a Report of the Autopsy done
Step 14 :- Select a type to store the data and click next. Here we are going to generate the report in
Excel.
Step 15 :- Now select all results this will generate all the reports and click finish. The other option
only generate the report for tagged one only.
Name: -Rohan Sunar Roll no.:- CS21028
Step 16 :- Report is Generated
Step 17 :- Click on close and open the excel from the directory it is stored
Step 18 :- Excel file is this
