|
Question: What processes did you (the investigator) use to successfully examine the entire contents of each file?
Answer: Cover page.jpg - misrepresented/Restored
File extension "jpg" was changed to "jpgc" -Changed file extension from "jpgc" to "jpg"
Starting cluster was changed from "42" to "420" -Performed "jpg" signature search and found one located on cluster "42". As a result, starting cluster "420" (listed in the root directory) was then changed to starting cluster "42"
Password "goodtimes" found in slack space of data. -Documented password for later use
|
|