Objectives
Upon successful completion of this lab, you should be able to
Partnering
You can work with one or two partners, but each student must submit individual work. Submit your work electronically to your instructor.
Steps for Analyzing MAC Dates and Times
1) Create a folder on your F: drive.
a) Start->My Computer
b) Under Network Drives, double-click on the icon for your F: drive.
c) Navigate to the MyDocs folder.
d) Make a new folder in the MyDocs folder.
e) Name your new folder ComputerForensics.
2) Create a text file.
a) Start->Run->notepad
b) Type some text.
c) Save the file on your F: drive in your ComputerForensics folder.
d) Name the file lab.txt.
e) Close the file.
3) Investigate MAC info.
a) Right click on the icon for your lab.txt file and select Properties.
b) Record the fileÕs MAC dates and times.
|
File name |
Modified Date/Time |
Accessed Date/Time |
Created Date/Time |
|
lab.txt |
|
|
|
4) Try the following experiments with your lab.txt file and record whether the MAC information changes.
a)
Test if copying the file to the same directory with a new name changes MAC info. Does the new file
have the same MAC info?
b)
Test if copying the file
to a different directory changes MAC info.
Does the new file have the same MAC info?
c)
Test if opening the file with Notepad changes MAC info.
d)
Test if changing the fileÕs contents with Notepad changes MAC info.
e)
Test if opening the file
with Internet Explorer changes
MAC info.
f)
Test if changing the file name (lab2) changes MAC info.
g)
Test if changing the file extension (.txt) changes MAC info.
5)
Use a grid (table) to record your results, something like the
following table:
|
Experiment |
Modified |
Accessed |
Created |
|
a. Copy same dir |
No Change |
|
|
|
b. Copy different dir |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
6) Submit your results electronically to your instructor.