>> Hey everybody. Welcome back to the course.
In the last video,
we downloaded and extracted
our USB folder and
file that we're going to be
using for the rest of the lab.
In this video, we're going to
go ahead and continue on with
the lab and analyze the information in that folder.
Let's go back to our lab document here.
On the desktop, what we're
going to do is we're going to double-click
on the ProDiscover shortcut icon.
Then, we're going to get a little pop-up
box as soon as it opens up,
regarding the launch dialogue,
we're just going to say Cancel to that pop-up box.
Let's go ahead and do that now.
It's going to be this ProDiscover Basic 64 icon here.
It looks like a guy with
a little magnifying glass and a hat.
Just go ahead and double-click on that.
It's going to take a moment or so to launch for you.
Then you're going to see this launch dialog box here.
Just go ahead and click on
the Cancel button at the bottom.
Let's go back to our lab document.
Now what we're going to do, we're going to
select the New Project button
that's at the top left of this Window.
It's going to be this little piece
of blank paper looking icon.
You'll see if I hover my mouse
over it, it says new project.
Go ahead and click on that. It's going
to give us a new project pop-up box here.
Here in step 4, the pop-up box is
opened and now we're just going to in step 5 and
step 6 under the project number and
also the project file name in those boxes,
we're going to type the same thing.
We're going to type C08InCHp.
Let's go ahead and do that now.
C08InChp.
We'll do the same thing for this one here as well.
Let's go back to our lab documents.
We've typed those in now in steps 5 and 6.
In step 7, we're just going to
select Okay and then we're
going to be back at the tool
where we'll choose some other options here.
We're just going to say Okay to that.
Now, we're going to go to
the top and we're going to select Action.
From the very top menu there,
we're going to select Add and then we're going
to select Image file.
Then what we'll see is a pop-up box will open for us.
Let's go ahead and do that now.
We're going to select Action,
we're going to select Add,
and then we're going to select Image File.
You'll see we have a pop-up box here.
Now what we're going to do,
we're going to navigate to this location.
If you notice, it's going to be where we saved
that USB file that so the C:\Work\Data files\Ch08,
and then all the way to our USB folder.
Let's go ahead and do that now.
We're going to scroll down, we're going to
select our C Drive,
we're going to select Work by double-clicking on it.
Same with data files, we'll double-click to open that.
We're going to double-click on Chapter 8,
and then double-click on our USB folder.
In there, you see several files.
Let's go back to our lab document.
We see in step 11 here we want to select a file
that's labeled as jo-favorites-usb-2009-12-11.E01.
Let's go ahead and look for that one.
We're looking for jo-favorites,
and you'll see there's only one that's labeled like that.
jo-favorites-usb-2009-12-11.E01.
We're going to select that and then just say Open.
Now, we're at step 12 of our lab document.
Now we're going to go back to the top
of our screen there in step
13 and select Action and then select Search.
Let's go ahead and do that now.
We're going to select Action at
the top and then
we're going to select the Search option,
just about a quarter of the way down here.
It's going to give us this pop-up box here.
Let's go back to our lab document.
In step 14, we want to make sure we select
the Cluster Search tab
and then we're going to mark the case sensitive checkbox.
Let's go ahead and do that.
Here we want to make sure we click on
the Cluster Search tab and then down here at the left,
we want to select the case sensitive checkbox.
Just go ahead and click in there and it'll
check the checkbox for us.
Let's go back to our lab document.
Now, in the search for patterns checkbox,
we want to type FIF. Let's go ahead and do that.
In the search for patterns,
we're going to type FIF.
Let's move on to the lab document again.
Here in step 17, under the select the disk images,
you want to search inbox.
We're going to select this option.
It's going to be this one
that ends in jo-favorites-USB-2009
, etc., E01.
You'll see it's going to be this top one here.
Now, we don't want to select this one,
you'll see it ends in the C drive,
we just want to select that top one there.
Then our next step here is just
>> click on the Okay button.
>> What that's going to do is a search just going to start
for us and it's going to take a minute or two,
probably about 30 seconds is
>> probably what it will take.
>> We'll take a look here. Just go ahead and say,
Okay here, you will see at the bottom
it starts initiating that search for us.
You'll see the little taskbar go in there.
We're just going to let that run.
You'll see it didn't take too
long to pull up the results for us.
The first thing we're going to do here in step 20,
once we're done with the search,
again, it might take 30 minutes or
maybe even a couple of minutes depending on your system,
we're going to click on
the very first search result
and then what we're going to see is
we're going to see the hex of
that particular file or item in the bottom window.
We're just going to select this top
one here. Let's go ahead and click on that.
You'll see all the hex here.
Now, what we want to do is we
want to scroll down and look for the FIF.
Remember, we search for FIF,
so we want to scroll down and look
where we see that highlighted.
Here in step 22,
we're going to use a scroll bar on
the right side to scroll down until we
see the FIF and see where it's highlighted in blue.
Let's go ahead and do that now.
We'll just use the scroll bar on the right side here.
I'm going to scroll down a little bit here.
We're just looking for FIF in blue.
You'll see right there,
we see the blue highlighting,
and we see here that we have the FIF.
Let's go back to our lab document.
Now, what we want to do in step
23 on the left side of the page,
we're going to expand the images options.
We'll click the little Plus sign.
Under the cluster view,
we're going to do that again by clicking
the Plus sign to the left of it.
Let's go ahead and do that now.
On the left side here under cluster view,
we're going to expand the images.
This little plus sign right
here, go ahead and click on that.
Let's go back to our lab document here.
Now we're going to expand the C:\Work\Data
files\Ch08 by also clicking
the small Plus sign to the left of it.
Let's go ahead and do that.
This one right here,
just click the little Plus sign to
the left and then you'll see we have the C drive.
Go ahead and just click on the C.
You'll see all sorts of pretty colors there.
Let's go back to our lab document.
Now, what we're going to do is we will see a text box,
it's going to be on the right side.
Then we're going to type in AC4.
So A, C,
and then the number 4 here in step 26.
Then we're going to select the Go option.
Let's go ahead and do that now.
We're going to want to scroll
over to the right side here,
this little text box right here,
we're just going to type in AC4
and then just click on Go.
What that's going to do is search for
the AC4 box in all of this,
you'll see we've got the number 4 right
here and we've got the AC there as well.
Let's go back to our lab document.
We see in step 28,
we see that the AC4 is highlighted in red for us.
Now, we're going to right-click on
that red square and select Find File.
Let's go ahead and do that.
Just right-click on this little square right
here and just select the Find File option.
It might take a moment or
so and you'll see a pop-up box opens up for us.
We should see that AC4
2756 should be selected. Do we see that?
Yes, we do. It's already selected for us.
We also see that the indicated file path
shows a name DSC00018.
If you notice here on the top right, DSC00018.
Let's go back to our lab document here.
In step 32, we're going to click the Show File button.
Let's go ahead and do that. Now,
you notice that the view in the background
there changed for us.
It's showing us under the content view now.
Let's look back at our lab document.
In step 33, it's just another location that hey,
the view has changed to the content view folder.
Now we're going to click Close on the pop-up box there.
Then, we see that we have all these files that start
in DSC00012, 13,
14, 00008, 00009, etc.
Step 35, yes,
we do see that we have file starting in all that.
In step 36, we're going to look
for the file that's labeled as
DSC00018 and then we're
going to right-click on it and select Copy.
This one right here, this DSC00018.
Go ahead and click on that.
Right-click and say Copy File.
A little pop-up box come up for us.
We get the Save As pop-up box.
We're going to change this name to
Recovery1 and then we'll click
the Save button. Let's go ahead and do that.
Now, we're just going to type in
Recovery1 and then just click on the Save button there.
Let's go back to our lab document.
We've already saved it here,
we've clicked the Save button and renamed it.
Next, we're going to go ahead and just close
the ProDiscover tool for
this portion of the lab and we're going to select
exit at the top menu.
It's going to ask us, do you want to save this?
We're just going to say yes when we're prompted.
Then we'll click the Save button and
then it should close off the tool for us.
Then in the next video,
we'll go ahead and continue on with the lab.
Let's go ahead and do that now.
We're going to come to the very top here,
select File, then Exit.
It's going to ask this, do you want to
save the project before quitting?
We'll say yes to that.
It's gong to give us the default path and everything.
Just click on the Save button here.
Then it'll a moment or so, but you'll see that
ProDiscover goes ahead and close this for us.
In this lab, we just went ahead through analyzing
that USB file that we had downloaded and extracted.
In the next video, we're going to go ahead and
continue on with our analysis of that file.