Skip navigation

Start your free month on LinkedIn Learning, which now features 100% of Lynda.com courses. Develop in-demand skills with access to thousands of expert-led courses on business, tech and creative topics.

 Start My Free Month

Next steps

Next steps: Learning Computer Forensics
Next steps: Learning Computer Forensics

Join for an in-depth discussion in this video Next steps, part of Learning Computer Forensics.

Resume Transcript Auto-Scroll
Author
Skill Level Intermediate
1h 57m
Duration
370,832
Views
Show More Show Less

Q: Which operating systems support built-in write blocking?

A: Microsoft introduced the registry concept into its OS with the release of Windows 95. As a result, registry-based write blocking has been available since then. In this course, we tested registry-based write blocking on both Windows 7 and Windows 8.
 
If for whatever reason your OS doesn’t support registry-based write blocking, you can enable software-based write blocking via a forensics software suite such as EnCase. Finally, If all fails, you can always use hardware write blockers.

Q: Are there other ways to access deleted files in the usbimage.001 file?

A:  When opening the usbimage.001 file in Autopsy and trying to recover the deleted file (i.e. dreamCar.jpg), as shown the chapter 5 movie “Searching,” if you don’t see the deleted file in the Data Sources tree, you can still view and extract the deleted file in the Views tree as shown below.
 
faq2.jpg

Skills covered in this course
IT and Hardware IT

Continue Assessment

You started this assessment previously and didn't complete it. You can pick up where you left off, or start over.

Start My Free Month

Start your free month on LinkedIn Learning, which now features 100% of Lynda.com courses. Develop in-demand skills with access to thousands of expert-led courses on business, tech and creative topics.

Start My Free Month