CGS 5131 - Practical #1 - File recovery

Background:  Lon Garm Law is a Sgt attached to the UCFFL (Univ Central FL
Forensics Lab).  He monitors students on probation.  He encountered one of
his parolees who was using a computer in the library.  The student was on
probation for possession of kitty porn.  He was forbidden from using a
computer to view any more while on probation.  When he saw Sgt Law approaching
him he quickly typed a few keystrokes and tried to prevent Sgt law from
viewing his screen by jumping out of his seat and warmly greeting the
officer.  Sgt law thought he saw an image disappear from the screen.  A floppy
diskette was in the A: drive.  The student was visibly concerned when Sgt.
Law ejected the diskette and took possession of it.  Sgt. Law needs your
help!  He observed the student at the computer for about 30 minutes before
making his appearance.  He ejected the diskette on 8/21/01 at 5:26 PM on his
watch.  The time on the computer was observed to be 5:28 PM 8/21/01

You received a single diskette from probation officer Lon Garm Law which he
obtained from one of his parolees who he suspects of a violation.  He wants
to know if there is any evidence of kitty porn on this disk.

Use the image file P1.IMG to make the evidence disk for this assignment. 

Hand in your processing report, an original (unchanged) diskette, the
modified copy diskette, and your forencis report as a Word document on a
third diskette (This is the diskette that would go to the prosecutor).
Copies of appropriate "digital evidence" would also be included on the
third diskette.  Keep your three diskettes together in a sealed zip-
lock baggie that is appropriately labeled.

You do not need to describe how you made the original since that is 
what Sgt. Law supposedly gave you.

Any recoverable files must be recovered manually.
Document the complete process in your processing report.  You may not 
use unerase or undelete for this practical.

