Recovering Graphics Files

Introduction

The Recovering Graphics Files lab provides you with the instructions and devices to develop your hands on skills in the following topics.

• Searching for and Recovering Digital Photograph Evidence
• Hands-On Project 8-1
• Hands-On Project 8-2
• Hands-On Project 8-3
• Hands-On Project 8-4
• Hands-On Project 8-5

Exercise 1 - Searching for and Recovering Digital Photograph Evidence

In this section, you learn how to use ProDiscover to search for and extract (recover) possible evidence of JPEG files from the USB drive the EMTS manager gave you. The search string to use for this examination is “FIF.” Because it’s part of the label name of the JFIF JPEG format, you might have several false hits if the USB drive contains several other JPEG files. These false hits, referred to as false positives, require examining each search hit to verify whether it’s what you are looking for.