Malware:ITX8042:2015:LAB2

LAB 2

Additional Reading + presentations!

Slides for lab

Assignment

Find USB Thumb Drive or SD card (The smaller, the better- it takes less time to create an image of it). If it is a new drive/card copy some files there and then delete them.

For the actual lab:

	* Make  an virtual image of the drive/card
       * compute hash 
	* Use virtual image and restore files from there with photorec
	* Document the processs

Additional question: Provide a reasoning why to restore from image rather than from actual drive/card.

Upload the report to the moodle in time !