From 5992f3c5c5379de69101ed043a8038a2902aeeff Mon Sep 17 00:00:00 2001 From: Frank Xu Date: Sun, 18 Aug 2019 15:03:21 -0400 Subject: [PATCH] clean up --- .../06_Windows_Registry/DisableUSBWrite.zip | Bin 0 -> 320 bytes .../06_Windows_Registry/EnableUSBWrite.zip | Bin 0 -> 317 bytes .../Email_forensics.pptx | Bin 6919406 -> 6919416 bytes .../~$Email_forensics.pptx | Bin 165 -> 0 bytes 4 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 FSCS727_Forensics/Labs/06_Windows_Registry/DisableUSBWrite.zip create mode 100644 FSCS727_Forensics/Labs/06_Windows_Registry/EnableUSBWrite.zip delete mode 100644 FSCS727_Forensics/Labs/10_Email_Investigation/~$Email_forensics.pptx diff --git a/FSCS727_Forensics/Labs/06_Windows_Registry/DisableUSBWrite.zip b/FSCS727_Forensics/Labs/06_Windows_Registry/DisableUSBWrite.zip new file mode 100644 index 0000000000000000000000000000000000000000..6ece1de97f467bc4f2d66cbaaf9ad0799b7aa47a GIT binary patch literal 320 zcmWIWW@Zs#U|`^22$D}TW3b%Ev;)Y~V`N|u2GTB>#feEdsiDD6;YFDxsd`1J>9PHR z+)WMwE&HD@_^%Acum~dsa@?>!W(x6XujDX9N&4imHVNc>@KU^C^J5vnXk{zo58AW<95n$ z-zN3EV?jAC3a$sjw(37AoSd!t-pRi5+U-B_MH97xW&f7;9!_62`Po?s?RT@Z0^_1v zR~9dvwRr9s)hV}fl0=Rj4e89AzOXE3P4uY)?><}aeV>;f;LXS+!hqYWK;Hs^0+__= T@c?gDHjpeM5IO?smtds;ltFfs literal 0 HcmV?d00001 diff --git a/FSCS727_Forensics/Labs/06_Windows_Registry/EnableUSBWrite.zip b/FSCS727_Forensics/Labs/06_Windows_Registry/EnableUSBWrite.zip new file mode 100644 index 0000000000000000000000000000000000000000..f6da96829cbab4eaffc67cb5da4292f7b2cb1c0b GIT binary patch literal 317 zcmWIWW@Zs#U|`^2NRm%8vkR(uyB)~WV`N|u0@AK|iAg!Bp}|h!MVTe3dPS+}vHb_R z4jBlz+>iVq?`7|>r$W%iLsVpKmuUA2k<4zEC9Pq)|MpmQawsKkwzi&p^4)96WQ`LV znJYdF*b=N!7` zw&K|fwa=YPx6O`dE!`Np>UR19S?TA~E|&lPGw*#~etf#ld`nP5~Z{$ zLS##JvSj(rOz(TW-}jB{H~0TO_y3&poaZ@nUC%LBRgPYV+>hK2SWIu@ElJ(awZ*?hqC6}Y%Zpx4S+nZjkjAPm-;8=zkYkJYcqExjok=uvhMJn zCFv}Cu~=F@nHZ}+d$3~ErE>TuT@9^c$~jI68@4Xv<{y^R=bf8Njj-XTr3iJ~dDfVE zcTBI0qtZjX(#Ouw8&`cl-sO1j`qR52U-v#q>_am{e{Morko$`D&8UD;`HhCCiWNiC zHYUvF&LnoE=s?zwYj=;(6FZbYkKLFHE6t6nnlnyUpDEq9`Xx8iTWve|F4y6CccwK3 z^%qNL&e_ksW*DG9QQ-FLnPk!hUHYU7fnVi3Pm$4QS1#b`MKML1{S`KvDyt)sNh$MZ zsTX@X3cm=?%_NruPPcX32u9M4&DBPI5=+AE0T+g zxcbsugY^eLOgC{boqcKEDm_BCD!Q|^7#DjorqXp{k}i4k;tbk+vai_m4b{DbgSC2u^!MlQ;eCK{FAS}ojLLZ^AmO- zH*X!0&OElgpTM$f9J?whRqVOQ&XU=W>YlVO5O!-(@42W{QEq?7sLL*GsUns*C)Bsr zoqA_|aGtyEVX%HJ(fW7NN6e({mzlJUP6C`StLMF??lNSgA=^Le^O~ z&eT7`H6BR;jj|EOk0(dJ_6z&`Se2I#xfOBis`@6qB$U0ohB&kL1 zj?^hUF||}dr%0OitX8GqCjuF#ilUAN-5#NfeCO;pr!F=;r5&Z4T3%y!*DmZPZbC(1 zXH0B6Lnr@H+4{B^{_JQ5;?h@}yNS-;{I=XS9@|SJwH96GxBZ(va*|(c1`rl7f_2&(^oN17rmGX78sKtNn<2>y+1k|E# z?a@lvp0rDn@&7W>Z*yCF!2Lc|VZh4XSw6KBOQF&NwC8r0v!_2kcBI$0>ze(_{wI8= zzc~NSF`q0D6N32H_#IYW#&|ydnI&xYYp5ms{`g#ka_UUECt+YtBd6J+F|$kS>+cfL zcl0hYjm%gD#=I{QbgOcBNj<`h@lmJRqBZTO&-yW+?0jB6`!eLQ&$OYJR#tp>-n8M( zZ}Ez^9x+EY_)N%}%{w^iU+wkQBlurE`S!;zwF^?hjekLh5Y z1wSPzbF~Ae^Vg^4wMik_J-hXIXZ_p@`?rld4tpl>xpHeBh&+qyHU3iRS?YT2bqjtC zH>f0->&rXmqM^CI@LY2@>F0D3Ys(8mEqQs7F1HgR%Y0YMyLHtbM=KPvDRxb!4oqic zVxl{@12WWN)VkWg5AZ7Ev*N=z5~r;R)7B^mH3SWzfzXnst@j9w(zKnb-A~%9LN`K< zmtWZu9=sA8ZqAUjz+bp!9M;yXHc^n@vtTZGeH8q3uR41;efX2zbH--99bsjGcLpl- z$zRrVSobHV?Ba<(njEuM9Pi^Eh)jKZ+!9@Xa#2-@o@f+!A@r)R=ZW6!hZ-98C$RDw z(t|PA5BjtBDnvNks&h11vd>ArFJw@Ygfjm;1)`b zUhmwP)R(L6#9Ixzn*IcuEuK&w)g10$+qLcES>FXY2|Vg_5PAp$gb}ir#G}4Xb{Gh* z$_s$`B!q#Ww<-@&fGCpmR*yc?A|$ynLH0v15M~GqgcZUDVTW))I3ZjRZpZ-$4}=%O z2jPbZKm;K|5MhW2L=++hIS3JlNI(ujBq36e!w_jwlAFxetDrScP5{I#$uJNm^5h^# zNE3PTst$l&MQI5okLX05B5EBx! zwCVAOG)0%$kB}_Bn>JD7i=s|4&Z>5XD!ytvJw3PeLGk7F^22Xd!K{)+X@$_avN^?? z_^Jt3^_%f!hCGD$lwbNLg&%op#Wg4L^e~sJC)=9awYE8_D{^nR zrga5mG-i&dJbkZat{~hhJ?qOqGG9K^AV~w7EWKz0I*xps+0d7Y8p<&|zR(dgystYl zVOxm4u2HOr;dPC;-32R|c2pB?^yoCp<D?S zo>E-KTM=co3|)~_9QEit&0fecH;FD{uForCypd9I4%P%?jDgIcOowS2>%h`uY)esER*UF6 zwDSDiuU|c11x__s8-9A8@Ik7~0((p6P)$e`F+29nut0KloV%1)nT<%BhtiBU$vg^1M_LUeT#d+oF zDI*qv(fa;Z(_kx_R<=x-$?QgmpL%e=VA>{s=SUP|wmerydhe^I6#7G+6Pw>&HO>8g z*--Bp-fo`~!G_;Z|8P>tlfl>ULfO^cY@8MQ=8c@8uv>}R#fA^AT|DjKnCNB{F3GR{ zQl^sM;RTW7Tw#LGUb-r#FO4i^g>jAjkJ$nwYOw6e&)<9yu=-}CT^kZG{&dzh=IGao zo%7v6ts&i$)BdxILg#*5ty$Tv8{aER`?Kgk`(i4~mA2l*NBd%L#*j3W#9p_)jzwj~ zW7vUIHo{DrG(%*lX+BHE$B?)!5LFZnJ8iBNu(m`*@IxJAi(}s`CPzl=*v(6ooVr2+ zBIOsT&fc_?T@IO7DiSC@kCV=lWHTCVBx#K~Cu!_3>o{0f%IKp#wDLk~?=|rJX)$D! z&Q%qDC}vt7+9k~tHg{WkjKQVK!~W)j9d9|6)x~!=O^zI|iAr?w3UV62pHs9p94p@7 ztCgzf+JmpFH)(5XTku_wT_C*}N$sm*AZTEa$61Np)vW4gt{-CXQh)cVvgdizH#(8k zI5kVBuTO_*S%tkjwran1mMnAu6_>uoP$0w8e0<-Tl&XO54+B$wJ$XlM)1b&c6J`E&XGbp3Q035i3pJPeey~jXr+;P45_<);l`1ODUpW{w5p;b z-n<^AXEX|law?2VkurXqvpO4L(5XUPS^a_6jJl^bITFCXVMB_dZ>S=KZiOX3y*+zD z>$d7Adfyk)2YC`%)6O&=YvtrPye;`e|53Kdoyt3?NBmzzj*&X#D&|@3Ch_UG+g`SJ zxnkJ1C3?&?9FHr#W0rAate3!kz3xV2(XAlRHlNU8Z~JwnCXwh=n=AEBht;I(())Ih zFi7Qgbu~ZU{B*Khb7Z-+gXtGqKfT>(?UmN#Z*QZl`gCI}R(FY}*AB=W#BZ7P?d>1_ zXo-G^pQ~uXn+O<1XDJQtFozigXpG(aG-wkaSGP5F< zqKf;uxNi8&u)St{ zY*w5tI3%)od7?m>;ZKLUHl4WxyZrN(nKLw*Tvh4$^w_Na=`**OvLw418CXulw_k|D zb1lh_TujK7GBVeT)B9xjGY+r}@mTFi@@~0UfP7}{BhF}z_u%_2{S3O+ulU79UE)0kPR!0Xn$~Epu&EyfvcIKjmg~GSHZgvd29ojSMT=? zX(v7ii`*~S*~`@F&$Z#j$L@{x{CX}=RxDhrpDU< zDpHFbqRUQ8`A-O-_d{$^!vN=pXj8M>XWejO%hIr?1^eK#HE$*;^ zUb3DUr)aiF*d-fiM?&v|Uw_BUi$r9pr|02hT$JaRb#R$^AAFVl=fk^9=_zy`x@dm? z9p0Us1g}%>Z#h|8{GlvmnykOun0VWoBi!`GVDReR?3KVm~jIx=sqoJJ^)J8*l2v~*zeN7AnYQ&(yJO+_MHG=3E zSepZ_EzgcDi!of#A(SATvQPshRB>dkxpxRaju8D{M_zpXv;O{UIF+sftE{TX4 z`g}S4-yv$t>1qGoSz{vO|Gp0=!B!&Tj5bJR1ZPqiIlyWvyx#aEc)iP@APJEGB`Hv! z07FTL4qC#6863QbXrO~Vn1L5r^kqqcs*7+vUvnjad675=U`mF!DSlECs3pU?mX{QW zp@BJZO`7CGaK>n$lC?d~*aiCiztN-^W2)709m2bAxGkOyhsL^R`vk8$Jfe z|MhKMR|V8WT8B>2-RX zVB!i~1WOuxY*s)z4cf1Q0CGqJ^=Zf<%Fz%Er6HVX?eC_*>AR^o;J*UGz|l+?x_rehwRK_nfr*iXp& z>_4W4?QCTmIZD5|kXI^Y&pOGOY8^mhC0AZgS9D-hLc$n*>dq-*^Om85fA`IFH9=b6 zcz)H)D^tr0>)NNXN_xm?TQcFFtP;x#UTm-=i8*tdO8=Ob+ugydzx-l|*n<1s-df3p zkCP^xcedYnL<|~LU#ZGf(-r$tX3I_R#Vt1YD|DQxqQ zd&w_&mlTE*@2?E#39f&cUcVlo#&5ZlU-oUybMqQUw=6etG|^VD`QgNuz5!9@Q}cP| zl{wroHlf*@RW00&la=>wzUWfUD0yWpl3g%7EpHuOciu{!f1)NVOyMYg@9m0*HNof2 z^*-!c+nI5Pz@3LF!HxE+5&W@@Dy&EA&qq1(w%n7^=4o|oQ3%M!53w_F&^-$}@l)J5 z#c-wl5f4*p=Na&&_;c{>C*c+Il_a_OX6BUlxtF{&b}m)U$j(Nwq^ShPZxP?V?(Ipm zV{1_td9EV)YL27$mF8;i!FO#p_YcewO4#~FRLqOsv&j>`K36d>&fRnn^)ioY;yBu{ z^+Ayum_!~G2hi$MLG=N4wHC zBk89MqQV%a0PV64{_Q{^^AgjxF22G=n0ke2K(Ah{$#MSU#l%`Dw+WQJjh_IsyCSRR2l zG-xvX$(=LZ#!c-%?*7c5Tkh~37vQ(O5oY^v#MZIXvggOiTw1+XhX^mRhsM67={S$P z6C4il`znzcIc8%LUZEk~d9fv+cTcuP=rN9F%a*$8)eHabwUY1$t8)} zLglaSv&WIszmJc6Tr3<*O@4Vsf~@F2WTi)TYhv1`V0p=;Z+^!jhSZ{|BU3HsBD`>D z?A=#Ooum}4SONLG#;J#d$!V2fEAEZY+B)5AGz87V&b(8mw_`Uur!~IUIJ)|oq#Cad z$B=G~>Q|mfvNaH1X#Uo_Dm2Z?c_@P8^0p)L^9ofvO$=+H;{e|#M~kXXaCXZ~TKJtp z8GLZJ@7VaQ>uV#DkLGoLeChb0!KXH=GW;Db#NgozCqnUUI!_ax_k@E< zwVj711h%|`zeUX9>}L3PPH0~c6#f!qsd@VG&H%CZ;Lv!$~G-qzXfBd|h>c^5J8AZ=}L}W->OwGxyNGJGa&+GRWcaiG5?(TnJ z^N2f)QNMpcv@oX2)_y&YuH_A)(7U_LMOeI@s)1m)fBCDsIFrPAi{sGCXL z{@$l-U$zmRI=HQ{H5`0%bp2IpP{~wB_wqH=%@}jqwUYD{Z?#R+!MUvfwhq6ai9L_@ zE&RlounIH(8&ED(7^mk?e?s++SQ75%zFQaERhsquxHC; zL9EhMV{QHTc$1$L&Bl3c-iA1DgMy$T7zj0lhCFXWD>O;1c;;g%ne7POCp3XQOoxhm zyHM~nS|rjya?eUIuqIV~MnXmNE%DCAolQIM_l#5ILpil4YBC62DF&+StTC=@$1-BC zxlZmCimERTiSG=_@l?@=ldBgCd@UkVSz=1q9film@^c3+6XplZa|V)o*_aL&dL;6{ z_}P04hs@zfk+`zYa`dmg2zWx4&d1|HcZKp53ir0Z_sq2RU-a^Q18x*4Vhx9NeNLge zg7OaNXx(hI*3N4hlrtXh)=V4^6F6z9C1|!%yWwtRqs^C{Ig+$KbFU_Q=Ub)sld?Ng zNeZj_-LutmYt(y&rJvr~e%vjp%sxEw!PixwQ-^Ocjs5u$SldzFE|NYRcsqL3yXgdV~GVT3S|g*2HDP5@qC4Iz{g`G~KE zpaD_V84KA5VTW))I3ZjR9E2Of1L1}6LHHp85J89#L>RIkA_5VGh(W|52Ots8$Sm_eYSiU2uHSDk20 zX>tIc1cZUC1k_EvKrN+7+*42R1+57PAKCSr+Amr_v!E!1I!qK_P=qLv#TS%y9DoTw zix5hU=)=zfVTG`fefY6$C%^&`!C|k!b40kR3WDrstzjuc3Dzf;Ss9j@Q6dH z!YCCYL;fK$L%y1pDX>^nlLAro8VtnfMK#D_a`fVn8EYc7oF?QLL<^z~IS$c*oPg*; z^dS0>lMn-lA>Lh4rne?mX12R! zqF*Z8#ull+Cn+fZ=(K%(S?RaF>hTXE%y`CjL))0ytt02nb_U1iFSz%&288MeR7o&B z4LSoV7AK`#9^13aj~`(K+`FRPfdt%m!_kVw!DpY3HS|R7tjq+sv~I6bAM2M3`5OBs z?jPO*4IC`u5A57e-MGsXy6;nVvO;}gM4gdaD3<}xO!B{?X*q?fJOZB(k@DPhmz)Q; zPRV5+DfcuDWqJ52`I=0>GxOE#jw!Ri5I4wqh&#js;t9Dxj-U3*yFim^ zbCT&gIADqh6TJUX#6IQTWIM6mk(LP(1sU%&Pgx|4HKlVIyvT{QHJijo4TpSO7K!`V z&{SWqB8#X^WYfH-XR@liL5nG5FMix#`ttl{Zp$%KDOBg_4#p}y6CYGifu>fkNkfL) zmMa6hRDzw!aDQ&s&#N{1-RFu@EbPuAXO)S?ea*cO)+e!imazOG*@)|ai7CjG3eEr96OxNs_>Q;P$UyEc$qrME!{qK8QC=Q7ln}TlTi18^XlNzopZ8^-U;#qI}tTMz^j5axz;i-6L`*ntE?u~`?)ftCS zSfy$P`?0{3L>oTlJtL8eKb{Gyj94691`n(e8$!#P^@?NBcyJx4wtVX)ZFs8^m@FOb z`z$uVMBc5rpPm(&XHDB6_4ssF^-6cj+UsoP$h7;;jr;jxBM#Vv(x0(Y>AvLFGoRp` zhsGs-&5pC5dv1a-vEX`)6q~rYn*VKacck(V6pWViHxDR%C*vexiq}A?c!Z6YDOemp z`>Od}vcFxY889;*KcTIBDMhC2WgCv(_*zOrXBEnm$|vba?qjD3TcMGv{R#pkzgdov zGWJH@Sn%{Ta)6*AcBC=aNzeb**K%8w@#xk+Riivws$W@ctc+!|8bj~Ndj?X|+)+PP zy)b3%af-XXWrvl4*C3;%V4Ka5&2~m$yGm^0hb`MPwbk_0)_&}jht1|*hdTM9{chaR zJ8w~6mIuwR##7_cj22xdDp6}^?^LY7-`5^H$p(d?r<%?Lx53Z*J8u2OI?NX?K@Lx6Q{yaTTKq$MQZ~)S?g)t zx`_Fug68lhUaKfVyKv9fh(O`GVKL3`j9Qn%0{koOoGhisgZ#Eg&q~hmS$oHCRae9J z;5(B=GA+SgG537qv+dwwBw9OEo6*82Qn{%0(b#zJp<{DpXW90sDSJQa5ayC{@+n(H z5=H3oZ&$?XuV-(v<*X-?t~&71+}27+dTxw8J$h@J`CP`43_oXri)36wx#7p_3%Rqo zJ_gO_3yP0P$uqux(K72woylF1K6}tvyzb32Lw*VC94_|84QjsiZ#z!Ud(ycX%kD|( z@S^zaB`b8DLzX*kD2wa;WSKH)%1O6%SyvWPD|rOUkLDy?$;biCR7 zBa`(WFZp{e-F+~+f0|mkONY-ia#*tUJ}P@QpXK2Su{TaV`yxkk0!!4}5)>QpT7=iT z@>>&6!cWOdaJpgHn-7 zp=yV#xhDoU9#>`?J5AqG@;kYP*rHzpjubA^*@lJ>gsOI~IsMi94R5M5%2NA9;(k3r zy`OI{lsov^V0KkLQHe!!uX}ma3@eV8Wfsz{S+!va@jE`tRK17Up(S_OA^Mzu{sRKo z{g5;0F&mI^1>pdAKSTkIwI?as^MFo2L&C|C=MWT5m7+N0^5tw*McW~#Pa}LB!VS)@nR#?0JXJL7l;lgi1&;So{5rUN~#E--OR2le+u{|*N5 z@cqN+{^@B#KvYo-Aew;KquKO-`*N-#s%Wm0f8q|%K=FgLtB5^H1bn}Wm|?!Upn$w4 z9Y3&%MieliZYW@3gb@U#6l=^71GWt@@*vL%4$Tn*Z<7Kz7z2By)l-AodTP<%vlpZs zD&NArb{#VnmB@czNJ`_^VY)x{W@F$pWCr}#5EIORHXT^frV|C%uOTv+;4=C@DMQ!b zkjIi3DO+_;AP|cfp!9%yETV&1TxA5;DlQ>_=0~1Pvc}O0-8dT&0ao1t-7B~@%#R_y05vkv&t$jTI z8R@sKdMf~~1VkDv!jstl#BQ`G0M`grUVtRQQmT|vixP^UH~~35GN6_N^*|PKvcbghRsv+F#e^VKvHeO$ulw z{C}~p-iHA^w@HB?d58Y49+h+i6T o4@*S_fB(8@L3$P<#!uNLoP&iN(f?aW9`t7+;<-xG_{P0Cmy@0s!EX4-EhS