Reference no: EM134001738
Assignment Project: Working with the Windows Registry
Assignment Instructions
For those of you who will be continuing in the Digital Forensics program here at Sullivan University, working with the Windows Registry will be integral to your efforts to acquire and examine volatile memory evidence.
As in any introductory course, this lab exercise is designed to get you into the Windows Registry and begin to navigate it with a simple and useful modification that you can continue to use long after the course is behind you. No AI shortcuts — Get genuine assignment help from experienced, real tutors.
So, let's begin with some simple concepts.
Please use the instructions provided below to complete the assignment for this week.
You MUST provide screen captures in your deliverable as proof of completion.
Try to Write to the USB Device
Double click your .reg file that write protects the USB (Instructor USB Protect On.reg).
Plug in the USB thumb drive or hard drive.
Click Start → Computer.
Double-click the USB device.
In the USB device's window, right-click an empty portion. The option New should no longer be available.
On your desktop, right-click an empty space and click New → Folder.
Name the folder "Your Name", replacing "Your Name" with your own name. Press Enter to save the name.
Drag the "Your Name" folder and drop it into the USB device's window.
A box pops up saying "The disk is write protected", with your name on it.
Capture this screen and add it to your Word document.
Write it up
Now that you've created two tools for turning on and off write protection to your USB storage devices, think about some uses for this ability.
For those of you who remember floppy drives, we were able to write-protect storage devices with a manual "switch" or "tab." This was useful for protecting contents from being overwritten. That's one use.
Now think of at least one or two more uses and add your thoughts to the Word document you've created for this lab's deliverable.
Steps (Continuation)
Right-click on StorageDevicePolicies and select Export.
This creates a .reg file that will apply this key when double-clicked.
Save this file on your Desktop as "Your Name USB Protect On".
Right-click on WriteProtect and select Modify; change the value to 0.
This allows writes to occur once more.
Right-click on StorageDevicePolicies and select Export again.
Save this .reg file on your Desktop as "Your Name USB Write Allow".
Now simply double-click on either .reg file to enable or disable USB write protection.
Capture your Desktop image (Ctrl + PrtScr) and paste it into your Word document.
Deliverables Summary for this Lab Exercise
Screen capture of Registry Hive containing your change to the Registry.
Screen capture of the Desktop image containing the two .reg files that you've created.
Screen capture of the popup window indicating that your USB storage device is write protected.
Your thoughts on the usefulness of the material you've learned in this lab.