Assessment Title – Hands-On Practical Projects and Research Report
Tasks:
This assessment has two components, hands-on practical projects and a research report.
Task 1: Hands-on Practical Projects
Complete the following hands-on projects from the textbook (Guide to Computer Forensics and Investigations, 6/e, Nelson, Phillips, & Steuart, 2019)
Hands-on Project 1-3, Forensic Examination of Digital Media
Deliverables: Include screen shots of the hands-on project in your assessment and insert C1Prj03 in your assignment as well. Also, provide a short summary (up to 1 page) of your findings from this project. This summary should include your reflection on findings as well. For example, you may write as a reflection that after your investigations you could not find (or you may have found) any evidence that the former employee was involved in taking the company proprietry photographs with him.
With the screen shots of your working, show/include your i2 login and/or username at least in one of the screen shots as a proof of your own work.
Hands-on Project 4-3, Examining M57 Patent Case
Deliverables: In this project you are examining ‘Terry’s work USB’ to find if Terry has been involved in anything illicit or against company policy. While your main focus will be investigating for any images in the USB, you also should look if there is any other suspecious material / activity record on the USB. Write a report with the investigation screen shots and explaining the importance of the files you examined and how might they affect the patent case. While providing screen shots of your working, include a short description about the information that is given in the screen shot. For example, if you did a key word search to find any images in the USB and you got results, describe what was your search term? What did you find as a search result? With the screen shots of your working, show/include your i2 login and/or username at least in one of the screen shots as a proof of your own work.
Hands-on Project 5-2, Exploring MFT and Exploring Metadata of File (4 Marks)
Deliverable: Write an MS Word report after completing this project describing what metadata you have discovered from the file you analysed using WinHex editor. Note that if you like, you can use any other Hex editor as well such as HxD or Neo. Provide screen shots of the steps completed in the project showing the results of date and time values you have recorded. Provide a brief description of each screen shot about the information it contains. Briefly describe the main steps that you think are necessary and important to locate date and time values while analysing the file.
Task 2: Research Project and Report
You have been assigned a digital forensics case to investigate involving a potential monetary fraud in an organisation. The CTO of the organisation has given you access to the workstation and other necessary hardware, e.g. USB, of one of his employees who she thinks is potentially involved in this fraud. Your job as a digital forensics examiner is to conduct this investigation. You are required to create a (investigation) plan and describe the standard practice procedure that is used in such investigations. Your plan must include the procedures for collecting the digital data, securing the evidence that you may collect and then describing the method to validate the collected data, e.g. calculating hash values and specifying the hash algorithm that you intend to use, e.g. SHA-3, MD5 etc. You can make some reasonable assumptions if required when describing your plan / procedures.
Deliverable: Write a repor that outlines the investigation plan, procedures to secure the digital evidence, and data validation methods. Your plan should include steps that you may take to conduct this investigation. There is no need to provide detailed explanation of each of the tasks that you think are necessary for this investigation and are listed in your plan. For example, one of the steps in your plan can be ‘Making forensic copy of the digital evidence’. The descriptiono of this step could be: ‘After acquiring the digital evidence and securing it properly, a forensic copy of the digital evidence will be made using a proper standardised forensic tool such as Autopsy or OSForensics’. However, the plan itself should be detailed and as comprehensive as you can think of covering all possible steps, starting from collecting the evidence, securing it, investigating / analysing it and then preparing the report of your investigation. If you use any references, make sure you cite those references at the end of your plan document