Reference no: EM13905169
THE CASE:
Donald Price is an employee from Joachim's Art Gallery based in Melbourne, Australia. Mr. Price had been suspended from the gallery when an audit discovered that one of the pieces he was responsible for had disappeared. (This was a small watercolor of two boats.) Unfortunately, Mr. Price wiped the hard disk of his office PC before investigators could be deployed. However, a CD-ROM was found in the PC's CD-ROM drive. Although Mr. Price subsequently denied that the CD-ROM belonged to him, it was seized and entered into evidence.
A forensic image in raw format of the CD-ROM can be found here: https://www.deakin.edu.au/~zoidberg/2013OZ.ISO
And its MD5 hash value can be found here: https://www.deakin.edu.au/~zoidberg/2013OZ.ISO.md5
You, an ITS officer employed by Joachim's Art Gallery, are assigned to examine the image for any information relating to the case. You should keep in mind malicious codes and other means which may potentially alter the evidence. YOU MUST CITE ALL REFERENCES INCLUDING TECHNICAL MANUALS AND LAW PARAGRAPHS.
Your analysis should be conducted on a virtual machine (VMware) and include the following information:
1. PROCEEDURE
Use an evidence form to document the evidence given to you.
Describe the environment of your forensic workstation and the access to the machine. Describe the procedure that you used to download the image file to your work directory.
Give at least two SHA-based hash function values of the ISO image.
Explain why multiple hash values are necessary to verify the validity of the image file.
Explain the procedure that you used before you could access the image file inside the virtual machine.
2. BINARY DETAILS
Use a table to document the detailed information of the files found in the root directory of the ISO image-file names, file actual sizes and their MD5 hash values.
Provide a description of any programs you would like to use based on the files identified on the ISO image.
3. FORENSIC DETAILS
Describe the key words you used to search the ISO image and explain why you chose them. Detail your search result and give your conclusions. (Document your procedure including commands and screenshots.)
4. LEGAL IMPLICATIONS
List one violation conducted by Mr. Price against Cybercrime Act 2001, and one violation conducted by Mr. Price against the Crimes Act 1958. Back up your answers with definitions.
Is this case best pursued as a corporate or criminal investigation? Why?
|
What is the return on investment on this upgrade project
: As a large construction company IT manager you have been asked to decide if the company should invest in an upgrade to the servers that support your engineering department. Include a cash flow table from your excel spreadsheet, include investments, a..
|
|
Compute lower of cost or market for inventory
: 1. Ames Trading Co. has the following products in its ending inventory.
|
|
Write case-study on when teamwork fail to meet its objective
: Drawing on your own personal experience, write a mini case-study (max 1500 words) on one of the following OB-relatedtopics: When Teamwork failed to meet its objective and The appropriate use of power in the workplace.
|
|
Faced with brutal price competition from low cost carriers
: Faced with brutal price competition from low cost carriers, Goliath Airlines is hemorrhaging money. The airline’s president, Fred Goliath, calls the mechanic’s union representative into his office and after describing the company’s truly desperate fi..
|
|
Case best pursued as a corporate or criminal investion?
: Is this case best pursued as a corporate or criminal investigation?
|
|
Gross income
: Herbert was employed for the first six months of 2015 and earned $90,000 in salary. During the next six months, he collected $8,800 of unemployment compensation, borrowed $12,000 (using his personal residence as collateral), and withdrew $2,000 from ..
|
|
What is the velocity
: The velocity in a circular channel that is 6 ft. in diameter and is half full of liquid is 5.62 fps. When the depth of the liquid is 2.70 ft., what is the velocity? 5.34 fps. 4.70 fps, 5.05 fps, 4.30 fps.
|
|
Difference in the mean amount purchased on an impulse
: At the .01 significance level is there a difference in the mean amount purchased on an impulse at the two stores? Explain these results to a person who knows about the t test for a single sample but is unfamiliar with the t test for independent me..
|
|
Was benson bound to the residency agreement
: Benson suffered from dementia and chronic confusion. When he became unable to manage his own affairs, including decisions about medical and financial matters, his son Eddie arranged for Benson to move to an assisted living facility. Was Benson bound ..
|