Reference no: EM132387196 , Length: 24

Learning Outcomes

Examine the functionality and challenges of different types of file systems as they this assessment relate to digital forensics.

Apply appropriate tools and techniques to complete a digital forensic investigation including recovery and presentation of evidence.

Assessment Guidelines

Lego is defined as a line of plastic construction toys consisting of interlocking plastic building blocks. In the state of Western Australia, it is illegal to access, own or distribute digital content relating to "Lego". An allegation has been made to law enforcement via a witness, who claims to have seen an individual access "Lego" related content within a place of work. Following the approval of formal warrants, the computer in question was seized. The computers disk drive was then forensically acquired using the Belkasoft Acquisition Tool (BAT). Unfortunately, the junior investigator who obtained the forensic image of the computer's disk drive only performed a logical acquisition. To worsen the situation, the junior investigator misplaced the original disk drive within the forensic laboratory. Given the time-critical nature of the case, an investigation will need to be undertaken on the available acquired data.The following list of facts have been produced for this investigation;

• The suspect, Jane, denies accessing "Lego" content on the computer.
• Jane did confirm that the computer does belong to her.
• Jane stated that she does not take the computer home.
• Jane stated that she does not lock the computer when she is away from her desk.
• Prior accumulated intelligence reports suggest that Jane may be formulating conspiracies and be in possession of content that suggests that the moon landing was fake.

You are a consultant who specialises in digital forensic investigations. You have been assigned the task of examining a forensic image of the computer that was seized. It is currently not known what Jane was doing with the Lego content. In Jane's opinion, the computer was infected with malware which could have resulted in potential content appearing on the computer. Given the significance of this case, Jane may have been engaged in additional illegal activity.

Your task is to investigate the supplied forensic image using appropriate tools and process and to develop and submit a written forensic report on your findings. You may use any tools to undertake the investigation but you must justify all of your actions.