Reference no: EM132968900 , Length: 2000 Words

MN624 Digital Forensics - Melbourne Institute of Technology

Assessment - Data Acquisition, Data Analysis and Data Validation

Learning Outcome 1: Record, administer and document digital forensics in social media.

Assignment 1a: Recent digital forensics crime

You need to research one recent digital forensics crime that requires digital forensics investigation, such as malware, embezzlement, extortion, cyberbullying, murder, kidnap, drug trafficking, intellectual property theft, espionage, employment misconduct, fraud, forgeries, inappropriate email and internet use in the workplace. Prepare a report on the following:

1. Provide a detailed description of the case.
a. Summary of the offence being investigated.
b. Report who was involved in the crime, i.e. who was the criminal(s), the suspect(s) and the victim(s)?
c. Identify and report what type of evidence was used in the criminal investigation of the case;
d. Explain two acquisition methods that you should use in this case study.
e. Discuss some options that can be used for preserving the data.
2. Explain the importance of a chain of custody for digital forensic evidence. Be sure to explain the process of documenting, collecting and storing evidence from the crime scene you're investigating (e.g. a laptop computer). Describe the consequences of not following a proper chain of custody.
3. Critically evaluate the forensic tool(s) and discuss their capacity in various categories of functions, including acquisition, validation, and verification, extraction, reconstruction, and reporting.

Assignment 1b: Data Preparation, Data Acquisition, Data Analysis and Data Validation
The objective of assignment part b is to acquire data from a drive, perform data recovery using different techniques and tools, analysing it and finally performing the validation of acquired data. In addition, students are required to properly document all steps in a report, the report should be formal so that it can be used in a legal process. Prepare a report on the following sections:

Section 1: Data Preparation

You need a USB; it is expected to have very important information related to the case. The USB contains several Excel files, a couple of image files and some text files. You need to use your own USB to create and delete files as the following:

1. On your USB drive, create a word file named your Student ID, where the blank should be filled with your name, mobile, citizen, address and some other information.
The file should contain the following sentence: "I have enrolled for MN624 Digital Forensic T1 2021." The first blank in the sentence should be filled in with your Full name and the second blank with the date when you registered for this unit.
2. On the same drive, create an excel file named "StudentID.xls", where the First column should be filled with your unit's name that you had at MIT last semester and the second column should be filled with your marks with those units.
3. Modify the extension of one of the doc file to .jpeg.
4. Create a password word document. Hint. Click the File menu, select the Info tab, and then select the Protect Document button. Click Encrypt with Password. Enter your password then click OK. Enter the password again to confirm it and click OK.
5. Store your current Photo on a USB drive and save it in JPG format or other images format.
6. Take a screenshot of your Windows Explorer window showing the content of the USB's folder hosting the three files. Include this screenshot in your final report!
7. Now delete those files including the file you have modified its extension, and then take another screenshot.

Section 2: Data Acquisition
Prepare a forensic image (bit stream copy) with the record of data deletion. Explain the method and tool you used for acquiring data. You will need this image to perform consecutive tasks.
Use two computer forensics tools from table 1 to Acquire an Image of a USB Drive. In the report, you need to include the screenshots of each step.

Section 3: Data Recovery
The suspect has deleted two image files from the USB, recover the files and explain the method (with screenshots) and tool you used. Use two computer forensics tools from table 1 to Recover Deleted Images and to verify which files have changed of extension. In the report, you need to include the screenshots of each step.

Section 4: Data Analysis
Inspect all files in the USB, use a hex editor and analyse if there is any hidden data in files. Provide screenshots of your analysis. Discuss what techniques and tools that can be used to recover the passwords. Use one of these techniques to recover the passwords from the protected files.

Section 5: Data Validation
Explain different methods of data validation and use one of them to validate data on USB.

Section 4: Comparison of the digital forensics tools
Comparison of the digital forensics tools that you used in this work. Your comparison could include:
- Digital forensics features
- Time is taken to detect acquire threat
- Ease of usage

Attachment:- Digital forensic.rar