Reference no: EM133713976

MBIS5005 Cyber Intelligence

Report and Presentation

Case Study

Learning Outcom 1: Outline a comprehensive process of digital forensics theory and practice and document evidence and report on computer forensics findings.
Learning Outcom 2: Administer appropriate tools and techniques to carry out a digital forensics investigations including recovery, validation and presentation of evidence.
Learning Outcom 3: Perform a practical investigation into computer forensics, including industry and legal procedures with respect to data acquisitions.

Assessment Description

Report
Overview
Assume a USB drive have been found in the company working site whereas none of the employee is supposed to carry a pen drive. The employees are allowed to use only company supplied USB. The manager suspects that some crucial information have been leaked or illegally downloaded. The USB contains different types of files including excel, image files of various formats, doc files and few text files.
Your manager assigns you the role to investigate and produce a forensics report based on your investigation. As part of the investigation, you will work on two phases, i.e. phase A and phase B. The details of phase A and phase B are described below:

Phase A
In this phase, you are required to conduct research on the current computer forensics tool that can be used for this kind of case study. Prepare a report containing the following information for each tool and state you would prefer to use:
Forensics vendors name
Tool name and latest version number
Features of the product

Pros and cons of the products

Phase B
In this phase, based on the research conducted in Phase A, install two forensics tool in your machine and compare the outcome at various phases. The detail plans and steps of the work are as follow:

Data Formulation
Get a USB of your own, approximately 8 to 16 Gb and follow the steps:

You will create six files type (pdf, excel and word documents). Name these files in a proper convention such as: groupnumber_unitcode_AssessmentNo_*, where "*" depends on the file type. Furthermore, the attributes of these files need to be changed to describe the Metadata which holds data such as your groupno as an author, organization name (any preferred name; could be AIH), computer name based on your terminal name, date/time created and comments such as "created for Assesment3".
Modify the extension of one of the doc file to .jpeg
Then delete 3 files including the file you have modified its extension, one of each type.
Take the necessary screenshots of each steps to be included in your report.

Part 1: Data Acquisition

Based on the installed tools, prepare a forensics image (bit stream copy) with the record of deleted data.
Include the screenshots of each step in the report.
Use this image to carry out the next part of activities.
In your report, cover the challenges to make successful acquisition and what are the relevant format to use and why.
Describe steps required for search and seizure.

Part 2: Data Recovery
As part of data recovery, consider the scenario where three image files of the USB have been deleted.
Recover the deleted images and explain the method based on the tool you use.
Provide sufficient screenshots.
In addition, recover the data from recycle bin, explain the procedure with screenshots. Recover the metadata of these files.

Part 3: Data Analysis
Use a hex editor and inspect all the files.
Check if there is any hidden files.
Take necessary screenshots of your working method.
Discuss about the tool, which can used for analysing the deleted files.
Would you be doing any windows registry analysis? Why?

Part 4 : Data Validation
Discuss different methods of data validation.
Use one the methods to validate the data of your USB.
How to verify file extension? Remember you have modified a file extension.
Validate and use screenshots to proof file extension alteration.

Presentation
Students are required to deliver a group presentation based on their case study performed in Assessment 3 (Report). All of the group members need to contribute and present the findings. In preparation of the presentation, the following steps should be taken into consideration: