Reference no: EM132556853 , Length: 4500 words

CTEC5806 Digital Forensics: Principles and Practice DL - De Montfort University

Digital Forensics Report

Learning outcome 1. Discuss the principles underpinning digital forensic practice & their importance;

Learning outcome 2. Explain the main stages & the associated procedures of a digital forensic investigation;

Learning outcome 3. Apply the principles & practices of digital forensics to given scenarios;

Learning outcome 4. Analyse forensic images of different formats using a suitable selection of tools;

Learning outcome 5. Prepare a suitable report to present your findings and professional opinion of a given scenario;

Learning outcome 6. Critically evaluate & reflect upon your own learning in relation to digital forensics & your future learning needs to be successful in the field of digital forensics;

Digital Forensics: Principles & Practice Distance Learning Coursework

Introduction

1. As a Digital Forensics Investigator, you are expected to follow several principles that are a combination of legal, ethical/moral and general guidelines.
• Discuss what these principles are and why they are important.

2. Explain the main stages of a Digital Forensic investigation, giving examples of what tasks, activities and the tools where appropriate, you would complete or use at each stage.

Background

3. Summarise the case you have been asked to investigate in your own words. State the case hypothesis.

4. What will you be looking for? Where will you expect to find such artefacts?

5. What tools are you going to use? How will they help you investigate? How do you use these tools?

Main Body - Biggest Section

6. Analyse the forensic image and illustrate step by step the process of what you did and what you found.

7. Assemble your findings in relation to what you have been asked to investigate.

8. Based on your findings, does the evidence support or refute the case hypothesis? Why? Back up your answer with demonstrable reasons and evidence.

Conclusions

9. What have you learnt during this assignment?

10. If you had to do the assignment again, what would you do differently? Why would this help you?
Appendices - each appendix should be on a separate page and have a title, plus a paragraph to explain what it is showing (except B and C which should just have a title)

A. References;

B. Spreadsheet and written details about their proposed lab setup and field kit;

C. Incident Response plan;

D. E. F. etc. Screenshots you think will support your report that do not fit in the main body of your assignment.

Particulars of the case:

Victim Steven James Neilson (AKA Stevie) has been murdered but it is not clear who the killer is. In addition, there is no indication of the motive at present; a background check is being carried out.

Suspect Andie Green was at the site and phoned the Police, looks like there was an altercation between the deceased and suspect Andie Green, suspect Andie Green denies stabbing victim.

Victims' phone was recovered from his pocket at the scene.
Suspect Andie Green's phone was seized, no relevant evidence was found on this phone;
Suspect Andie Green gave her statement to Detective Ian Robert Edwards, from which we have another two suspects (Matthew Briggs and Adam Westland) in custody; their phones were seized to investigate further.

Detectives visited victims' home and seized the victims' laptop.

All digital devices that have been seized as part of the case have been handed over to the forensics lab technician to forensically image, the forensic images will be provided to you so you can analyse them and write up your report.

Leicestershire Police have requested your services in order to ascertain:

1. From the digital devices seized, is there evidence to support or refute each of the suspects' involvement in the case;

2. Where there is evidence supporting a suspect's involvement in the case, what was the suspect's involvement?

Please provide a timeline of events to assist the Police with the case.

You will need to use Autopsy to analyse the coursework forensic image then answer the questions based on your examination, question 6 will therefore be quite a large chunk of your work so you will need to add some sub headings of your choosing.

Attachment:- Digital Forensics.rar