Reference no: EM132915121

ICT248 Cyber Forensics

Question 1

(a) Define what is meant by the term, 'digital evidence', and describe the environments where cyber forensics examinations are carried out and the range of offences and issues examined.

(b) Discuss how human evidence and tangible (physical) evidence could assist in your analysis of the digital evidence you found during your examination of the crime scene in Assignment 1.
Question 2

(a) Describe and discuss the term 'chain of custody of the evidence' AND explain why it plays a critical part in cyber forensic examinations. You should provide examples to reinforce your explanation.

(b) In the context of a cyber forensics examination, explain the terms 'chain of evidence', 'admissibility of evidence' AND 'credibility and weight' of evidence". You should provide examples to reinforce your explanation.

Question 3

(a) Describe and explain the processes involved in live analysis of digital evidence in the cyber forensic environment.

(b) Describe and explain the processes involved in dead analysis of digital evidence in the cyber forensic environment.

(c) Discuss the advantages and disadvantages of using each process to acquire AND preserve digital evidence located on your suspect's home computer that was linked to the Internet, based on your investigation in Assignment 1.

Question 4
(a) Define the terms 'inculpatory evidence' AND 'exculpatory evidence' as they relate to cyber forensic investigations.
(b) Include in your answer the objectives, importance and benefits of developing `alternative hypotheses' when reconstructing a cyber crime.
(c) Provide examples of exculpatory evidence you found in the investigation you undertook of the crime scenes in completion of Assignment 1.
Question 5
(a) Validating digital evidence goes beyond seeking corroboratory facts that make up a 'chain of evidence' or 'continuity of evidence'. Define the term, `validation of digital evidence' and discuss its relevance and importance in cyber forensics.
(b) Describe the processes you used to validate evidence in the crime scene you examined in Assignment 1.
(c) In the context of cyber forensics examinations, discuss the statement, "The forensic examiner 's primary role is to seek the truth of a matter."

Part -2

QUESTION 1
a. Using an example, explain why cyber crime has resulted in a need for new investigative methods.

b. Discuss the aspects of investigation of cyber crime that are similar to investigation of other crimes. Your discussion should include examples that illustrate your argument.

C. Discuss three (3) examples of corporate environment violations that would result in a cyber forensic investigation.

d. Compare Computer Security and Cyber Forensics in terms of timing and protection against attack.

QUESTION 2
a. Explain how the Locard Exchange Principle relates to cyber forensic investigations. Your answer should include an example.

b. Explain the differences between dead and live data acquisition and when each would be used.

c. Explain, using an example, why it is important to collect evidence to refute your hypothesis as well as evidence to support it.

QUESTION 3
a. Give an example of how steganography could be used to commit a cyber crime, and explain how you could go about demonstrating that the crime had been committed.

b. Explain the purpose and potential results of a File System Analysis.

c. Provide three (3) examples of information that could be contained in the metadata category of a file system analysis.

QUESTION 4
a. Discuss three (3) reasons why identifying digital crime is difficult, and the impact each has on the conduct of a cyber forensic investigation.

b. Explain, using an example, how a time line would be used in a cyber forensic investigation.

a. Explain why digital evidence is seen as being "fragile". Use an example to illustrate your answer.

QUESTION 5
a. There are a number of traps and pitfalls in the examination of computers from a forensic perspective. Give an example of a way in which a computer could be modified to destroy evidence.

b. Explain, using examples relevant to digital evidence, the difference between inculpatory and exculpatory evidence.

c. Discuss why caution should be exercised when using freeware tools for cyber forensic investigation.