Reference no: EM132860687

ICT378 Cyber Forensics and Information Technology - Murdoch University

Description - Case: Illegal Materials (Methamphetamine)

A functioning workstation originally belonging to m57.biz was purchased on the second-hand market in early December, 2009. The buyer (Mr. Aaron Greene) realizes that the previous owner of the computer had not erased the drive, and finds suspicious documents and videos related to drug use (specifically Methamphetamine) when looking through the folders and opening the various applications. Mr. Greene reports this to the police, who take possession of the computer.

Police forensics investigators determine the following:

• The computer originally belonged to m57.biz
• The computer was used in 2009 by Jo, an M57 employee, as a work machine.
• The computer was sold as-is to Mr. Aaron Greene on the 1st of December.

The police provide you with a disk image from the computer purchased by Mr. Aaron Greene, as created on December 2nd, 2009. The image has the extension "dd". It has been shared with you that Mr. Aaron is considered to have acted suspiciously and answered questions inconsistently throughout all interactions with the detectives.

Materials - Drive Image
The materials you will use for your investigations are: Assignment Data Files , Uploaded on the LMS

Deliverable - Report Task Description:

You should follow forensics procedures, such as taking a hash of the image before using it and checking regularly to ensure you have not modified it. You can select and use any proprietary or open source tools that you have been introduced to or find yourselves to perform the analysis and extract any evidence present.

Your report should detail the investigation process and the findings (including copies of relevant evidence), including obstacles and problems that you encountered and how you overcame them. You can assume that the reader has a light understanding of digital forensics, so any complicated terms/techniques/etc should be explained.

You must include some screenshots in your reports with the output of the tools or the processes and when necessary to support/show how you reached your conclusions. Screenshots should not be used to excess - they merely serve to demonstrate your understanding of the tools/processes and should be used to support written explanations (not in place of).

You will be marked based on the evidence you extract, the use of appropriate tools, the detail of the process, the explanation on its relevance to the case and documentation.

Remember, your report should present the information in an unbiased way. Improper handling/validation of evidence would result in loss of marks except where accurately identified and corrected.

Attachment:- Cyber Forensics.rar