Reference no: EM132990147

Case Study

Guidelines

Coffee is defined as a "a hot drink made from the roasted and ground seeds (coffee beans) of a tropical shrub". In Australia, it is illegal to be in possession of any digital content related to coffee, coffee beans or information on the process of making coffee. As a result, accessing, owning, or distributing digital content relating to "coffee" is a criminal offense.

Josh claims to have witnessed a work colleague (Bob) viewing coffee content on a work computer. The allegation was escalated to management, who subsequently escalated the allegation to law enforcement. Following the approval of formal warrants, Bob's computer was seized by law enforcement and transported to the Cyber Crime Centre (CCC).

The computer's hard disk was acquired using AccessData FTK Imager. Unfortunately, the junior investigator who acquired the computer's hard disk only performed a logical acquisition. The CCC is currently in lockdown due to COVID-19, so all employees are completing investigations remotely and thus at this stage, a subsequent full-disk acquisition cannot be undertaken. Given the time-critical nature of the case, an investigation will need to be undertaken on the acquired data, that is currently available. The following list of facts have been produced for this investigation.

• The suspect, Bob, denies accessing "coffee" content on the computer.
• Bob is technically skilled and alleges he has been setup. Bob claims that malware and RDP access to his computer may have resulted in the presence of content.
• Bob confirmed that the computer does belong to him.
• Bob confirmed that he did not use a password onto his computer.
• Bob confirmed that he does not take the computer home.
• Bob backs up his Apple iPhone to the work computer via iTunes.

In addition to initial allegation, prior accumulated intelligence reports suggest that Bob may have been working with an insider - who works for law enforcement. A USB stick may have been physically handed to Bob. The USB stick contained a classified document on COVID-19 and a confidential video of a Bugs Bunny cartoon. As part of the investigation, it is critical to determine if the USB drive was ever connected to Bob's computer and were either of the files copied and subsequently shared with others.

You are a newly hired consultant who specialises in digital forensic investigations. As your very first investigation, you have been assigned the task of examining a forensic image of the computer that was seized. It is currently not known what Bob was doing with the coffee content. Your task is to forensically investigate the supplied forensic image using appropriate tools and processes and develop a formal forensic report encompassing the evidence and methodology used. You may use any tools to undertake the investigation, but you must formally justify and document all of your actions. The recommended report structure is as follows:
• Evidence/content - 30%
• Running sheet - 60%
• Timeline of events 10%.

As a result, the running sheet is the most important component of your report. You may or may not find all evidence and items of interests in the supplied forensic image. Thus, you should focus on carefully documenting end explaining the methods you used to locate evidence and analyse their value within this investigation.

General Idea

• Cover page - unit code and title, assignment title, student name, number, campus and tutor.
• Table of contents - An accurate reflection of the content within the report, generated automatically in Microsoft Word
• Summary - A succinct overview of the report. What were you looking for? How did you approach the investigation? What did you do? What did you find? What is the outcome of the investigation? Use numbers and/or statistics to support or extend the extent of any crimes that have been committed. Keep the summary to a maximum of 1 page.
• Issue #1: Presentation of content relating to offence - A detailed representation of all content identified, extracted and analysed in the investigation. All evidence must be characterised, explained and examined. What metadata exists? What is the value of the evidence to the investigation? What does each piece of evidence mean? Does the evidence support or negate the allegations made? Consider how you will present the evidence. Do not make the mistake of making issue #1 the majority of your report.
• Issue #2: Identification - Detail all information relating to possible use/ownership of the evidence identified and extracted. How can you link the evidence to a particular owner? Is there any digital evidence that demonstrates ownership of the device or content?
• Issue #3: Intent - Was the digital content purposefully accessed/used/downloaded/installed? Was it accidental? Was it a third party? Was it malicious software? Present all evidence to support your theory.
• Issue #4: Quantity of files - How many files of every type were present on the system? What percentage of these files relate to the offence? What does this mean for the overall investigation?
• Issue #5: Installed Software - What applications are installed that relate to the investigation? What purpose do these applications serve? Have they been used/run? What are the dates/times the application was last used? What impact do these applications have on the investigation?
• Issue #6, 7, etc. - Any other evidentiary sections that do not full under the other issue headings.
• Appendix A: Running sheet - A comprehensive running sheet (recipe) of your actions in investigating the case study. The running sheet should be presented in table form. What did you? How did you do it? What was the outcome of your action? The running sheet should be more detailed than a ‘recipe' and allow someone to replicate your process and achieve the exact same outcome.
• Appendix B: Timeline of events - A comprehensive and chronological order of events representing the actions that resulted in the illegal activity taking place, and the events thereafter. Be creative in how you present this data. Consider what is important to include and what serves no purpose.

Attachment:- Case Study.rar