Reference no: EM132382954 , Length: word count:2000

ITC597 - Digital Forensics Assignment - Charles Sturt University, Australia

Abstract - This subject provides an in-depth study of the rapidly changing and fascinating field of computer forensics. It combines both the technical expertise and the knowledge required to investigate, detect and prevent digital crimes. The subject covers the knowledge on digital forensics legislations, digital crime, forensics processes and procedures, data acquisition and validation, e-discovery tools, e-evidence collection and preservation, investigating operating systems and file systems, network forensics, art of steganography and mobile device forensics, email and web forensics, presenting reports and testimony as an expert witness.

Learning outcomes - Upon successful completion of this subject, students should:

• be able to determine and explain the legal and ethical considerations for investigating and prosecuting digital crimes;
• be able to formulate a digital forensics process;
• be able to evaluate the technology in digital forensics to detect, prevent and recover from digital crimes;
• be able to analyse data on storage media and various file systems;
• be able to collect electronic evidence without compromising the original data;
• be able to evaluate the functions and features of digital forensics equipment, the environment and the tools for a digital forensics lab;
• be able to critique and compose technical tactics in digital crimes and assess the steps involved in a digital forensics investigation;
• be able to prepare and defend reports on the results of an investigation.

Assessment 1 - Tasks and Research Project

Task -

Task 1: Investigating Hashing software and the basic usage

In this task, you need to find three hashing identify software or utilities regardless MS Windows and/or Linux platforms these tools can run on and provide three quick samples or procedures or steps that to show how to use this three software or utilities to identify a hash string. Three (3) marks for each software or utility named and a sample of how to identify a hash string. You can use MD5, SHA varieties or a hash string at your choice.

Deliverable: Three software or utility named and provided details of how to identify a hash string from each of software or utilities. Provide figure number and a short description for each snapshot. All three software or utilities need at least a reliable reference for each.

Task 2: Case Project

Complete the Hands-on Project 9-4. (Nelson, Phillips, & Steuart, 6th edition, 2019, p. 411) Deliverable: Write a 300-500 words paper explaining the importance of hash values used in the files you examined. Provide screenshots of the steps completed in the project.

Task 3: Research Project

You're investigating a case involving a 2 GB drive that you need to copy at the scene. Describe the three types of acquisitions - physical, logical, and sparse that you can use to copy the drive accurately. Be sure to include your software and media choices.

Deliverable: Write a 300-500 word report that outlines standard investigation management and data validation methods.

Note: Combine deliverables of all three tasks mentioned above in a single document (only MS Word (preferable) or pdf, please note other formats e.g. *.zip, *.rar etc are NOT allowed).

Assessment 2 - Tasks and Forensics Report

Task -

Task 1: Recovering scrambled bits

For this task I will upload a text file with scrambled bits on the suject interact2 site closer to the assignment due date. You will be required to restore the scrambled bits to their original order and copy the plain text in your assignment.

Deliverable: Describe the process used in restoring the scrambled bits and insert plain text in the assignment.

Task 2: Digital Forensics Report

In this major task you are assumed a digital forensics investigator and asked to prepare a digital forensic report for the following scenario: You are investigating a real-world situation, an Enron scandal. Research Kenneth Lay's role in the Enron case and then examine his emails.

Student needs to obtain the archived file for this case around 18.0 GB and with a minimal registration or can make a copy from your lecturer. For further hints and the best software or utilities to accelerate the information searching should refer to Hands-on 11-1 and 11-2 on p.p 488-490, Nelson, Phillips, & Steuart, 6/e, 2019.

Your task is to search all possible data that might relate to Enron founder, Kenneth Lay, recover and present any digital evidence in the report.

Deliverable: For this forensic examination, you need to provide a report of 1800-2000 words in the format described in presentation section below.

Presentation - The following should be included as minimum requirements in the report structure:

Executive Summary or Abstract

This section provides a brief overview of the case, your involvement as an examiner, authorisation, major findings and conclusion

Table of Contents

Introduction

Background, scope of engagement, forensics tools used and summary of findings

Analysis Conducted

• Description of relevant programs on the examined items
• Techniques used to hide or mask data, such as encryption, steganography, hidden attributes, hidden partitions etc
• Graphic image analysis

Findings

This section should describe in greater detail the results of the examinations and may include:

• Specific files related to the request
• Other files, including any deleted files that support the findings
• String searches, keyword searches, and text string searches
• Internet-related evidence, such as Web site traffic analysis, chat logs, cache files, e-mail, and news group activity
• Indicators of ownership, which could include program registration data.

Conclusion

Summary of the report and results obtained

References

You must cite references to all material you have used as sources for the content of your work

Glossary

A glossary should assist the reader in understanding any technical terms used in the report.

Use a generally accepted source for the definition of the terms and include appropriate references.

Appendices

You can attach any supporting material such as printouts of particular items of evidence, digital copies of evidence, and chain of custody documentation.

Note - Need only 2000 words Assessment 2 - Task 2: Digital Forensics Report.

Attachment:- Digital Forensics Assignment File.rar