Reference no: EM132841349

Networked Forensic Investigation - Leeds Beckett University

Learning Outcome 1: Develop a critical understanding of the variety of evidence available from networked digital devices

Learning Outcome 2: Perform detailed analysis of a variety of networked digital devices using appropriate forensic tools and techniques.

Learning Outcome 3: Develop a critical understanding of the ways of retaining evidence continuity and the correct methods for collecting networked forensic evidence.

Scenario

As part of Operation BUMBLEBEE, surveillance is being carried out at a warehouse in Churchill Lane Industrial Estate, from which an organised crime operation is suspected to be being co-ordinated; the criminal activities include drug and people trafficking operation.

Following additional intelligence investigation two mobile phones were recovered by covert officers and CDR records requested from the network operators.

The information was recovered and is now submitted for immediate investigation as follows:
• PBZ1-Extraction from recovered mobile phone 1
• PBZ2-Extraction from recovered mobile phone 2
• PBZ3-CDR-IN
• PBZ4-CDR-Out
• PBZ5-UK Location Data

You are tasked with the analysis of all of the data provided to attempt to give the investigators information along with the following:
• A clear time-frame
• The time, type and content of communication
• Location of the device(s) in your time frame
• Places of interest
• Identification of the perpetrator(s)
• Identification of victim(s)

Remit of the investigation
Dates and times are vital for this investigation, much of the evidence contains lots of information (covering a wide timeframe), students must therefore decide on a period in which to focus the analysis.
Once the date and time of interest are identified and reviewed, the selected data should be visualised in the identified period. Students are attempting to show links between the data and the people, as a minimum - answers to the following list is a minimum:
• The time, type and content of communication
• Location of the device(s) in your time frame
• Places of interest
• Identification of the perpetrator(s)
• Identification of victim(s)

Recorded Presentation Overview
As part of your presentation you will need to cover, as a minimum (time estimates are provided as guidance):
• Introduction covering what the "customer" has asked to be done (1 minute)
• Your findings including the visualised data - presented as if to the customer (8 minutes)
• Conclusions (1min)
• 2 minutes for Q&A from your tutors (will be arranged on W/C 8th March)

Attachment:- Networked Forensic Investigation.rar