Reference no: EM133141428

CO4514 Digital Forensic Technology - University of Central Lancashire

Evidence Chain of Custody Tracking

Assignment - Perform a forensic investigation into digital evidence.

Audience: Non-technical client/investigation commissioner

You are provided with an evidence file available on Blackboard.

Perform and report on individual parts of a digital forensic investigation.

• Check that the disk acquisition has been performed correctly
• Maintain investigative documentation
• Use forensic tools to analyse and interpret digital data.
• Create an expert report containing the findings from your investigation
• Keep contemporaneous notes

This is a simulated investigation and doesn't include the analysis of lots of irrelevant data. The evidence that is provided is small and doesn't include any tricks. You will however need to interpret the data/evidence and draw your own conclusions based on the evidence you find.

You will create an expert report to communicate your findings. See the scenario below for further information about your investigation. You will keep notes of your investigative actions contemporaneously; they should be as long as is necessary but should reflect your investigation process accurately.

Assignment Scenario
You are a forensic investigator working for the UCLAN High Tech Crime Unit. You have been contacted by the Managing Director of the company ‘Vamos Solutions'. One of their employees has been accused of stealing company secrets.

The employee has attempted to smuggle company secrets out of the work building by copying company secrets onto a USB data storage device. While leaving the building the employee was detained by on-site security and the USB storage device was discovered. This USB storage device has been processed by a forensic imaging technician and the forensic image has been obtained.

You have been provided with a forensic image of the USB data storage device. This is called exhibit CST/001. This is available for download via Blackboard and is available under CO4514->assignments->co4514ass2year3.e01. This is anevidence file that contains the USB image file and must be viewed in forensic software such as Autopsy.

You have been asked to answer the following questions.

Question 1 - Is there any evidence to suggest that the company secrets have been copied onto the USB pen?

Question 2 - Is there any evidence to suggest that the suspect has tried to hide any data?

Question 3 - Any evidence to suggest the reason why the suspect has attempted to steal this data?

Question 4 - What further evidence may be needed by the investigation team to support any of the facts discovered during your investigation?

Note: question 4 is not about the evidence that you will find during your investigation; it is about identifying what further evidence could possibly be found if you had access to other evidence sources (for example, the suspect's office computer).

Attachment:- Digital Forensic Technology.rar