Reference no: EM132373515
Assessment - Tasks and Forensics Report
Task 1: Recovering scrambled bits
For this task I will upload a text file with scrambled bits on the suject interact2 site closer to the assignment due date. You will be required to restore the scrambled bits to their original order and copy the plain text in your assignment.
Deliverable: Describe the process used in restoring the scrambled bits and insert plain text in the assignment.
Task 2: Digital Forensics Report
In this major task you are assumed a digital forensics investigator and asked to prepare a digital forensic report for the following scenario:
You are investigating a real-world situation, an Enron scandal. Research Kenneth Lay's role in the Enron case and then examine his emails.
Student needs to obtain the archived file for this case around 18.0 GB with a minimal registration or can make a copy from your lecturer. For further hints and the best software or utilities to accelerate the information searching should refer to Hands-on 11-1 and 11-2 on p.p 488-490, Nelson, Phillips, & Steuart, 6/e, 2019.
Your task is to search all possible data that might relate to Enron founder, Kenneth Lay, recover and present any digital evidence in the report.
Rationale
back to top
This assessment task will assess the following learning outcome/s:
be able to determine and explain the legal and ethical considerations for investigating and prosecuting digital crimes.
be able to formulate a digital forensics process.
be able to evaluate the technology in digital forensics to detect, prevent and recover from digital crimes.
be able to analyse data on storage media and various file systems.
be able to collect electronic evidence without compromising the original data.
be able to critique and compose technical tactics in digital crimes and assess the steps involved in a digital forensics investigation.
be able to prepare and defend reports on the results of an investigation.
Task 2: Forensics report
Background, scope of engagement, tools and findings
All elements are present, well expressed, comprehensive and accurate.
All elements are present and largely accurate and well expressed.
All elements are present with few inaccuracies.
Most elements are present possibly with some inaccuracies.
Fails to satisfy minimum requirements of introduction.
Analysis: relevant programs, techniques, graphics
Description of analysis is clear and appropriate programs and techniques are selected. Very good graphic image analysis.
Description of analysis is clear and mostly appropriate programs and techniques are selected. Good graphic image analysis.
Description of analysis is clear and mostly appropriate programs and techniques are selected.
Reasonable graphic image analysis.
Description of analysis is not completely relevant. Little or no graphics image analysis provided.
Fails to satisfy minimum requirements of analysis.
Findings:
specific files/images, type of searches, type of evidence, indicators of ownership
A greater detail of findings is provided. Keywords and string searches are listed very clearly. Evidence found is very convincing. Indication of ownership is very clear.
Findings are provided, keywords and string searchers are listed. Evidence is sound. Ownership is clear.
Findings are provided, some keywords are listed. Evidence is reasonable which relates to the ownership.
Findings are provided but are somewhat vague. Keywords
and strings are not very clear. Evidence found may be questionable.
Fails to satisfy minimum requirements providing findings.
Conclusion:
Summary, Results
High level summary of results is provided which is consistent with the report.
Well summarised results and mostly consistent with the findings.
Good summary of results.
Able to relate the results with findings. No new material is included.
Satisfies the minimum requirements. Results are not really consistent with the findings.
Fails to satisfy minimum requirements of summarising the results.
References:
Must cite references to all material used as sources for the content
APA 6th edition referencing applied to a range of relevant resources. No referencing errors. Direct quotes used sparingly. Sources all documented.
Presentation
The following should be included as minimum requirements in the report structure:
Executive Summary or Abstract
This section provides a brief overview of the case, your involvement as an examiner, authorisation, major findings and conclusion
• Table of Contents
• Introduction
Background, scope of engagement, forensics tools used and summary of findings
• Analysis Conducted
o Description of relevant programs on the examined items
o Techniques used to hide or mask data, such as encryption, steganography, hidden attributes, hidden partitions etc
o Graphic image analysis
• Findings
This section should describe in greater detail the results of the examinations and may include:
o Specific files related to the request
o Other files, including any deleted files that support the findings
o String searches, keyword searches, and text string searches
o Internet-related evidence, such as Web site traffic analysis, chat logs, cache files, e-mail, and news group activity
o Indicators of ownership, which could include program registration data.
• Conclusion
Summary of the report and results obtained
• References
You must cite references to all material you have used as sources for the content of your work
• Glossary
A glossary should assist the reader in understanding any technical terms used in the report. Use a generally accepted source for the definition of the terms and include appropriate references.
• Appendices
You can attach any supporting material such as printouts of particular items of evidence, digital copies of evidence, and chain of custody documentation.