Reference no: EM132420750

BN309 - Computer Forensics - Melbourne Institute of Technology

Assignment - Validating and Testing Computer Forensics Tools and Evidence - Part 1

Purpose of the assessment - This assignment assesses the following Unit Learning Outcomes; students should be able to demonstrate their achievements in them.
a. Systematically collect evidence at private-sector incident scenes.
b. Document evidence and report on computer forensics findings.
c. Implement a number of methodologies for validating and testing computer forensics tools and evidence.

Assignment Questions:

Objective: The objective of the assignment is to acquire data from a drive, perform data recovery using different techniques and tools, analysing it and finally performing the validation of acquired data. In addition, students are required to properly document all steps in a report, the report should be formal so that it can be used in a legal process. Marks will be awarded based on the sophistication and the difficulties of the techniques explored.

Case Study: You have been assigned a case of embezzlement. A USB is found from the suspect's office, and it is expected to have very important information related to the case. The USB contains several Excel files, a couple of image files and some text files.

Assignment Specification:

Prepare a report on the following sections related to the case study scenario.

Data Preparation: You need to use your own USB to create/delete files as mentioned in the scenario below and perform the digital forensics investigation:

Question 1. You need to create six files of type pdf, excel and word documents, where you need to name these files as follow: yourname-BN309-Assig1, where * depends of the file type. In addition, you need to change the attribute of these files to describe the Metadata which holds data such as your name as an author, organization name "MIT", computer name "based on your terminal name", date/time created, and comments such as "created for Assignmentl of BN309".

Question 2. Modify the extension of one of the doc file to .jpeg

Question 3. Then you need to delete 3 files including the file you have modified its extension, one of each type. Provide the list of references using IEEE referencing style at the end of the report.

Section 1: Data Acquisition
Prepare a forensic image (bit stream copy) with the record of data deletion. Explain the method and tool you used for acquiring data. You will need this image to perform the consecutive tasks. Please submit this image with your assignment. You need to cover the challenges to make a successful acquisition, and what are the relevant format to use and why. Describe steps required for search and seizure. (400 words)

Section 2: Data Recovery
The suspect has deleted three image files from the USB, recover these files and explain the method (with screenshots) and tool you used. (300 words)
In addition, recover the data from recycle bin, explain the procedure with screenshots. You need to recover the metadata of these files (200 words)

Section 3: Data Analysis
Inspect all files in the USB, use a hex editor and analyse if there is any hidden data in these files. Provide screenshots of your analysis. Describe the tools that can be used for analysing the deleted files, and also describe the benefit(s) for conducting a window registry analysis (300 words)

Section 4: Data Validation
Explain different methods of data validation and use one of them to validate data on USB. Explain how to verify the file extension if it has been altered using relevant tools. Demonstrate with snapshots the data validation as well as detecting the file extension alteration. (400 words)