Prepare reports for target audience that justifies findings

Reference no: EM132369855

Assessment: Case Investigation Report

This document supplies detailed information on assessment tasks for this unit.

Learning Outcomes
This assessment assesses the following Unit Learning Outcomes (ULO) and related Graduate Learning Outcomes (GLO):

Unit Learning Outcome (ULO)
ULO 1: Apply knowledge of security on Windows network domain and follow standard procedure to investigate different types of cyber-crime
ULO 3: Analyse forensic data and review findings to further probe and investigate serious computer crimes; and
ULO 4: Reflect on findings and prepare reports for target audience that justifies findings.

Purpose
This assessment requires students to apply knowledge of security on the Windows network domain and follow the standard procedure to investigate different types of cyber-crime

Instructions
This is an individual assessment task. You are required to submit a case investigation report supporting your findings and a bibliography. You will be acting the role of the investigator Arif and report the findings.

This report should consist of:
• an overview of the computer crime case
• a list of necessary resources for forensic investigation
• an analysis of detailed findings
• a review and reflection on the findings

Problem Statement

Arif works for a university as an IT administrator. He received a call on Sept 8, 2009 from a staff member Amy who complained that a suspicious account has been created on her personal laptop without her consent. The general IT policy of the university disallows Arif to acquire any research-related files from Amy's laptop because she is participating in a top-secret government project. Therefore, Arif asked Amy to export the Windows Registry and copy a few Windows log files of her laptop from the directory:

C:\Windows\system32\config

Task 1 (Scanning the machine)
To ensure that Arif's machine is free of rootkit programs which may alter the investigation results, he decides to run a thorough scan on his investigation machine to ensure that there is no rootkit program. Choose at least two scanning programs and provide the screenshots of the scanning results.

Task 2 (Repairing Windows Logs)

Having ensured the safety of his forensic investigation platform, Arif decompresses the file "Desktop.zip" and finds 4 Windows event log files. Describe the information stored in each log file and repair those important log files so that they can be viewed in Windows EventViewer.

Task 3 (Which account is created)

Having repaired the log files, Arif examines one of them in order to identify which account was created without Amy's consents. Which log file and which EventID number should Atif search? Provide a screenshot for the account-creation event.

Task 4 (Where is Amy's password)

Having identified the event that a new user was created on Amy's laptop, Arif telephones Amy and asks whether she can provide more clues. Amy tells that she has a personal password safe as an encrypted ZIP file hidden on the university network. But Amy is confident that only she can access her account details because this password safe has multiple security protection mechanisms. However, Arif wants to demonstrate that Amy's belief may be too optimistic. Provide screenshots and describe how Arif can easily access Amy's account information.

Task 5 (Amy's password)

Arif has extracted Amy's password safe, but he wants to demonstrate to Amy that her Windows password can be easily cracked. So he calls Amy and Amy bets that he cannot get her password. Being challenged and authorized, Arif decides to crack Amy's Windows password used on her laptop. Work out what the username and the password are on Amy's laptop.

Task 6 (When did things go wrong?)

Amy now realizes that Windows provides a very weak protection and she becomes concerned about the safety of her research data. Arif decides to look through the log files again in order to identify when the bogus account logged on to Amy's laptop. Use two screenshots to indicate when the bogus account was logged on and logged off.

Task 7 (I know what you did)

Arif believes that he can find all important activities on Amy's system during the session time identified in Task 6. Which event recorded in the system log file will tell Arif about the actions performed by the bogus account?

When did this event terminate?

Task 8 (Using LogParser)

Arif recalls that some events with EnventID 11728 are closely related to the installation of Windows programs. He decides to use the program LogParser to search for the events with EventID 11728 in the log files. List all the events Arif will find by using LogParser (screenshots are required).

Task 9 (The valuable Registry)

Arif feels that things might be very serious, so he decides to go through the Registry file "Server.reg" in the "Desktop.zip" file. What program(s) will Arif classify as suspicious? Provide strong reasons.

Task 10 (Before calling the police)

Arif and Amy feel that they must report to the police about their findings. Before they write a formal complaint to the forensic team, Arif recalls that he has intercepted an NTLM authentication session of user "helpdesk" and the hash is:

3520EFAAD3850A27AAD3B435B51404EE:13C1E98BECA440FADC09F3D24670EA72

Arif guesses that the password is 3 characters long but contains special symbols. Now, crack this password by using your own rainbow tables (screenshots are required).

Reference no: EM132369855

Questions Cloud

Discussed importance of stakeholder engagement in policy : discussed the importance of stakeholder engagement in policy making. The author presented several benefits and an analysis of five cases in which stakeholder

Advise both nosa and betty as to the tax consequences : Advise Bob of the potential tax implications in relation to the $700,000 sale proceeds. Where appropriate, calculations must be made.

Shadow IT for Business Operations : Organizations do not always provide information systems that allow their staff to perform their responsibilities efficiently and effectively.

Describe the public health problem using given information : The literature review process can be an inexact science and tedious process because of the extensive scope of public health material, studies, and research.

Prepare reports for target audience that justifies findings : Analyse forensic data and review findings to further probe and investigate serious computer crimes and Reflect on findings and prepare reports

Cyber attacks on critical infrastructures : After writing your literature review ("Cyber attacks on Critical Infrastructures") you are required to write a "Problem Statement". T

Should developing countries pursue use of biotechnologies : What are some potential consequences and benefits to using biotechnologies in developing countries? Based on the research currently available.

United States Supreme Court Carpenter v. United States 2018 : Please run a Google search of the term, "United States Supreme Court Carpenter v. United States 2018."

Agile methodology-process methodology life cycle : Create a Unified Modeling Language (UML) activity diagram that illustrates the process methodology life cycle.

User Account

All Pages