digital forensics investigation using ftk must use lab
Forensics Procedures or Methodology
1. Establish Chain of custody
2. Verify hash value of the image
3. Identify Drive information
4. Examine NT user Data (Tom or/and Leslie)
5. Search through the folders for each user
6. Examine Cookies/ Desktop/Recent Folders
7. Search Email ( Internet/email search)
8. Examine History/ Web cache Files
9. Keyword search List
10. Bookmark all the evidence findings ( highly recommend bookmark your
findings based on the checklist information below – create one folder for each
grading option(s) )
11. Draft a Computer Examiners Report of your findings using the following report
writing format or the Report Format provided by your Professor:
Write a Digital Forensics Report:
Your report should consist of the following items or use the Report
Format provided by your Professor :
Computer Forensics Examiner Report
1. Introduction (Explain how you got the case & what you were requested to examine) 1
st paragraph
2. Examination Summary (Give an Overview explanation of what you found in
relationship to the case investigation. Use at least two-three paragraphs for each
disk that you examined e.g. Leslie Disk: On the Leslie Disk I discovered several
files relating to plans that Leslie was making with Tom to ….; Tom Disk: On the
Tom Disk I discovered files relating to concerns that Tom had regarding his….. )
3. File Details (Highlight the top 5-7) important files you discovered and analyzed in
this case e.g. in un-allocated space, deleted files, photos, etc.
a. List each important file by name using a * bullet point and give a brief caption
description of what the file represents
Example:
* proposal.pdf
This file contains a business proposal marked for dynamic solutions marked
“confidential”
b. List each graphic file by thumbnail and name using a * bullet point and give a
brief caption description of what the graphic file represents
network6s.jpg
This photo contains a photograph of the internal network connection for
lab ST-109
4. Steps Taken (List and Explain how examination was conducted)
i.e. A forensic image of the hard disk was made using Encase or WinHex.
An MD 5 hash was generated.
Describe step by step procedure taken during the examination
5. Exhibits (List Exhibits by File Type e.g. Documents, Images, Excel, etc.)
Example:
Exhibit 1 contains recovered text file documents obtained from the hard disk
Exhibit 2 contains recovered images files obtained from the hard disk.
6. Chain of Custody (Document where & how media was obtained, processed and
stored)
Example:
The Seagate hard disk No. AW37Z81 was received by Fed Ex Shipping No.
1234569 and stored in the locked evidence bin/drawer #1.
A forensic image of the original hard disk forensic was made and the original was
returned to evidence bin/drawer #1.
An examination was conducted on the forensic hard disk image copies.
The original Seagate hard disk No. AW37Z81 was returned to the Sunshine
Company by FED Ex Shipping No. WBX90172 after completion of the
examination.
EXAMINATION CHECKLIST
Things you can find on the evidence drives:
1. Information showing Tom’s excitement at the proposal of getting promoted
2. Information showing Tom’s concerns
3. Information showing Tom’s meeting with Mr. Melonis of
Saspah Software
4. Leslie browsing the Internet for vocation deals
5. Information about how Tom and Leslie felt that the company owes them.
6. Leslie searching for embezzlement schemes on the Internet
7. Leslie creating a second set of “Books” (the Excel sheet)
8. Leslie emailing Tom links she found on the Internet
9. Leslie computer accessed file that were never on her computer
From a USB drive (optional)
10. Information showing how discussions about they might use the accounts
11. Information showing Tom and Leslie’s romance
12. Report should include your name, course number, date, your formatted examining
of findings.
Note: Your report should represent a polished work product you would be proud of using in
your portfolio for purposes of securing an entry level job or promotion.
Do you need a similar assignment done for you from scratch? We have qualified writers to help you. We assure you an A+ quality paper that is free from plagiarism. Order now for an Amazing Discount!
Use Discount Code "Newclient" for a 15% Discount!
NB: We do not resell papers. Upon ordering, we do an original paper exclusively for you.
