BN309 Computer Forensics

Assignment Detail:

Objective: The objective of the assignment is using/comparing Computer Forensics Tools for a given case. The assignment require you to acquire data from a USB drive, perform data recovery using different techniques and tools, analyzing it and finally performing the validation of acquired data. In addition, students are required to document all steps in a report, and the report should be formal so that it can be used in a legal proceeding. Marks will be awarded based on the sophistication and in-depth presentation of the techniques explored.

Case Study: Working as a forensic analyst, you have been assigned a case of embezzlement. A 32GB storage drive (for example a USB) is found from the suspect’s office, the USB may have data with digital clues that may be related to the case. The USB contains different types of files for example Doc files, Excel files, a couple of image files, and some text files.

Assignment Specification:

Prepare a report on the following sections related to the case study. The assignment consists of two parts.

In Part A, you will install and compare two Computer Forensics Tools required to complete this report.

Data Preparation:

1. You need to use your own USB to create/delete files as mentioned in the scenario below and perform the digital forensics investigation: 1. You need to create six files of type pdf, excel and word documents, where you need to name these files as follows: YourMITID_BN309_Assignment01.*, where * depends on the file type. In addition, you need to change the attribute of these files to describe the Metadata which holds data such as your name as an author, organization name “MIT”, computer name “based on your terminal name”, date/time created, and comments such as “created for Assignment1 of BN309”
2. Modify the extension of one of the doc files to .jpeg.
3. Then you need to delete 3 files including the file you have modified its extension, one of each type. Take the screenshot of each step and include these in your final report. Provide the list of references using IEEE referencing style at the end of the report.

In Part B, you will use the feedback from Part A to extend your report further to address the following requirements:

Section 1: Data Acquisition

Prepare a forensic image (bit stream copy) using any two standard tools from Table 1 with the record of data deletion. In the report, you need to include the screenshots of each step. You will need this image to perform consecutive tasks. You need to cover the challenges to and make a successful acquisition what are the relevant format to use and why. Describe steps required for search and seizure. (400 words)

Section 2: Data Recovery

The suspect has deleted three image files from the USB, recover these files and explain the method (with screenshots) and tool you used. (300 words) In addition, recover the data from recycle bin, explain the procedure with screenshots. You need to recover the metadata of these files. (200 words)

Section 3: Data Analysis

Inspect all files in the USB, use a hex editor and analyze if there is any hidden data in these files. Provide screenshots of your analysis. Describe the tools that can be used for analyzing the deleted files, and also describe the benefit(s) for conducting a window registry analysis. (300 words)

Section 4: Data Validation

Explain different methods of data validation and use one of them to validate data on USB. Explain how to verify the file extension if it has been altered using relevant tools. Demonstrate with snapshots the data validation as well as detecting the file extension alteration. (400 words)

Marking Guide

This assessment requires you to write a report which includes Part A and Part B. You will perform the following tasks.

1. In part A, you will write a report on, i.
2. Compare and analyze two Computer Forensics Tools (from Table 1) used in forensic case investigations (the report should discuss similarities and differences with screenshots from the installed tools features and references).
3. Discuss what you should consider when determining which data acquisition method to use.

                         iii.  Provide the suitability of computer forensics tools for the given case.

2. In Part B: you will extend the report from Part A to include more details using the feedback received. You will also perform 4 demonstration tasks along with data preparation and evidence of your work. Your final report should include:
3. Data preparation
4. Section I: Data Acquisition

iii. Section II: Data recovery

1. Section III: Data Analysis
2. Section IV: Data Validation