Reference no: EM134008577

Digital Forensics

Tutorial 1

Read the enclosed case study (Case Study: famous cases digital forensics) below and answer the following questions. This tutorial also relates to concepts covered in Computer Science and Software Engineering.

Question 1. Discuss your options for acquiring the image

Question 2. What questions should you ask and how should you proceed?

Question 3. Explain three common types of digital crime

Question 4. Discuss the acquisition method that can be used.

Question 5. Discuss the options that can be used to recover the file.

Tutorial 2

Case 1
At murder scene, you have started making an image of computer's drive. You're in the back bedroom of the house, and a small fire has started in the kitchen. If the fire can't be extinguished, you have only a few minutes to acquire data from a 10GB hard disk. Write one paragraph outlining your options for preserving the data.

Case 2
You need to acquire an image of a disk on a computer that can't be removed from the scene, and you discover that it's a Linux computer. What are your options for acquiring the image? Write 2-3 paragraphs specifying the hardware and software you would use. Knowledge of Linux and Operating System concepts may support this task.

Case 3
You're investing a case involving a 2 GB drive that you need to copy at the scene. Write one to two paragraphs designing three options you have to copy the drive accurately. Be sure to include your software and media choices.

Tutorial 3

Read the enclosed case study (Case Study: Email Infidelity in a Computer Forensics Investigation) below and answer the following questions:

1. Discuss your options for acquiring the image

2. What questions should you ask and how should you proceed?

3. Explain three common types of digital crime

4. Discuss the acquisition method that can be used.

5. Discuss the options that can be used to recover the file.

Tutorial 4

Case 1
A new start-up SME (small-medium enterprise) based in Luton with an E-government model has recently begun to notice anomalies in its accounting and product records. It has undertaken an initial check of system log files, and there are a number of suspicious entries and IP addresses with a large amount of data being sent outside the company firewall. They have also recently received a number of customer complaints saying that there is often a strange message displayed during order processing, and they are often re-directed to a payment page that does not look legitimate.

The company makes use of a general purpose eBusiness package (OSCommerce) and has a small team of six IT support professionals, but they do not feel that they have the expertise to carry out a full scale malware/forensic investigation.

As there is increased competition in the hi-tech domain, the company is anxious to ensure that their systems are not being compromised, and they have employed a digital forensic investigator to determine whether any malicious activity has taken place, and to ensure that there is no malware within their systems.

Your task is to investigate the team's suspicions and to suggest to the team how they may be able to disinfect any machines affected with malware, and to ensure that no other machines in their premises or across the network have been infected. The team also wants you to carry out a digital forensics investigation to see whether you can trace the cause of the problems, and if necessary, to prepare a case against the perpetrators. Topics associated with Data Communication And Networking and Data Mining are relevant for this investigation process.

The company uses Windows Server NT for its servers. Patches are applied by the IT support team on a monthly basis, but the team has noticed that a number of machines do not seem to have been patched.

Discuss how you would approach the following:

• Malware investigation
• Digital Forensic Investigation

Write a general overview of the methodology that you will use and provide a reasoned argument as to why the particular methodology chosen is relevant.

Write a process that you will use to collect evidence and discuss the relevant guidelines that need to be followed when collecting digital evidence

Case 2
You're investigating a case involving an employee who's allegedly send inappropriate photos via email in attachments that have been compressed with a zip utility. As you examine the employee's hard disk, you find a file named Orkty.zip, which you suspect is a graphics files. When you try to open the file in an image viewer, a message is displayed indicating that the file is corrupt. Write one pages explaining how to recover Orkty.zip for further investigation.

Case 3
You work for a mid-size corporation known for its inventions that does a lot of copyright and patent work. You're investigating an employee suspected of selling and distributing animations created for your corporation. During your investigation of the suspect's drive, you find some files with the unfamiliar extension .xde. The network administrator mentions that other .xde files have been sent through an FTP server to another site. Write one page describing your findings after conducting an Internet search for this file extension.

Tutorial 5

Read the enclosed case studies below and answer the questions in each case:

Case 1
As a part of the duties of a digital forensics examiner, creating an investigation plan is a standard practice. Write one to two pages describing how you would organize an investigation into a potential fraud case. In addition, list methods you plan to use to validate the date collected from drives and files, such as Word and Excel, with hashes. Specify the hash algorithm you plan to use, such as MD5 or SHA1.

Case 2
Several graphics files were transmitted via email from an unknown source to a suspect in an ongoing investigation. The lead investigator gives you these graphics files and tells you that at least four messages should be embedded in them. Use your problem-solving and brainstorming skills to determine a procedure to follow. Write a short report outlining what to do.

Case 3
A drive you are investigating contains several password-protected files and other files with headers that don't match the extension. Write a report describing the procedures for retrieving the evidence with some of the forensics tools and hexadecimal editors discussed in chapter 8 and 9. Explain how to identify the files header and determine how their extensions are mismatched. Then discussed what techniques and tools you can use for recovering password from the protected files.