Glossary A glossary should assist the reader in understanding any technical terms used in the report. Use a generally accepted source for the definition of the terms and include appropriate references. • Appendices You can attach any supporting material such as printouts of particular items of evidence, digital copies of evidence, and chain of custody documentation. Follow the referencing guidelines for APA 6 as specified in Referencing Guides.

Findings This section should describe in greater detail the results of the examinations and may include: o Specific files related to the request o Other files, including any deleted files that support the findings o String searches, keyword searches, and text string searches o Internet-related evidence, such as Web site traffic analysis, chat logs, cache files, e-mail, and news group activity o Indicators of ownership, which could include program registration data. • Conclusion Summary of the report and results obtained • References You must cite references to all material you have used as sources for the content of your work

The following should be included as minimum requirements in the report structure: Executive Summary or Abstract This section provides a brief overview of the case, your involvement as an examiner, authorisation, major findings and conclusion • Table of Contents • Introduction Background, scope of engagement, forensics tools used and summary of findings • Analysis Conducted o Description of relevant programs on the examined items o Techniques used to hide or mask data, such as encryption, steganography, hidden attributes, hidden partitions etc o Graphic image analysis

Findings: specific files/images, type of searches, type of evidence, indicators of ownership (5 marks) A greater detail of findings is provided. Keywords and string searches are listed very clearly. Evidence found is very convincing. Indication of ownership is very clear.Conclusion: Summary, Results (3 marks) High level summary of results is provided which is consistent with the report. References: Must cite references to all material used as sources for the content (2 marks) APA 6th edition referencing applied to a range of relevant resources. No referencing errors. Direct quotes used sparingly. Sources all documented.

Criteria Successfully recovering the scrambled bits to their original order (5 marks) HD 100% - 85% Scrambled bits are restored to the original text. Tool used to decode the text is mentioned and justification to use the tool is also provided. The process to restore the scrambled bits is clearly described with screenshots inserted of all steps. Task 2: Forensics report (20 marks) Criteria Introduction: Background, scope of engagement, tools and findings (3 marks) All elements are present, well expressed, comprehensive and accurate. Analysis: relevant programs, techniques, graphics (5 marks) Description of analysis is clear and appropriate programs and techniques are selected. Very good graphic image analysis.

Deliverable: For this forensic examination, you need to provide a report of 1800-2000 words in the format described in presentation section below. Rationale This assessment task will assess the following learning outcome/s: be able to determine and explain the legal and ethical considerations for investigating and prosecuting digital crimes. be able to formulate a digital forensics process. be able to evaluate the technology in digital forensics to detect, prevent and recover from digital crimes. be able to analyse data on storage media and various file systems. be able to collect electronic evidence without compromising the original data. be able to critique and compose technical tactics in digital crimes and assess the steps involved in a digital forensics investigation. be able to prepare and defend reports on the results of an investigation.