Practical cyber forensics - forensic investigation

Assignment Help Computer Network Security
Reference no: EM133529987

Cyber Forensics

Assessment - Practical Cyber Forensics - Forensic Investigation

Learning outcome 1: Apply a range of techniques for collecting digital evidence and case assessment.

Learning outcome 2: Discuss the functionality of the various tools and phases of evidence collection and analysis.

Learning outcome 3: Communicate effectively and professionally the outcomes of the cyber investigation.

Learning outcome 4: Discuss the strengths and limitations of forensics tools.

Learning outcome 5: Compare various types of evidence collected from different devices and environments.

Learning outcome 6: Communicate ideas and solutions with rational and reasoned arguments using appropriate methods (e.g. orally, electronically, written reports).

Assessment task details and instructions

Lectures will be used to introduce and discuss important concepts and techniques of cyber investigation, which will then be practised in more details in practical classes.

In this practical assignment, students are required to solve a real-world cyber investigation case. They are also required to utilize their knowledge and skills to collect evidence and answer the main questions generated by the case study.

The students will be given a cyber-crime case description and the related collected evidence (disk images, RAM images, files, etc.). They are required to apply the appropriate forensics tools to extract data, retrieve hidden files, and comment on their findings. They are also required to answer the questions generated by the case study based on the data retrieved from the provided evidence. They are required to submit an assignment report producing a detailed walkthrough for each task, explaining techniques used and include relevant screenshots where appropriate.

Case Scenario

On 09/20/04, a Dell CPi notebook computer, serial # VLQLW, was found abandoned along with a wireless PCMCIA card and an external homemade 802.11b antennae. It is suspected that this computer was used for hacking purposes, although cannot be tied to a hacking suspect, Greg Schardt. Schardt also goes by the online nickname of "Mr. Evil" and some of his associates have said that he would park his vehicle within range of Wireless Access Points (like Starbucks and other T-Mobile Hotspots) where he would then intercept internet traffic, attempting to get credit card numbers, usernames & passwords.

A DD image (in eight parts and notes) and EnCase Image (in two parts) of the abandoned computer have already been made and are available.

Your Task

In the provided images, find any hacking software, evidence of their use, and any data that might have been generated. Attempt to tie the computer to the suspect, Greg Schardt.

You can use any of the tools and techniques that have been discussed in the class, as well as other tools that you may find useful but have not been covered in this module to perform the investigation.

What the work must include:

Before beginning the practical investigation, from the information and material provided, develop a high-level set of procedures, processes, and techniques to plan this investigation. Your plan should be clear and concise, and should then be followed throughout this investigation. The plan should be specific to this case, but backed up by best-practice. (20%)

Before beginning the practical investigation, Identify initial key questions that will need to be answered throughout the investigation. Also record how the question was answered - what was the source of the answer including what procedure/process/technique was used to determine the answer.

As you work through the practical investigation, identify further key questions to lay the factual groundwork for this case. An example list of some key questions is below, - use this and add to this list. Answer these key questions and also record how the question was answered.

Keep a record of the answers and sources to all the key questions in a separate self-contained chapter or appendix. These will comprise part or all of the evidences.

For the main body of the work, in accordance to your plan, piece together all the pieces of evidence to present a solid case with conclusions. Refer to your evidences. Present and address any conflicting or circumstantial evidences directly.

Throughout this work, you must references and best-practice to give credence to your work.

The above does not define a structure. You are expected to form a reasonable structure to your work, in accordance Layout of Report. Although no marks are awarded directly for the structure, the inability to be well-structured could impact the overall quality of your work. - See Assessment Criteria, below.

Example list of some key questions

1. What is the image hash? Does the acquisition and verification hash match?
2. What operating system was used on the computer?
3. When was the install date?
4. What is the timezone settings?
5. Who is the registered owner?
6. What is the computer account name?
7. What is the primary domain name?
8. When was the last recorded computer shutdown date/time?
9. How many accounts are recorded (total number)?
10. What is the account name of the user who mostly uses the computer?
11. Who was the last user to logon to the computer?
12. A search for the name of "Greg Schardt" reveals multiple hits. One of these proves that Greg Schardt is Mr. Evil and is also the administrator of this computer. What file is it? What software program does this file relate to?
13. List the network cards used by this computer
14. This same file reports the IP address and MAC address of the computer. What are they?
15. An internet search for vendor name/model of NIC cards by MAC address can be used to find out which network interface was used. In the above answer, the first 3 hex characters of the MAC address report the vendor of the card. Which NIC card was used during theinstallation and set-up for LOOK@LAN?
16. Find 6 installed programs that may be used for hacking.
17. What is the SMTP email address for Mr. Evil?
18. What are the NNTP (news server) settings for Mr. Evil?
19. What two installed programs show this information?
20. List 5 newsgroups that Mr. Evil has subscribed to?
21. A popular IRC (Internet Relay Chat) program called MIRC was installed. What are the user settings that was shown when the user was online and in a chat channel?
22. This IRC program has the capability to log chat sessions. List 3 IRC channels that the user of this computer accessed.
23. Ethereal, a popular "sniffing" program that can be used to intercept wired and wireless internet packets was also found to be installed. When TCP packets are collected and re- assembled, the default save directory is that users \My Documents directory. What is the name of the file that contains the intercepted data?
24. Viewing the file in a text format reveals much information about who and what was intercepted. What type of wireless computer was the victim (person who had his internet surfing recorded) using?
25. What websites was the victim accessing?
26. Search for the main users web based email address. What is it?
27. Yahoo mail, a popular web based email service, saves copies of the email under what file name?
28. How many executable files are in the recycle bin?
29. Are these files really deleted?
30. How many files are actually reported to be deleted by the file system?
31. Perform a Anti-Virus check. Are there any viruses on the computer?

Layout of Report

This report must be formatted and submitted as one document. The report should look presentable with the target audience being a peer. It must at least have;
a title,
one Contents section or page at the start, a very brief introduction to the report,
a well-structured body that addresses the task,
and a chapter or appendix that records all the key questions, answers, and source.
A reader of your report must be able to navigate the document; sections / sub-sections must be named appropriately, and numbered if considered useful.
Write the report so that the reader does not need to refer to this Assignment Brief. I.e. it should be self-contained.

Organisation advice:
• Number all figures and tables used, and use brief captions to each figure or table. Refer to the figure or table from the body of the text.
• Use presentable formatting; Use headers, and break into appropriate sections with sub- headers
• Don't write complicated long sentences unless they completely make sense; it is often easier to write shorter sentences that are well-formed and unambiguous, clearly making a point.
All/any Appendices should be referred to from the main body of the report.

Reference no: EM133529987

Questions Cloud

What type of fluid balance problem is the client exhibiting : What type of fluid balance problem is the client exhibiting? Discuss each of the electrolyte abnormalities present. What signs and symptoms would you expect for
Discuss the first and greatest priority of the first officer : Discuss the first and greatest priority of the first officer on a scene. Discuss the steps for interviewing victims, witnesses and suspects.
Perspectives on meaning-application of strategic risk : We learned of multiple perspectives on the meaning and application of strategic risk. how do you think these two companies viewed strategic risk, before fire.
Demonstrates safe nursing care and knowledge and critical : Explain the difference between a hypotonic solution and an isotonic solution and an example of when each may be given to a patient.
Practical cyber forensics - forensic investigation : Cyber Forensics - University of Salford - Practical Cyber Forensics - Forensic Investigation and Discuss the functionality of the various tools and phases
Explain three types of vehicle searches : List and explain the steps an officer must follow to execute a search warrant on a home. List and explain three types of vehicle searches.
What would kants formula of ends require the doctor to : Based on the Module 2 reading, what would Kant's Formula of Ends require the doctor to? If you were the patient, what would you prefer your doctor did? Why?
According to barilla spa case study : According to barilla spa case study explain Headings to be covered: Introduction, Issue(s) Identification, Environmental and Root Cause Analysis,
Discussing domestic violence : In discussing domestic violence, it is important to note that most men in this country aren't abusive.

Reviews

Write a Review

Computer Network Security Questions & Answers

  An overview of wireless lan security - term paper

Computer Science or Information Technology deals with Wireless LAN Security. Wireless LAN Security is gaining importance in the recent times. This report talks about how vulnerable are wireless LAN networks without any security measures and also talk..

  Computer networks and security against hackers

This case study about a company named Magna International, a Canada based global supplier of automotive components, modules and systems. Along with the company analysis have been made in this assignment.

  New attack models

The Internet evolution is and is very fast and the Internet exposes the connected computers to attacks and the subsequent losses are in rise.

  Islamic Calligraphy

Islamic calligraphy or Arabic calligraphy is a primary form of art for Islamic visual expression and creativity.

  A comprehensive study about web-based email implementation

Conduct a comprehensive study about web-based email implementation in gmail. Optionally, you may use sniffer like wireshark or your choice to analyze the communication traffic.

  Retention policy and litigation hold notices

The purpose of this project is to provide you with an opportunity to create a document retention policy. You will also learn how to serve a litigation hold notice for an educational institute.

  Tools to enhance password protection

A report on Tools to enhance Password Protection.

  Analyse security procedures

Analyse security procedures

  Write a report on denial of service

Write a report on DENIAL OF SERVICE (DoS).

  Phising email

Phising email It is multipart, what are the two parts? The HTML part, is it inviting the recepient to click somewhere? What is the email proporting to do when the link is clicked?

  Express the shannon-hartley capacity theorem

Express the Shannon-Hartley capacity theorem in terms of where is the Energy/bit and is the psd of white noise.

  Modern symmetric encryption schemes

Pseudo-random generators, pseudo-random functions and pseudo-random permutations

Free Assignment Quote

Assured A++ Grade

Get guaranteed satisfaction & time on delivery in every assignment order you paid with us! We ensure premium quality solution document along with free turntin report!

All rights reserved! Copyrights ©2019-2020 ExpertsMind IT Educational Pvt Ltd