CO4514 | DIGITAL FORENSIC TECHNOLOGY ASSIGNMENT 2 | DIGITAL FORENSIC

Assessed Learning Objectives

LO3 – Analyse, interpret and report on digital evidence

LO4 – Use and extend a technical vocabulary necessary to interact with stakeholders in a digital forensic investigation

Unfair Means to Enhance Performance

Please see the UCLAN Academic Regulations and Assessment Handbook for information and penalties related to “unfair means to enhance performance”.

Housekeeping

Work submitted up to 1 week late from the submission date will be capped at 50%. No work will be accepted after 1 week without supporting extenuating circumstances. All assignments must be submitted electronically through Blackboard where they will be processed by Turnitin. Extenuating circumstance requests must be lodged via myUCLAN.

Word Counts

Learning to write concisely is an important skill to develop and is useful throughout your academic and professional career. Your mark will be penalised heavily if you exceed the word counts or page limits.

                                                                                               

You should use Microsoft Word to complete this assignment. If you use a word processor other than Microsoft Word then you should check to ensure that the document layout is the same as Microsoft Word. Microsoft Word is also available through the University remote access portal page.

You are provided with an evidence file available on Blackboard.

Perform and report on individual parts of a digital forensic investigation.

• Check that the disk acquisition has been performed correctly
• Maintain investigative documentation
• Use forensic tools to analyse and interpret digital data.
• Create an expert report containing the findings from your investigation
• Keep contemporaneous notes

This is a simulated investigation and doesn’t include the analysis of lots of irrelevant data. The evidence that is provided is small and doesn’t include any tricks. You will however need to interpret the data/evidence and draw your own conclusions based on the evidence you find.

You will create an expert report to communicate your findings. See the scenario below for further information about your investigation. You will keep notes of your investigative actions contemporaneously; they should be as long as is necessary but should reflect your investigation process accurately.

You should submit your expert report and your contemporaneous notes separately on Blackboard.

Assignment Scenario

You are a forensic investigator working for the UCLAN High Tech Crime Unit. You have been contacted by the Managing Director of the company ‘Vamos Solutions’. One of their employees has been accused of stealing company secrets.

The employee has attempted to smuggle company secrets out of the work building by copying company secrets onto a USB data storage device. While leaving the building the employee was detained by on-site security and the USB storage device was discovered. This USB storage device has been processed by a forensic imaging technician and the forensic image has been obtained.

You have been provided with a virtual machine that contains the forensic image of the USB data storage device. This is called exhibit CST/001. The virtual machine is available for download via Blackboard, and is available under CO4514->Assignment 3->cst-001.zip. This is a ZIP file that contains a virtual machine, and the files must be extracted from the ZIP file before they can be accessed.

You have been asked to answer the following questions.

Question 1 – Is there any evidence to suggest that the company secrets have been copied onto the USB pen?

Question 2 – Is there any evidence to suggest that the suspect has tried to hide any data?

Question 3 – Any evidence to suggest the reason why the suspect has attempted to steal this data?

Question 4 – What further evidence may be needed by the investigation team to support any of the facts discovered during your investigation?

Note: question 4 is not about the evidence that you will find during your investigation; it is about identifying what further evidence could possibly be found if you had access to other evidence sources (for example, the suspect’s office computer).