Question 1:
Prepare a report describing the analysis you would perform for the company. As you will not have access to computers containing the hard disk or forensics tools, your report must describe what you would do, not what you actually do.
Your completed documentation should as a minimum contain the following sections:
• Table of contents.
• An introduction.
• An appropriate, relevant explanation of specific forensic terms, techniques and procedures.
• A description of the interactions of the components of a personal computer and computer networks and system software (including network software).
• A critical evaluation of concepts behind Amanda computer crime and malicious activity.
• A recommendation for appropriate tools to detect and gather evidence about Amanda actions and to prevent destruction of evidence.
• A description of actions carried out and their purpose.
• A description of how your team found evidence, together with an explanation of the meaning of the evidence and the chain of custody of evidence.
• The actions your team carried out during the investigation, with a description of each actions purpose.
• A conclusion, giving a review of the case, and the recommended next step(s).
• References.