Assignment: Digital Forensics Essentials
Forensic investigation and reporting: An individual assessment in the form of a forensic report.
Scenario: Working as a forensic practitioner, you have been provided with an EnCase evidence image taken from a suspect's PC. The specific details of the suspect are unknown to you at this time, however you have been made aware that they are suspected of colluding with another individual to plan a variety of serious crimes. The motives of the suspect are unknown at this time.
Task: Your first task will be to analyse the evidence image and obtain as many details as possible about the suspect and their actions, particularly in relation to any crimes they may be planning, or have already committed, and any accomplices with whom they may be working. You will conduct the analysis using EnCase, based on the skills you have gained during this course. You will need to make case notes/records for all of the details that you discover during your analysis for ultimate inclusion in a forensic report, which is the major deliverable for this assessment.
Ensure that you clearly identify each of the digital artefacts that you discover in your forensic report (e.g. using file paths or other unique IDs) and that you record relevant metadata for each artefact (e.g. date/time created, last accessed, modified). Artefacts without supporting metadata will not be accepted.
The forensic report should conform with the guidelines specified in Australian Standard 5388.4-2013 Forensic Analysis Part 4: Reporting, with specific focus on Section 9 - Report Contents. This section will provide high-level guidance on the structure of your forensic report. In addition to the structural guidance provided by AS 5388.4, you must include a Conclusions section which summarises your key findings in relation to the case. The word limit for the forensic report is 2,000 words (+10%).
In addition to the forensic report, you will need to produce a document which justifies the analysis and reporting decisions that you have made. This should include a detailed discussion of the techniques that you used within EnCase and the associated artefacts located (referencing the forensic report where appropriate). It should also include a justification for the detailed sections included in the forensic report (beyond those specified by AS 5388.4). The word limit for the companion document is 1,000 words (+10%).
Logistics: You will be provided with access to the EnCase evidence image related to this case for the duration of your scheduled practical class (~2 hours) in Week 13. It is imperative that students attend the practical class for which they are enrolled in Week 13. Attendance records will be taken during these classes.
During this time, you will need to use the skills that you have gained throughout the course to analyse the evidence image as required to complete the task outlined above. You will need to strike a balance between the width of analysis (i.e. variety of artefacts analysed) and the depth of analysis (i.e. the extent to which any individual, or type of, artefact is analysed).
You will need to record (on paper or your own personal device) specific details for all artefacts that you will use in your report during the class. You also need to create a "Bookmark", within your EnCase case, of each artefact that you intend to use in your report - these bookmarks may be used by the marker.
The analysis of this image will be conducted as a supervised activity, with similar conditions to an open book test (you will not be permitted to talk with others in the class or remotely during the activity). You will need to save your completed EnCase case file, including evidence of all your completed analysis, to CyberNet. You will no longer be able to access your case file after the conclusion of your practical class.
Format your assignment according to the following formatting requirements:
1. The answer should be typed, double spaced, using Times New Roman font (size 12), with one-inch margins on all sides.
2. The response also includes a cover page containing the title of the assignment, the student's name, the course title, and the date. The cover page is not included in the required page length.
3. Also include a reference page. The Citations and references should follow APA format. The reference page is not included in the required page length.