Question 1:
Prepare a report describing the analysis you would perform for the company. As you will not have access to computers containing the hard disk or forensics tools, your report must describe what you would do, not what you actually do.
Your completed documentation should as a minimum contain the following sections:
• Table of contents.
• An introduction.
• An appropriate, relevant explanation of specific forensic terms, techniques and procedures.
• A description of the interactions of the components of a personal computer and computer networks and system software (including network software).
• A critical evaluation of concepts behind Amanda computer crime and malicious activity.
• A recommendation for appropriate tools to detect and gather evidence about Amanda actions and to prevent destruction of evidence.
• A description of actions carried out and their purpose.
• A description of how your team found evidence, together with an explanation of the meaning of the evidence and the chain of custody of evidence.
• The actions your team carried out during the investigation, with a description of each actions purpose.
• A conclusion, giving a review of the case, and the recommended next step(s).
• References.
• In your document the report is to be written in a professional manner, paying due regard to the following aspects:
• The report is to be written in the 3rd person.
• The report should have a consistent layout and be divided into enumerated sections, sub-sections, sub-sub sections etc.
• A contents page is to be included that also shows the word count of the main body of the report (excluding title and contents page).
• The report should be fully referenced using the University standard.