Linda who works for an intelligence company is suspected of accessing and possessing digital content pertaining to turtles. Accessing, possessing, or distributing of digital content pertaining to turtles breaches both civil and criminal laws. Linda has also been accused (by her company) of obtaining two highly confidential documents. One document encompasses the names, positions, usernames and passwords of notable personnel within the company. The second document is a top secret intelligence report. Linda should not have had access to either of these documents.
You are a consultant who specialises in Digital Forensic investigations. You have been assigned the task of examining an image of Linda's laptop which was seized with the appropriate warrants. An image of the hard disk was created using forensically sound practices. Only a logical acquisition was undertaken by the individual responsible for creating the forensic copy. The logical acquisition was undertaken in a forensically sound manner and the md5 value at the time of acquisition was "b7cb6e8ad2ed5b89014f4ee25c05087e".
At this point in time it is unknown if Linda was also distributing the digital content. Linda denies accessing and possessing any content pertaining to turtles and denies storing the confidential documents on her computer. Linda stated that she noticed her computer had been misbehaving in recent months. During the interview she stated that the computer had been problematic since May 10th, 2014. As a result she believes a computer virus may have infected her computer and downloaded the content to the computer. The following points have also been provided to you to aid your investigation:
• The computer in question was seized from 1 Bradford Street, Mount Lawley on the 8th of February, 2015.
• Linda has acknowledged that she was the only user of the computer but later retracted this comment.
• No other persistent storage devices were located around the crime scene.
• Linda denies using the computer for approximately one week leading up to the investigation.
Task
Your task is to investigate the supplied image using appropriate tools and forensic process and to develop and submit a written report on your findings. You may use any tools to undertake the investigation but you must justify all of your actions!
Report Structure
• Executive Summary
o Describe the investigation that you have undertaken
o Summarise and quantify the evidence identified
o State any observations made during your investigation
• Tables of Contents
• Part 1: Presentation of Evidence
o This section must report on what and where you found evidence. Include metadata associated with the evidence (file names, physical and logical locations of files, creation/access/modified times).
o This section should be organised according to 'issues' and follow the structure depicted in the unit.
• Part 2: Investigative Notes
o This section should contain a well-structured running sheet showing what, how and why you did it, and the outcome. This should be very detailed and show clear use of the forensic process.
o The process must be detailed enough so that the procedures can be repeated and the exact same results reproduced.
o You must validated your results utilising multiple tools.
• Part 3: Timeline of events
o A chronological order of key events that took place on Linda's computer.
• Tools and Terminology
o Name, version and description of tool(s) utilised through the forensic investigation.
o Justification of tools utilised and their forensic soundness.
o Definition of uncommon terminology or evidentiary elements discovered.
• Conclusion
o Summarise the investigation
Additional Task Information
• Start early and plan ahead, you may need to spend some time experimenting with various tools. If a tool or method fails to result in a successful outcome you should still document this action in your running sheet.
• Try and experiment/use different tools. Each tool has its own strengths and limitations.
• There is no total page limit for the final report. Each report will be unique and presented in its own way.
• Every report will encompass a slightly unique structure! Whilst you should utilise the structure depicted in this unit, you can adjust it to suit your style of investigation and evidence obtained.
• Looks for clues/hints in the investigation. Strategically placed clues/hints have been created in this fictitious case study to help you along the way.
• It is not expected that you find every piece of evidence and nor do you have to.
• Remember to ensure the integrity of the image being investigated. You should continually demonstrate that you have maintained integrity throughout your investigation.
• Do not make assumptions. Stick to facts.
• The most important aspect of this case study is your methodology.