Problem
Case Study: You have been assigned a child abduction case. A 16GB USB is found from the suspect's apartment, and it is expected to have very important information related to the case. The USB contains several Doc files, a couple of image files, and some text files.
Data Preparation: You need to use your own USB to create/delete files as mentioned in the scenario below and perform the digital forensics investigation:
i. You need to create six files of type pdf, excel and word documents, where you need to name these files as follow: BN309_Assig1.*, where * depends of the file type. In addition, you need to change the attribute of these files to describe the Metadata which holds data such as your name as an author, organization name "MIT", computer name "based on your terminal name", date/time created, and comments such as "created for Assignment1 of BN309".
ii. Modify the extension of one of the doc file to .jpeg
iii. Then you need to delete 3 files including the file you have modified its extension, one of each type. Provide the list of references using IEEE referencing style at the end of the report
You need to make a report of data Acquisition and data recovery regarding the case and data preparation above by using PRODISCOVER tool, screenshoots during the process are require.
Follow the requirement below:
Prepare a forensic image (bit stream copy) with the record of data deletion. Explain the method and tool you have used in acquiring data. Submit this image with your assignment. You need to cover the challenges to make a successful acquisition, and what are the relevant formats to use and why. Describe the steps required for search and seizure.