ITC597 Digital Forensics

Question:

You have been assigned a digital forensics case to investigate  involving a potential monetary fraud in an organisation. The CTO of the organisation has given you access to the workstation and other necessary hardware, e.g. USB,  of one of his employees who she thinks is potentially involved in this fraud. Your job as a digital forensics examiner is to conduct this investigation. You are required to create a (investigation) plan and describe the standard practice procedure that is used in such investigations. Your plan must include the procedures for collecting the digital data, securing the evidence that you may collect and then describing the method to validate the collected data, e.g. calculating hash values and specifying the hash algorithm that you intend to use, e.g. SHA-3, MD5 etc. You can make some reasonable assumptions if required when describing your plan / procedures.

Task: 

Write a  report that outlines the investigation plan, procedures to secure the digital evidence, and data validation methods.

Learning Outcomes:

• Be Able To Determine And Explain The Legal And Ethical Considerations For Investigating And Prosecuting Digital Crimes.
• Be Able To Formulate a Digital Forensics Process.
• Be Able To Evaluate The Technology In Digital Forensics To Detect, Prevent And Recover From Digital Crimes.
• Be Able To Analyse Data On Storage Media And Various File Systems.
• Be Able To Collect Electronic Evidence Without Compromising The Original Data.
• Be Able To Prepare And Defend Reports On The Results Of An Investigation.