Criminal Justice Assignment | Online Homework Help

Total points: 20

(* Answer All 5 Questions, points for each question are marked on the right side of the question)

Goal: This final lab assignment will allow you to go give an overall review of many methods and strategies we learned in this Computer Forensics course for digital investigations.

1. You’re investigating a case involving a 2 GB drive that you need to copy at the scene. This is a hypothetical situation. (You are assuming that you are involved in the case which has 2 gb drive) Write few paragraphs describing the three types of acquisitions — physical, logical, and sparse — you can use to copy the drive accurately. Be sure to include your software and media choices.                                 4

2. As a digital investigator for your local sheriff’s department, you have been asked to go witha detective to a local school that got a bomb threat in an anonymous e-mail. The detectivealready has information from a subpoena sent to the last known ISP where the anonymouse-mail originated, and the message was sent from a residence in the school’s neighborhood.The detective tells you the school principal also stated that an unknown attacker had defaced the school’s Web server. The detective has just obtained a warrant for thesearch and seizure of a computer at the residence the ISP identified. Prepare a list of whatitems should be included in an initial-response field kit to ensure the preservation of digitalevidence when the warrant is carried out. 3

3. You work for a mid-size corporation known for its inventions that does a lot of copyrightand patent work. You’re investigating an employee suspected of selling and distributinganimations created for your corporation. During your investigation of the suspect’s drive, youfind some files with the unfamiliar extension .xde. The network administrator mentions thatother .xde files have been sent through an FTP server to another site. Describe your findingsafter conducting an Internet search for this file extension. 2

4. As part of the duties of a digital forensics examiner, creating an investigation plan is astandard practice. Write a paper that describes how you would organize an investigation fora potential fraud case. In addition, list methods you plan to use to validate the data collectedfrom drives and files, such as Word and Excel, with hashes. Specify the hash algorithm youplan to use, such as MD5 or SHA-1.5

Help: Recall from Chapter 1 that you begin a digital forensics case by creating an investigationplan that defines the investigation’s goal and scope, the materials needed, and thetasks to perform. Although some basic principles apply to almost all digital forensicscases, the approach you take depends largely on the type of case you’re investigating.For example, gathering evidence for an e-mail harassment case might involvelittle more than accessing network logs and e-mail server backups to locate specificmessages. Your approach, however, depends on whether the case is an internalorganizational investigation or a civil or criminal investigation carried out by lawenforcement. In an internal investigation, evidence collection tends to be fairly easyand straightforward because private-sector investigators usually have ready access tothe necessary records and files. In contrast, when investigating a criminal cyber stalkingcase, you need to contact the ISP and e-mail service. Some companies have systemsset up to handle these situations, but others do not. Most organizations don’t keep

e-mail for longer than 90 days, and many keep it for far less time.An investigation of an employee suspected of industrial espionage can require themost work. Before initiating this type of investigation, make sure the organization,whether it’s a private company or a public agency, has set up rules of use andlimitations of privacy rights, as described in Chapter 1. For these investigations, youmight need to set up a surveillance camera to monitor the employee’s activities in theoffice. You might also need to plant a software or hardware keylogger (for capturingkeystrokes remotely), and you need to engage the network administrator’s servicesto monitor Internet and network activities. In this situation, you might want to do aremote acquisition of the employee’s drive, and then use another tool to determinewhat peripheral devices have been accessed

5. A desperate employee calls because she has accidentally deleted crucial files from her harddrive and can’t retrieve them from the Recycle Bin. What are your options? Write one to twopages explaining your capabilities and listing the questions you need to ask her about hersystem.                                 6

Help: When you analyze digital evidence, your job is to recover the data. If users havedeleted or overwritten files on a disk, the disk contains deleted files and file fragmentsin addition to existing files. Remember that as files are deleted, the space theyoccupied becomes free space—meaning it can be used for new files that are saved orfiles that expand as data is added to them. The files that were deleted are still on the

disk until a new file is saved to the same physical location, overwriting the original file.In the meantime, those files can still be retrieved. Forensics tools such as Autopsy canretrieve deleted files for use as evidence.