Investigation of Alleged Drug Involvement and Evidence Tampering

Given the above suspicion and seized data files, it is your role as investigator to uncover any evidence to prove or disprove the allegations – of drug involvement - but also of evidence tampering. The brief above has highlighted what in particular you are looking for, so the scope of the investigation is limited to this particular suspected crime.
Your report should follow the structure detailed in Chapter 14 of the textbook, there is no limitation on size of the report although you are urged to state the facts clearly and not bury them in pages of irrelevant content.
Your report should highlight the following areas (these will be assessed):
a) Discuss if there is there any evidence of illegal drug activity (Methamphetamine). Explain your position on this. What evidence did you find if any? How sound / reliable do you believe your evidence collection to be? [20 marks]
b) Present any evidence in a time line format, signposting the points where you believe any offence may have occurred and other significant dates/times in the case. Compare any evidence found and timeline information side by side with the different tools available to you (e.g. ProDiscover/ OSFOrensics/ FTK Imager) and highlight any differences. Be sure to state the pros and cons of using one tool over the other. [20 marks]
c) You were provided with two sets hard drive images. Are there any differences between them, considering they are purported to be of the same computers. What do you think has occurred here? What are the differences between the sets of the drive images? Which images do you think are the originals and why? How do you think the sets of drive images were created? [20 marks]
d) A common defence is that the actions were committed unintentionally or that the perpetrator did not know the actions were illegal. With these possible defences in mind, address how you would respond to these defences. Are there any clues that indicate intent or knowledge of criminal activity? [20 marks]
e) Conduct some research into ways that image files could be “tampered with”. Are there ways that are undetectable, or difficult to detect? Present your findings in a short section – written in a formal referenced style. You are only expected to have approximately 5 references (good quality: reputable journal or conference papers). [20 marks]

Background

 m57.biz is a patent company newly set up with four main employees; the CEO(Pat McGoo), IT Administrator (Terry), and Jo and Charlie, the two patent researchers. The employees work on site and mainly communicate through e-mail in a windows environment. A workstation used originally at m57.biz is sold to a customer (Greene) in the second hand market; Greene realizes the previous owner did not erase the hard drive and suspicious videos and documents related to metmphetamine drug use; a real problem drug in Singapore and Australia. Greene reports this to the police who start forensics investigations. The provided information include the hard drive sold with the computer and other hard drives as listed below;

The two additional images are provided I different format and while they have no problem with logging, there is suspicion of police negligence and even foul play which is yet to be determined.

Objectives

The team is given the task of determining and uncovering any evidence either prove or disprove allegations of illegal drug use. The other objective is to determine whether there is evidence of tampering with the provided evidence and possible cover up of the situation. The main objective is to determine whether there was illegal drug