7906ICT Digital Forensics

Task 1: Case Project
A distressed employee calls you because she has accidentally deleted crucial files from her hard drive and can’t retrieve them from the Recycle Bin. Describe the options or methods that you believe might be used to recover the files. Your solution may contain a list of questions to ask her about her system before you carry out your methods.
Task 2: Research Project

As part of the duties of a digital forensics examiner, creating an investigation plan is a standard practice. Write a paper that describes how you would organise an investigation for a potential fraud case. Also, list the methods that you plan to use to validate collected data from storage devices such as MS Word, MS Excel and emails, with hashes. Specify the hash algorithm you plan to use, such as MD5 or SHA1.

Scenarios of accidental deletion of files by human interaction or due to some major issues with the computing device leads to data loss. The case presented here is about the Employee who have accidentally deleted few files from the hard disk she is working on and she is not being able to recover the files from the recycle bin as well. As these types of situation being very common so the software or tools available in the market are high and their efficiency are quite high and very good in the recovery of the files.  In order to devise a plan and provide the optimal solution to the employee, we need to understand all the situations under which files were deleted and what can be done to revive those files.

 The set of questions would be following:

1. Operating System on which employee was working
2. Deleted files size
3. Location from which files are deleted
4. Hard Disk Size
5. Number of days since files been deleted
6. Encryption type if any being used on the hard disk
7. Compression if any being used on the hard disk

Since there are many solutions available in the market, the recovery could be easy based on the question’s answers that have been provided by the employee. Assuming not much time has passed since the deletion of the file and sectors have not been over written many times, there are no physical or logical errors on the device. The recovery software can be used to recover the files and some of the other factors that could possibly related to files recovery are:

1. Processing power of the system
2. Hard disk capacity of the system

Best options to recover the files are as follows:

1. Recuva
2. Disk Drill
3. FreeUndelete
4. Glary Undelete
5. Pandora Recovery
6. SoftPerfect File Recovery
7. EaseUS Data Recovery Wizard
8. Orion File Recovery Software

The one that would be recommended would be Orion File Recovery Software, it is free recovery system form NCH software, it does the work as many recovery tools but its simplicity and support for multiple types of files provides the overall great experience and it does support the deep scan mode that helps in recovery of the data that has been overwritten quite a few times.   This software supports all types of devices external and internal as well. The software is free of cost and don’t have any limitation in recovering of files.

References

19 Free Data Recovery Software Tools. (2017). Lifewire. Retrieved 5 April 2017, from https://www.lifewire.com/free-data-recovery-software-tools-2622893

Free Data Recovery Software Download for File Recovery - EaseUS Data Recovery Wizard Free. (2017). Easeus.com. Retrieved 5 April 2017, from https://www.easeus.com/datarecoverywizard/free-data-recovery-software.htm

Task 2

The Digital forensic is the branch of computer science in which investigations and procedures are used for legal procedures that involves data collection, data recovery, data validation and data authorization, the chain of custody is also an important feature of Digital forensics and it also involves mathematical proofs along with may or may not the expert’s comments and presentations. Since there were hardly any standards till 19^th century, it was in the 21^st century the standard procedures came into place and proper guidelines were made for digital investigations to be carried out in fool proof manner.

Obtaining digital evidences around the world have increased as the cyber-crimes are also on the rise around the globe, hence it is the duty of the investigator to provide the fool proof evidences in order to catch the right person for the crime.

For the present case to recovery of the different types of files like word, ppt, excel etc. can be done using the recovery software that we have just discussed in our task 2 above. After the recovery in order to maintain data integrity we should calculate the SHA-1 so that anything that is being recovered is not tampered with, if tampered the data collected becomes useless as the state from which it was collected do not meet the requirements. The hash calculations are as important as the data recovery and proof management. The data acquisition could be from removable devices or non-removable devices. The data recovery process could vary depending upon the following factors:

1. Encryption of the data
2. Data deletion
3. Format of the hard disk
4. Device security.

These factors could lead to hindrance on the path to collect the data but this could be managed with some advanced tools and techniques so that right data and culprit could be easily be nabbed and strong case could be developed against him. After the data have been acquired the data is stored either on the removable devices or on highly secure clouds. The SHA-1 is then calculated of the files and stored along with them and as well as secondary locations, so that incase if the data ever happen to be tampered with, it could be easily being made out using the simple SHA-1 calculations. These hashing techniques helps in verifying of the data quickly and accurately within few seconds to minutes depending upon the size of the system.  

References

MD5 and Sha 1 algorithm - VPN and cryptography Tutorial. (2017). Internet-computer-security.com. Retrieved 5 April 2017, from https://www.internet-computer-security.com/VPN-Guide/Sha-1.html

What Are MD5, SHA-1, and SHA-256 Hashes, and How Do I Check Them?. (2017). Howtogeek.com. Retrieved 5 April 2017, from https://www.howtogeek.com/67241/htg-explains-what-are-md5-sha-1-hashes-and-how-do-i-check-them/