Digital Forensic Investigation of Encase Demonstration Case - Hunter XP

Assessment of module learning outcomes

This assignment assesses the following module learning outcomes:

• Assess tools and techniques for investigating computer crime enabling the identification of low level information structures and hardware file formats.

• Evaluate appropriate forensic computing investigative strategies and select available tools based on their appropriateness for a given investigation.

• Understand how to use software tools to investigate the contents of electronic storage devices

• Create reports that use a language and format appropriate to their use in a court of law.

The assignment is worth 50% of the overall mark for the module.

Broadly speaking, the assignment requires you to write an individual report on the Encase Demonstration Case, i.e. “Hunter XP”, showing not only report writing skills but also a knowledge of the technical aspects of forensic recovery and analysis.

This is an individual assignment.

Working on this assignment will help you to demonstrate your ability to investigate digital evidence using various digital forensic tools, and practice your report writing skills. If you have questions about this assignment, please post them to the discussion board on Blackboard:

The principle aims of this assignment are to allow you to demonstrate:

• The ability to investigate digital evidence to establish facts and opinions;

• Report writing skills.

Task Specification

Scenario:

“A forensic image of a PC was delivered to your office on 02 November 2020 (10:30 GMT).You are asked to perform a digital forensic investigation of this image and produce a document that explains your findings. You are supposed to identify users and their actions  Computer Crime and Digital Evidence.

Based on the facts you found in the image, and express your opinion about any crimes committed.”

You will be provided with a copy of the EnCase demo forensic image file, i.e. you will be studying the “Hunter XP” evidence file.

You should:

• Investigate the evidence for potential criminal activity.

• Keep contemporaneous notes of your examination.

• Write a report presenting the facts you have discovered.

• Create a timeline of the sequence of significant events in the case.

• Write a brief summary of your opinion of what occurred, based on the facts you discovered.

For information on how your work will be assessed, see Assessment (Marking) Criteria below.

You must submit your report as a Microsoft Word (.doc or .docx) or as a PDF document via Blackboard – NO paper submission is required. Please compress your report (zip file) before uploading it on Blackboard.

Your report will comprise the following four Sections (see table below). Note that apart from Section 4 there is no specified word count (word limit). The size of deliverables (or Sections) 1-3 will depend on your findings during your investigation.

However, credit will be given to reports that are concise and avoid unnecessary verbiage. You must submit ONE individual file (zip file) that consists of the following sections by the submission date indicated below:

1. Contemporaneous Notes

Your contemporaneous notes will document the steps you took to examine the evidence; they will probably be based on the template, provided on Blackboard (Assignments folder). Factors you need to consider are:

i. The notes need to be sufficiently detailed to demonstrate that you have performed a complete and coherent examination,

ii. Repeatability: The notes should be sufficiently detailed to allow an independent analyst to repeat your examination with the same results.

iii. Dual verification: Choose 2 key evidence items, and provide their provenance, using 2 separate tools such as EnCase and Autopsy.

2. A concise written summary of the evidence file you have studied. This section of the report will typically be around 4-5 pages long and will document the most significant evidence items which you have identified within the forensic image.

This section of the report should document facts, not opinion, for example, the presence of a picture file, rather than a discussion of how this file possibly arrived on the disk. You should include the bulk of the evidence items within an including a provenance block for each item.

3. A timeline of the sequence of events that occurred during this potential crime.

The timeline should be clearly laid out to show what happened when, with appropriate comments. You should concentrate upon the significant events in the case.