Project 2: Computer Architecture and Imaging Step 1: Brief the Legal Team on Forensics Before you have a chance to begin the imaging process, your supervisor calls to tell you that the organization's...

1 answer below »
Please look at the attachments for instructions.


Project 2: Computer Architecture and Imaging Step 1: Brief the Legal Team on Forensics Before you have a chance to begin the imaging process, your supervisor calls to tell you that the organization's legal team has been asking questions about types, sources, and collection of digital information. Team members have also asked about file formats. Your supervisor asks you to prepare a brief explanatory memo. You use the department's technical manual to compose your memo on finding valuable forensic information and storing digital evidence. You also review image verification using hashing, an important component of digital forensics.  For the first step in this project, prepare a memo (one to two pages in length following this format) in plain language that summarizes where valuable digital forensic information resides in the device, as well as collection and storage options. The devices to be addressed are USB sticks, RAM and swap space, and operating system hard disks. You will need to research and cite reference sources for each answer contained your memo (e.g., NIST) For each electronic media device described, include a short description of the following:   · identify the digital media device examined  · types of data that can be found there  · reasons why the data has potential value to an investigation in general, and for this case in particular  · list the possible digital evidence storage formats (raw, E01 (ewf), and AFF) and describe the advantages and disadvantages of each format, and   · how digital forensic images are collected (local and remote, memory and disk) and verified.   Your memo will be included in the final forensic imaging lab report.  Project 2: Computer Architecture and Imaging Step 2: Image a USB Drive Using Linux Tools In the first step in this project, you reviewed technical information and imaging procedures and briefed your legal team on digital forensic basics. Now, it's time to move forward with the investigation.  The USB stick may contain intellectual property that you can use to prove the suspect's guilt, or at least establish intent. Security personnel recovered the stick from the suspect's desk drawer the night before. You take possession of the stick, recording the physical exchange on the chain-of-custody document prepared by the security officers.   Your team's policy is, when practical, to use multiple tools when conducting digital forensic investigations, so you decide to image the USB stick using both Linux and Windows tools.  To get started, review the lab instructions in the box below, as well as methods of acquisition. Then go to the virtual lab to set up your evidence drive and proceed to enable write protection, sterilize the target media, perform a static acquisition of Linux data, and verify the USB stick on the sterilized media using Linux tools in preparation for the report and notes requested by your supervisor.  Complete This Lab Resources · Accessing the Virtual Lab Environment: Navigating UMGC Virtual Labs and Lab Setup · Self-Help Guide (Workspace): Getting Started and Troubleshooting · Link to the Virtual Lab Environment: https://vdi.umgc.edu/ Lab Instructions · Linux Forensics Imaging Getting Help To obtain lab assistance, fill out the support request form. Make sure you fill out the fields on the form as shown below: · Case Type: UMGC Virtual Labs Support · Customer Type: Student (Note: faculty should choose Staff/Faculty) · SubType: ELM-Cyber (CST/DFC/CBR/CYB) · SubType Detail: Pick the category that best fits the issue you are experiencing · Email: The email that you currently use for classroom communications In the form's description box, provide information about the issue. Include details such as steps taken, system responses, and add screenshots or supporting documents. Submit your lab notes and report to your supervisor (instructor) for ungraded feedback and incorporate any suggested changes. This material will be included in the final forensic imaging lab report in the last step of this project. In the next step, you will conduct the same procedures using Windows tools. Project 2: Computer Architecture and Imaging Step 3: Image a USB Drive Using Windows Tools After imaging the USB drive with Linux in the previous step, your next step is to image the USB drive again, this time using Windows tools. Review the lab instructions in the box below, and then go to the virtual lab. When you complete the activity, review your lab notes and report for accuracy and completeness; they will be included in your final forensic imaging lab report in the final step. Complete This Lab Resources · Accessing the Virtual Lab Environment: Navigating UMGC Virtual Labs and Lab Setup · Self-Help Guide (Workspace): Getting Started and Troubleshooting · Link to the Virtual Lab Environment: https://vdi.umgc.edu/ Lab Instructions · Windows Forensic Imaging Getting Help To obtain lab assistance, fill out the support request form. Make sure you fill out the fields on the form as shown below: · Case Type: UMGC Virtual Labs Support · Customer Type: Student (Note: faculty should choose Staff/Faculty) · SubType: ELM-Cyber (CST/DFC/CBR/CYB) · SubType Detail: Pick the category that best fits the issue you are experiencing · Email: The email that you currently use for classroom communications In the form's description box, provide information about the issue. Include details such as steps taken, system responses, and add screenshots or supporting documents. Your organization's legal team has some questions for you in Step 4. Project 2: Computer Architecture and Imaging Step 4: Respond to Questions from the Legal Team In previous steps, you imaged the USB drive using Linux and Windows tools. In this step, you will create a legal memorandum that responds to pointed questions from your organization's legal team. The legal team has been involved in cybercrime cases before, but team members want to make sure they are prepared for possible legal challenges. They have requested very specific information about imaging procedures based upon your review of reference sources in the field. Research sources on digital forensics imaging and mounting procedures before writing your response. Then review Set Up Your Evidence Drive, Hash Functions, Imaging Programs, and Image Verification With Hashing as needed. Questions from the legal team: 1. Assuming that this is a criminal case that will be heard in a court of law, which hashing algorithm will you use and why? 2. What if the hash of your original does not match your forensic copy? What kinds of issues could that create? What could cause this situation? 3. What if your OS automatically mounts your flash drive prior to creating your forensic duplicate? What kinds of problems could that create? 4. How will you be able to prove that your OS did not automatically mount your flash drive and change its contents prior to the creation of the forensic copy? The legal team would like you to respond in the form of a brief memo (one to two pages following this format) written in plain, simple English. The memo will be included as an attachment to your final forensic imaging lab report in the final step, so review it carefully for accuracy and completeness. You are hoping that you will be able to access the suspect's local computer next. Project 2: Computer Architecture and Imaging Step 5: Acquire RAM and Swap Space In the previous step, you addressed the concerns of your company's legal team. While you were doing so, the suspect's afternoon training session started, so now you can move to the next stage of your investigation. Your organization's IT department backs up the hard drives of HQ computers on a regular basis, so you are interested only in the suspect's RAM (referred to as volatile data storage) and swap space. The RAM and swap space may reveal programs used to hide or transmit intellectual property, in addition to the intellectual property itself (past or current). You have a four-hour window to acquire the RAM and swap space of his live computer. When you arrive at the suspect's office, the computer is running, but locked. Fortunately, the company IT department has provided you with the administrator password, so you log on to the system. Review the lab instructions in the box below, and then go to the virtual lab. Follow the steps required to acquire and analyze the RAM and swap space and perform imaging of a live computer. Complete This Lab Resources · Accessing the Virtual Lab Environment: Navigating UMGC Virtual Labs and Lab Setup · Self-Help Guide (Workspace): Getting Started and Troubleshooting · Link to the Virtual Lab Environment: https://vdi.umgc.edu/ Lab Instructions · RAM and Swap Acquisition Getting Help To obtain lab assistance, fill out the support request form. Make sure you fill out the fields on the form as shown below: · Case Type: UMGC Virtual Labs Support · Customer Type: Student (Note: faculty should choose Staff/Faculty) · SubType: ELM-Cyber (CST/DFC/CBR/CYB) · SubType Detail: Pick the category that best fits the issue you are experiencing · Email: The email that you currently use for classroom communications In the form's description box, provide information about the issue. Include details such as steps taken, system responses, and add screenshots or supporting documents. Your lab notes and report will be included in your final forensic imaging lab report (Step 7) so make sure you review them carefully for accuracy and completeness. Now that you've imaged the suspect's local computer, there is only one task that remains. You need to use the company network to access his remote computer. Project 2: Computer Architecture and Imaging Step 6: Perform Forensic Imaging Over a Network In the previous step, you acquired and analyzed the RAM and swap space from the suspect's live, local computer. In this step, you perform a similar analysis on his networked, off-site computer. Take a minute to consider forensic evidence in networks. Your supervisor confirms that the suspect's remote office is closed for the weekend, so you are free to image his computer via the network to store the digital evidence. The remote computer is locked, but the company IT department has provided an administrator password for your investigation. Using your forensic workstation at headquarters, you log on to the remote system. If the image were going to pass unencrypted over an untrusted network (such as the internet), you'd would want to conduct the transfer over SSH, but since you're on the company network and connecting to the remote office via a VPN, you can use the dd command to transfer a copy of the remote hard drive to your local workstation using the netcat tool. Review the lab instructions in the box below, and then go to the virtual lab. Follow the steps required to image the computer over the network. Complete This Lab Resources · Accessing the Virtual Lab Environment: Navigating UMGC Virtual Labs and Lab Setup · Self-Help Guide (Workspace): Getting Started and Troubleshooting · Link to the Virtual Lab Environment: https://vdi.umgc.edu/ Lab Instructions · Imaging Over a Network Getting Help To obtain lab assistance, fill out the support request form. Make sure you fill out the fields on the form as shown below: · Case Type: UMGC Virtual Labs Support · Customer Type: Student (Note: faculty should choose Staff/Faculty) · SubType: ELM-Cyber (CST/DFC/CBR/CYB) · SubType Detail: Pick the category that best fits the issue you are experiencing · Email: The email that you currently use for classroom communications In the form's description box, provide information about the issue. Include details such as steps taken, system responses, and add screenshots or supporting documents. Review your lab notes
Answered 15 days AfterJan 28, 2022

Answer To: Project 2: Computer Architecture and Imaging Step 1: Brief the Legal Team on Forensics Before you...

Amit answered on Feb 12 2022
124 Votes
Title of the assignment:
Student’s name:
Student ID:
Professor’s name:
Course title:
Date: 2/12/2022
Table of Contents
1.    Step 1: Memo for legal team on Forensics    3
2.    Step 2: Image a USB Drive using Linux Tools    5
3.    Step 3: Image a USB Drive using Windows Tools    10
4.    Step 4: Respond to questions from Legal team    16
1.    Answer to question 1 of legal team    16
2.    Answer to question 2 of legal team    17
3.    Answer to question 3 of legal team    18
4.    Answer to question 4 of legal team    19
5.    Step 5: Acquire RAM and Swap Space    19
6.    Step 6: Forensic Imaging over a network    2
2
7.    Conclusion    26
8.    References:    27
1. Step 1: Memo for legal team on Forensics
To: Legal Team members
From: Forensic analyst
Subject: Memo on examined digital media and possible storage formats
Date: Saturday, February 12, 2022
Dear forensic team,
The forensic analysis is carried out for finding the digital evidences which may be used for any legal or organizational purposes. It involves analysis of different digital media like pen drive, hard disk etc. The data can be stored in different formats like AFF, EWF and each format maintains its advantages and disadvantages. The data theft is very commonly occurred thing in modern time and person inside the organization are mostly responsible for it. The users mostly makes use of pen drives or other disk drives for performing data theft activities. The use of portable media like pen drive allows easy theft operations for the confidential data. Each becomes very critical for the client organization to prevent any data theft operations especially when the insider is conducting such theft related activity.
The pen drive is most commonly used device for performing data theft operation and pen drive is examined for conducting the forensic analysis with help of tools like FTK Imager, Autopsy etc. on different operating systems like Windows and Linux. The selected data source ( pen drive) maintains data as evidence of different types. This data includes MS office files like world file, excel file or images.
The organizational data is always considered as the confidential data and it requires to be prevented from all possible attacks. Any possible data theft activity can cause huge losses to the client organization. Most of the organizations makes implementation of 2-level security and implementation of encryption for preventing such incidents. Even after implementing such high level of security, the data theft operations are carried out by the attackers and insiders.
The digital evidences are mostly stored in AFF and E01 format. The advantages of storing data in AFF format are:
· This is a flexible format in which meta data of images and other formats can be stored collectively for forensic analysis.
· This is most suitable format for storing image based evidences.
· Very less amount of disk space is consumed for storing the digital evidences.
The AFF format also maintains certain disadvantages and these are:
· The forensic analysis with this type of digital evidence can lead to false positive results.
· It is good for image based evidence but not suitable for other formats of evidences.
Like AFF, the E01 is also most commonly used format for storing the digital evidences and its advantages are:
· It is an industrial format in which the forensic analysis can be carried out without decompressing the data or evidence.
· The forensic analysis and recovery of deleted files can easily be done with this format.
· The inbuilt checksum capabilities makes it better format to store digital evidences.
The E01 format also maintains certain disadvantages and these are:
· The data structure of the digital evidences can be compromised with this format.
· This is not an open format and mostly used for legal purposes only.
The collection of forensic images for conducting the forensic analysis is a critical task. These digital images are mostly collected from the suspicious system from which the possible theft activity is occurred. This includes remote systems, hard drives and emails.
2. Step 2: Image a USB Drive using Linux Tools
The forensic analysis can be carried out with on different operating systems like Windows and Linux. The Autopsy is a powerful forensic analysis tool which is mostly used for Linux based operating system. The high capabilities of Autopsy allows easy forensic analysis of USB drive on Linux platform. This is a very extensible and easy tool which is most commonly used on Linux platform for completing the forensic analysis. It provide easy steps to the analyst for completing the forensic analysis of supplied digital evidence. The hash filtering and time line based analysis capabilities of this tool makes it one of the best tool suitable for the Linux platform. The keyword based search is also allowed by this tool. The discovery of web and data artifacts along with multimedia makes it powerful tool for forensic analysis. This is a cost effective tool which provides very fast results for forensic analysis to the analysts. The investigation of hard drive like USB drive based evidences is easily performed with this tool. This tool provides support to both Linux as well as Windows based platforms. The investigation of network based digital evidences can also be carried out with Autopsy on Linux platform. The digital evidences are created and stored on the USB drive for completing the forensic analysis. The detailed steps for completing the forensic analysis of USB drive with Autopsy tool on Linux platform are provided underneath:
1. The Autopsy is started on the Linux platform and a new case is created:
2. Now the case name is provided and base directory for storing the forensic analysis information is selected.
3. As we are using USB disk based data for completing the forensic...
SOLUTION.PDF

Answer To This Question Is Available To Download

Related Questions & Answers

More Questions »

Submit New Assignment

Copy and Paste Your Assignment Here