Case investigation and recommendation report (30% of overall assessment) Tools required

1. Autopsy or The Sleuth Kit (TSK). Available:
https://sleuthkit.org/

2. Download the hard drive images required for this activity from the following link.

https://drive.google.com/drive/u/0/folders/1Nzs3baa4KayJthlMU0CLSwC8_y0z7N4t

3. Use MD5 and SHA to check for evidence integrity. Check the text files for the hash values.

4. Set timezone as (GMT- 4:00) America/New York

5. Download a copy of Win10 iso from the following link.

https://drive.google.com/drive/folders/1gNZNI2ysG2pEHT
-
Gf_z8RjmQ4g
-
9qHJt?usp=sharing

Forensic Challenge 1

Scenario

Susie Stapleton has gone missing for 3 days. Her family is worried sick. A police officer has acquired an image of her hard drive.
Use the ntfs.dd disk image for this challenge.

1. Look through her user profile to find any pictures that might reveal where she is.

2. Bookmark any photos you find that you deem to be relevant

3. Prepare a forensic report with relevant evidence and justification, incorporating the Digital Forensics Process.

Forensic Challenge 2

Scenario

Jimmy Jamison has been arrested for stealing credit cards. He has used five different credit cards that were not his. A police officer has acquired an image of his hard drive.
Use the case2.dd.gz disk image for this challenge.

1. Look through his user profile to find any documents that Jimmy had

2. Export the documents and view them to determine if credit card info is present

3. Bookmark any documents that you deem to be relevant

4. Prepare a forensic report with relevant evidence and justification, incorporating the Digital Forensics Process.