Forensics Procedures or Methodology

1. Establish Chain of custody

2. Verify hash value of the image

3. Identify Drive information

4. Examine NT user Data (Tom or/and Leslie)

5. Search through the folders for each user

6. Examine Cookies/ Desktop/Recent Folders

7. Search Email ( Internet/email search)

8. Examine History/ Web cache Files

9. Keyword search List

10. Bookmark all the evidence findings ( highly recommend bookmark your

findings based on the checklist information below – create one folder for each

grading option(s) )

11. Draft a Computer Examiners Report of your findings using the following report

writing format or the Report Format provided by your Professor:

Write a Digital Forensics Report:

Your report should consist of the following items or use the Report

Format provided by your Professor :

Computer Forensics Examiner Report

1. Introduction (Explain how you got the case & what you were requested to examine) 1

st paragraph

2. Examination Summary (Give an Overview explanation of what you found in

relationship to the case investigation. Use at least two-three paragraphs for each

disk that you examined e.g. Leslie Disk: On the Leslie Disk I discovered several

files relating to plans that Leslie was making with Tom to ….; Tom Disk: On the

Tom Disk I discovered files relating to concerns that Tom had regarding his….. )

3. File Details (Highlight the top 5-7) important files you discovered and analyzed in

this case e.g. in un-allocated space, deleted files, photos, etc.

a. List each important file by name using a * bullet point and give a brief caption

description of what the file represents

Example:

* proposal.pdf

This file contains a business proposal marked for dynamic solutions marked

“confidential”

b. List each graphic file by thumbnail and name using a * bullet point and give a

brief caption description of what the graphic file represents

 network6s.jpg

This photo contains a photograph of the internal network connection for

lab ST-109

4. Steps Taken (List and Explain how examination was conducted)

 i.e. A forensic image of the hard disk was made using Encase or WinHex.

An MD 5 hash was generated.

 Describe step by step procedure taken during the examination

5. Exhibits (List Exhibits by File Type e.g. Documents, Images, Excel, etc.)

Example:

Exhibit 1 contains recovered text file documents obtained from the hard disk

Exhibit 2 contains recovered images files obtained from the hard disk.

6. Chain of Custody (Document where & how media was obtained, processed and

stored)

Example:

The Seagate hard disk No. AW37Z81 was received by Fed Ex Shipping No.

1234569 and stored in the locked evidence bin/drawer #1.

A forensic image of the original hard disk forensic was made and the original was

returned to evidence bin/drawer #1.

An examination was conducted on the forensic hard disk image copies.

The original Seagate hard disk No. AW37Z81 was returned to the Sunshine

Company by FED Ex Shipping No. WBX90172 after completion of the

examination.

EXAMINATION CHECKLIST

Things you can find on the evidence drives:

1. Information showing Tom’s excitement at the proposal of getting promoted

2. Information showing Tom’s concerns

3. Information showing Tom’s meeting with Mr. Melonis of

Saspah Software

4. Leslie browsing the Internet for vocation deals

5. Information about how Tom and Leslie felt that the company owes them.

6. Leslie searching for embezzlement schemes on the Internet

7. Leslie creating a second set of “Books” (the Excel sheet)

8. Leslie emailing Tom links she found on the Internet

9. Leslie computer accessed file that were never on her computer

From a USB drive (optional)

10. Information showing how discussions about they might use the accounts

11. Information showing Tom and Leslie’s romance

12. Report should include your name, course number, date, your formatted examining

of findings.

Note: Your report should represent a polished work product you would be proud of using in

your portfolio for purposes of securing an entry level job or promotion.