Digital Forensics Investigation of Clowns' Content

Table of Contents
1 Summary............................................................................................................................2
2 Presentation of content relating to offence.....................................................................2
3 Identification.....................................................................................................................4
4 Intent................................................................................................................................11
5 Quantity of Files..............................................................................................................16
6 Installed Software...........................................................................................................24
References...............................................................................................................................24
1

1 Summary
Primary focus of this project is look into the progressed advanced crime scene investigation
images by using reasonable instrument. Basically, domain of Western Australia does not offer access
to electronic substance related to clowns since it is illegal access, guarantee and flow the propelled
substance related to clowns. The clowns' modernized substance are gotten to by malware. Thusly, this
examination is prerequisites to look into the propelled substance related to the clowns. Generally, the
charge was make the law approval where by a spectator claims to get to the clowns related data inside
a work put. In any case, some humourist’s substance are gotten to without the work put.
Unfortunately, junior propelled specialist got the computerized crime scene investigation photo of the
PC that is clowns substance played out a real anchoring. Along these lines, this situation the lesser
progressed advanced legal sciences analyst wiped the main hard drive from the PC. Since, the
predictable anchoring is done by forensically strong way. Thusly, the lesser authority easily chose the
lawful picture. The suspect, Clark demies the getting to the humourist content and besides Clark does
not confirm that the PC has a place with him. The Clark says, he doesn't for the most part take the PC
home or jolt it. Thusly, senior analyst needs to review the lawful photo of the lap which was seized
with right warrants. Likewise, furthermore Clark express the PC was defiled with malware that
achieved different potential substance appearing on the PC. This examination is done by using the
after death examination advanced crime scene investigation instrument. The examination will be done
and discussed in detail.
2 Presentation of content relating to offence
Here, customer needs to give the presentation of substance relating to the offense. The gave
logical examination communicated that the charge was make the law prerequisite where by an
eyewitness declares to get to the clowns related data inside a work put. Unfortunately, junior pushed
master got the modernized crime scene examination photo of the PC that is clowns substance played
out a real anchoring. Thusly, this circumstance the Junior examiner wiped the principle hard drive
from the PC. Since, the anticipated tying down is finished by forensically solid way. Thusly, the
junior inspector easily chose the criminological image. Thusly, senior inspector needs to investigate
the quantifiable photo of the lap which was seized with right warrants. This examination is done by
using the dissection criminology device.
7 Zip extraction
2

In 7 zip extraction, we are successfully extract the provided casefile. After, we are requires to
download and install the autopsy tool. The autopsy installtion is completed, after open the autospy
tool and click the new case. This process is illustrated as below (Boddington, 2016).
After, enter the case information to create the new case. So, here user needs to enter the case name
and save the case file to browse the directory. Then click the next button to enter the required
information to create the new case file. After, user enter the required information like case number.
Once case number is entered, after click the finish button create the case file (Casey, 2012).Once, case
file is created successfully, then add the data source on the case. Here, we are having the raw bit data.
So, choose the unallocated disk image. Then, select the forensic images files to browse the
appropriate folder. After click next button. This process is shown below (CYBERCRIME AND
DIGITAL FORENSICS, 2018).
After, configure the provided case file to ingest modules. Then, click the next button.
At last, user successfully added the data sources for newly created case file. This process is
demonstrated as below.
Similarly, add provided all the forensics image to the digital forensics case (Duranti & Endicott-
Popovsky, 2010).
Once, data sources are added into the created case after user needs to identify the evidence for digital
forensics investigation.
3

3 Identification
Here, we are identify the forensics image file information to proceed the digital forensics analysis.
182.7z.002 Case File Identification
Click appropriate data file to identify the case file information (Flory, 2016). This case file has only
one deleted file which is demonstrated as below.
The following details is used to display the deleted file details on the case file (Garfinkel, 2011).
This case file contains the some keyword search information like email address, single regular
expression and single literal keyword search. The email address key search file consist of three files
and it is illustrated as below.
The following details is used to display the given case file results.
182.7z.003 Case File Identification
Click appropriate data file to identify the case file informatio(Gogolin, 2013). This case file has only
one deleted file which is demonstrated as below.
The following details is used to display the deleted file details on the case file (Hannay, 2011).
This case file contains the some keyword search information like email address, single regular
expression and single literal keyword search. The email address key search file consist of three files
and it is illustrated as below.
4

The following details is used to display the given case file results.
182.7z.004 Case File Identification
Click appropriate data file to identify the case file information. This case file has only one deleted file
which is demonstrated as below.
The following details is used to display the deleted file details on the case file.
This case file contains the some keyword search information like email address, single regular
expression and single literal keyword search. The email address key search file consist of three files
and it is illustrated as below.
The following details is used to display the given case file results.
182.7z.005 Case File Identification
Click appropriate data file to identify the case file information. The provided the case file has the one
deleted file.
The following details is used to display the deleted file details on the case file.
5

The following details is used to display the given case file results.
182.7z.006 Case File Identification
Click appropriate data file to identify the case file information. This case file has only one deleted file
which is demonstrated as below.
The following details is used to display the deleted file details on the case file.
This case file contains the some keyword search information like email address, single regular
expression and single literal keyword search. The email address key search file consist of three files
and it is illustrated as below.
The following details is used to display the given case file results.
182.7z.007 Case File Identification
Click appropriate data file to identify the case file information. This case file has only one deleted file
which is demonstrated as below.
6