Computer Forensics: Investigation of Advanced Digital Crime Scene Examination Images

This project focuses on investigating advanced digital crime scene examination images using forensic tools. The investigation involves accessing and protecting digital content related to clowns, which is illegal in Western Australia. The investigation is carried out using digital forensics tools and involves identifying and analyzing deleted files and keyword searches. The section also includes instructions on using 7-zip and Autopsy software tools.

Computer Forensics
Unit Number:
Unit Name:
Student Name:
Student Number:

Table of Contents
1 Summary of the Project...................................................................................................2
2 Presentation of content relating to offence.....................................................................2
3 Identification.....................................................................................................................9
4 Intent................................................................................................................................47
5 Quantity of Files..............................................................................................................69
6 Installed Software...........................................................................................................89
7 Appendix – A...................................................................................................................90
8 Appendix - B....................................................................................................................91
References...............................................................................................................................93
1

1 Summary of the Project
Essential focal point of this project is investigate the advanced propelled crime scene
examination images by utilizing sensible tool. Essentially, space of Western Australia does
not offer access to electronic substance identified with comedians since it is illegal access,
assurance and stream the impelled substance identified with clowns. The comedians'
modernized substance are gotten to by malware. In this manner, this examination is essentials
to investigate the impelled substance identified with the clowns. By and large, the charge was
make the law endorsement where by an witness professes to get to the comedians related
information inside a work put. Regardless, some humourist's substance are gotten to without
the work put. Shockingly, junior impelled pro got the modernized wrongdoing scene
examination photograph of the PC that is comedians substance played out a genuine mooring.
Thusly, this circumstance the lesser advanced progressed legitimate sciences examiner wiped
the primary hard drive from the PC. Since, the anticipated securing is finished by forensically
solid way. Along these lines, the lesser specialist effortlessly picked the legal picture. The
suspect, Clark demies the getting to the humourist content furthermore Clark does not affirm
that the PC has a place with him. The Clark says, he doesn't generally take the PC home or jar
it. In this manner, senior investigator needs to audit the legal photograph of the lap which was
seized with right warrants. In like manner, moreover Clark express the PC was debased with
malware that accomplished distinctive potential substance showing up on the PC. This
examination is finished by utilizing the after death examination propelled wrongdoing scene
examination instrument. The examination will be done and talked about in detail.
2 Presentation of content relating to offence
Here, user needs to give the introduction of substance identifying with the offense. The
gave appropriate examination imparted that the charge was make the law essential where by
an witness announces to get to the clowns related information inside a work put. Shockingly,
junior pushed excellent got the modernized offense scene examination photo of the PC that is
clowns substance played out a genuine anchoring. Consequently, this situation the Junior
analyst wiped the rule hard drive from the PC. Since, the foreseen secures is done by
forensically strong way. In this manner, the junior investigator effectively picked the
criminological picture. Along these lines, senior examiner needs to explore the quantifiable
2

photograph of the lap which was seized with right warrants. This examination is finished by
utilizing the digital forensics tool.
Extraction of 7 Zip
Here, user needs to use the 7 zip to extract the provided case file. To extract the case file by
using the below steps.
 First, user needs to download and install the 7 zip software.
 Once installtion is completed successfully, after user needs to open the 7 zip to click
the file to open the all provided case file.
 Then, select the all the files and right click the files to click the 7 zip to choose the
extract option.
 After, all the files are extracted into one file.
This processes are demostrated as below.
3

4

At lasy, user successfully extracted the given case file.
Then, user needs to download and install the autospy software tool because this tool is used
to provide the effective investigation for digital forensics investigation. Basically, this tool
easily analysis the case file by using the key word search and ingest modules. These two
options are very useful to analysis the provided case file. The autopsy installation is
completed successylly, open the autopsy to click new case which is illustrated as below.
After, the new case windows is open which contains the following information such as case
name, base directory and case type. Here, we are enter the case name as digital forensics, the
base directory is used to save the case file. So, browse the directory to save the case file.
5

After choose the case type as single user. Then, click the next. This processes are illustrated
as below.
The user is required to fill the necessary information such as case number. After, enter this is
it required to press on the button, Finish and this will create a case file as demonstrated in the
following figure.
6

After the creation of a case file, on the case add the data source. It contains raw bit data thus
it is suggested to select the disk image which is unallocated, as demonstrated in the following
figure.
Then, browse and choose forensic images files and press the button, Next, as demonstrated in
the following figure (CYBERCRIME AND DIGITAL FORENSICS, 2018).
7

Later, it is required to configure the given case file in the ingest modules and press on the
button, Next.
Finally, for the newly created case file the data sources are added, as demonstrated in the
following figure.
8

Likewise, all the given forensics image must be added to the digital forensics case (Duranti &
Endicott-Popovsky, 2010).
9

After all the data sources are included in the created case, the user must identify the evidence
which is related to the investigation of digital forensic.
3 Identification
In this section, the forensics image file information will be identified, for proceeding
the analysis of digital forensics.
182.7z.002 Case File Identification
Choose appropriate data file for identifying the information of the case file, as
demonstrated in the following figure (Flory, 2016).
10

Just a single deleted file is available in this case file, as illustrated in the following figure.
For displaying the details of the deleted file, the following details are utilized (Garfinkel,
2011).
11

This is a case file that comprises of certain keyword search information such as, single
regular expression, single literal keyword search and email address. The following figure
displays the three files from the email address key search file.
The below table represents the details that are utilized for displaying the provided case file’s
outcome.
12

182.7z.003 Case File Identification
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure (Gogolin, 2013).
Just a single deleted file is available in this case file, as illustrated in the following figure.
13

The below table represents the details of the deleted files from the case file (Hannay, 2011).
This is a case file that comprises of certain keyword search information such as, email
address, single regular expression and single literal keyword search. The following figure
displays the three files from the email address key search file.
14

The following table displays the result details of the provided case file.
15

182.7z.004 Case File Identification
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
Just a single deleted file is available in this case file, as shown in the following figure.
16

The below table represents the details related to the provided results of the case file.
17

This is a case file that comprises of certain keyword search information such as, single
regular expression, email address and a single literal keyword search. The following figure
displays the three files from the email address key search file.
18

The following table displays the result details of the provided case file.
182.7z.005 Case File Identification
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
19

Only one deleted file is available in the given case file.
The below table represents the deleted files’ detail, from the case file.
20

The following table displays the result details of the given case file.
182.7z.006 Case File Identification
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
21

Only one deleted file is available in the given case file.
The below table represents the details of the deleted files from the case file
22

Here is a case file that comprises of certain keyword search information such as, single
regular expression, email address and a single literal keyword search. The following figure
displays the three files from the email address key search file.
23

The following table displays the result details of the provided case file.
182.7z.007 Case File Identification
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
24

Only one deleted file is available in the given case file.
The below table represents the details of the deleted files from the case file.
25

Here is a case file that comprises of certain keyword search information such as, single
regular expression, email address and a single literal keyword search. The following figure
displays the three files from the email address key search file.
26

The below table displays the results of the given case file.
182.7z.008 Case File Identification
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
27

Just a single deleted file is available in this case file, as illustrated in the following figure.
28

The below table represents the details of the deleted files from the case file.
Here is a case file that comprises of certain keyword search information such as, single
regular expression, email address and a single literal keyword search. The following figure
displays the three files from the email address key search file.
29

The following table represents the result details related to the given case file.
182.7z.009 Case File Identification
Select the appropriate data file for identifying the information of the case file, as
demonstrated in the following figure.
30

Only one deleted file is available in the given case file.
The below table represents the details of the deleted files from the case file.
31

182.7z.010 Case File Identification
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
Only one deleted file is available in the given case file.
32

The below table represents the details of the deleted files from the case file.
Here is a case file that comprises of certain keyword search information such as, single
regular expression, email address and a single literal keyword search. The following figure
displays the three files from the email address key search file.
33

The below table displays the results of the given case file.
182.7z.011 Case File Identification
Select an appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
34

Only one deleted file is available in the given case file.
The below table represents the details of the deleted files, from the case file.
35

Here is a case file that comprises of certain keyword search information such as, single
regular expression, email address and a single literal keyword search. The following figure
displays the three files from the email address key search file.
36

The below table displays the results of the given case file.
182.7z.012 Case File Identification
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
37

Only one deleted file is available in the given case file, as illustrated in the following figure.
The following details is used to display the deleted file details on the case file.
38

Here is a case file that comprises of certain keyword search information such as, single
regular expression, email address and a single literal keyword search. The following figure
displays the three files from the email address key search file.
39

The following table represents the result details related to the given case file.
182.7z.013 Case File Identification
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
40

Only one deleted file is available in the given case file, as illustrated in the following figure.
The below table represents the details of the deleted files from the case file.
41

Here is a case file that comprises of certain keyword search information such as, single
regular expression, email address and a single literal keyword search. The following figure
displays the three files from the email address key search file.
42

The following table represents the result details related to the given case file.
182.7z.014 Case File Identification
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
43

Only one deleted file is available in the given case file, as illustrated in the following figure.
44

The below table represents the details of the deleted files from the case file.
182.7z.015 Case File Identification
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
Only one deleted file is available in the given case file, as illustrated in the following figure.
45

The below table represents the details of the deleted files from the case file.
46

4 Intent
It is needed that the investigator has to indent the given digital content that are used,
accessed and deleted the files. This following section will demonstrate the processes for
displaying the details of the deleted files.
182.7z.002 Case File Indent
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure (Larson, 2014).
Only one deleted file is available in the given case file, as illustrated in the following figure.
47

The below table represents the details of the deleted files from the case file.
182.7z.003 Case File Indent
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
48

Only one deleted file is available in the given case file, as illustrated in the following figure.
The below table represents the details of the deleted files from the case file (Marshall, 2009).
49

182.7z.004 Case File Indent
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
50

Only one deleted file is available in the given case file, as illustrated in the following figure.
The below table represents the details of the deleted files from the case file.
182.7z.005 Case File Indent
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
51

Only one deleted file is available in the given case file, as illustrated in the following figure.
The below table represents the details of the deleted files from the case file.
52

182.7z.006 Case File Indent
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure (Parasram, n.d.).
53

Just a single deleted file is available in this case file, as illustrated in the following figure.
The below table represents the details of the deleted files from the case file.
182.7z.007 Case File Indent
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
54

Only one deleted file is available in the given case file, as illustrated in the following figure
(Pollitt & Shenoi, 2010).
The below table represents the details of the deleted files from the case file.
55

182.7z.008 Case File Indent
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
56

Only one deleted file is available in the given case file, as illustrated in the following figure.
The below table represents the details of the deleted files from the case file.
182.7z.009 Case File Indent
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
57

Only one deleted file is available in the given case file, as illustrated in the following figure
(Ray & Shenoi, 2011).
The below table represents the details of the deleted files from the case file.
58

182.7z.010 Case File Indent
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
59

Only one deleted file is available in the given case file, as illustrated in the following figure.
The below table represents the details of the deleted files from the case file (Sammons, 2015).
60

182.7z.011 Case File Indent
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
Only one deleted file is available in the given case file, as illustrated in the following figure.
61

The below table represents the details of the deleted files from the case file.
182.7z.012 Case File Indent
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
62

Only one deleted file is available in the given case file, as illustrated in the following figure.
The below table represents the details of the deleted files from the case file.
63

182.7z.013 Case File Indent
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
Only one deleted file is available in the given case file, as illustrated in the following figure.
64

The below table represents the details of the deleted files from the case file.
182.7z.014 Case File Indent
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
65

Only one deleted file is available in the given case file, as illustrated in the following figure.
The below table represents the details of the deleted files from the case file.
66

182.7z.015 Case File Indent
Click the appropriate data file for identifying the information of the case file, as demonstrated
in the following figure.
Only one deleted file is available in the given case file, as illustrated in the following figure.
67

The below table represents the details of the deleted files from the case file.
68

5 Quantity of Files
For determining the number of files presented in the system, the forensics image file
is used. The below section demonstrates this determination process.
182.7z.002 Quantity of Case File
The user must click on an appropriate data file for identifying the information of the case file,
such as quantity, as demonstrated in the following figure.
The provided case file contains email address key search which has three files, as represented
in the following figure.
69

182.7z.003 Quantity of Case File
The user must click on an appropriate data file for identifying the information of the case file,
such as quantity, as demonstrated in the following figure.
Only one deleted file is available in the given case file, as illustrated in the following figure.
The provided case file contains email address key search which has three files, as represented
in the following figure.
70

182.7z.004 Quantity of Case File
The user must click on an appropriate data file for identifying the information of the case file,
such as quantity, as demonstrated in the following figure.
Only one deleted file is available in the given case file, as illustrated in the following figure.
71

The provided case file contains email address key search which has two files, as represented
in the following figure.
72

182.7z.005 Quantity of Case File
The user must click on an appropriate data file for identifying the information of the case file,
such as quantity, as demonstrated in the following figure.
Only one deleted file is available in the given case file, as illustrated in the following figure.
On the system, the case file doesn’t contain any file
182.7z.006 Quantity of Case File
73

The user must click on an appropriate data file for identifying the information of the case file,
such as quantity, as demonstrated in the following figure.
Only one deleted file is available in the given case file, as illustrated in the following figure.
The provided case file contains email address key search which has two files, as represented
in the following figure.
74

182.7z.007 Quantity of Case File
The user must click on an appropriate data file for identifying the information of the case file,
such as quantity, as demonstrated in the following figure.
75

Only one deleted file is available in the given case file, as illustrated in the following figure.
The provided case file contains email address key search which has just one file, as
represented in the following figure.
76

182.7z.008 Quantity of Case File
The user must click on an appropriate data file for identifying the information of the case file,
such as quantity, as demonstrated in the following figure.
77

Only one deleted file is available in the given case file, as illustrated in the following figure.
The provided case file contains email address key search which has just one file, as
represented in the following figure.
78

182.7z.009 Quantity of Case File
The user must click on an appropriate data file for identifying the information of the case file,
such as quantity, as demonstrated in the following figure.
79

Only one deleted file is available in the given case file, as illustrated in the following figure.
On the system, the case file doesn’t contain any file.
182.7z.010 Quantity of Case File
The user must click on an appropriate data file for identifying the information of the case file,
such as quantity, as demonstrated in the following figure.
80

Only one deleted file is available in the given case file, as illustrated in the following figure.
The provided case file contains email address key search which has one file, as represented in
the following figure.
81

182.7z.011 Quantity of Case File
The user must click on an appropriate data file for identifying the information of the case file,
such as quantity, as demonstrated in the following figure.
82

Only one deleted file is available in the given case file, as illustrated in the following figure.
The provided case file contains email address key search which has one file, as represented in
the following figure.
83

182.7z.012 Quantity of Case File
The user must click on an appropriate data file for identifying the information of the case file,
such as quantity, as demonstrated in the following figure.
84

Only one deleted file is available in the given case file, as illustrated in the following figure.
The provided case file contains email address key search which has three files, as represented
in the following figure.
182.7z.013 Quantity of Case File
Here, user needs to click appropriate data file to identify quantity the case file information
and it is shown below.
85

Only one deleted file is available in the given case file, as illustrated in the following figure.
The provided case file contains email address key search which has two files, as represented
in the following figure.
86

182.7z.014 Quantity of Case File
The user must click on an appropriate data file for identifying the information of the case file,
such as quantity, as demonstrated in the following figure.
87

Only one deleted file is available in the given case file, as illustrated in the following figure.
The case file doesn’t contain any file on the system.
182.7z.015 Quantity of Case File
The user must click on an appropriate data file for identifying the information of the case file,
such as quantity, as demonstrated in the following figure.
88

Only one deleted file is available in the given case file, as illustrated in the following figure.
The case file doesn’t contain any file on the system.
Finally, the digital forensics investigation is utilized for delivering the details of forensics
images which are raw bit data. The given case file comprises of only one deleted file and has
various email key word search files. A third party is used for illegal access.
6 Installed Software
This investigation didn’t install any software on the system (Steel, 2014).
89

7 Appendix – A
What did you? How did you do it Outcomes
Extract the provided case
file.
Using 7 Zip The provided case file is
successfully extracted.
Create New case on
Autopsy tool.
 Enter the case name,
number and Browser the
directory to save the case
file.
Case file successfully created.
Add data source on created
new case.
 Click the add data source
and browse the data
source folder.
 After, select the all the
provided data file.
Data source is successfully
added.
After identified, extracted
and analysed on the
provided case file.
 By Choose appropriate
data file for identifying
the information of the
case file.
 Just a single deleted file is
available in this case file
Successfully investigator
identified, extracted and
analysed the given case file.
Then, It is needed that the
investigator has to indent
the given digital content that
are used, accessed and
deleted the files.
 Click the appropriate data
file for identifying the
information of the case
file.
 Only one deleted file is
available in the given
case file.
Successfully investigator intent
the digital content on the given
case file.
For determining the number
of files presented in the
system, the forensics image
file is used
 The user must click on an
appropriate data file for
identifying the
information of the case
file, such as quantity.
 The provided case file
contains email address
Successfully investigator
determine the quantity of files
on the provided case file.
90

key search which has
three files.
Finally, determine the
installed software on the
system.
 Click the appropriate data
file for identifying the
information of the case
file.
 View the all the folders
and file.
This investigation didn’t install
any software on the system
8 Appendix - B
Timeline Events for the given case file is shown below.
Timeline
Event
number
What did you? How did you do it Outcomes
1. Extract the provided
case file.
Using 7 Zip The provided case file is
successfully extracted.
2. Create New case on
Autopsy tool.
 Enter the case name,
number and Browser
the directory to save
the case file.
Case file successfully
created.
3. Add data source on
created new case.
 Click the add data
source and browse the
data source folder.
 After, select the all
the provided data file.
Data source is successfully
added.
4. After identified,
extracted and analysed
on the provided case
file.
 By Choose
appropriate data file
for identifying the
information of the
case file.
 Just a single deleted
file is available in this
Successfully investigator
identified, extracted and
analysed the given case
file.
91

case file
5. Then, It is needed that
the investigator has to
indent the given digital
content that are used,
accessed and deleted the
files.
 Click the appropriate
data file for
identifying the
information of the
case file.
 Only one deleted file
is available in the
given case file.
Successfully investigator
intent the digital content
on the given case file.
6. For determining the
number of files
presented in the system,
the forensics image file
is used.
 The user must click
on an appropriate data
file for identifying the
information of the
case file, such as
quantity.
 The provided case
file contains email
address key search
which has three files.
Successfully investigator
determine the quantity of
files on the provided case
file.
7. Finally, determine the
installed software on the
system.
 Click the appropriate
data file for
identifying the
information of the
case file.
 View the all the
folders and file.
This investigation didn’t
install any software on the
system
92
Extract the
provided case
file Using 7 Zip
After identified,
extracted and
analysed on the
provided case file
Then, it is needed that the
investigator has to indent the
given digital content that are
used, accessed and deleted
the files.

References
Boddington, R. (2016). Practical Digital Forensics. Packt Publishing.
Casey, E. (2012). Cloud computing and digital forensics. Digital Investigation, 9(2), 69-70.
doi: 10.1016/j.diin.2012.11.001
93
Timeline Events
Finally, determine
the installed
software on the
system.
Create new case
on Autopsy tool
and Add data
source on created
new case.
For determining the
number of files presented
in the system, the
forensics image file is
used.

CLANRYE INTL. (2018). CYBERCRIME AND DIGITAL FORENSICS. [S.l.].
Duranti, L., & Endicott-Popovsky, B. (2010). Digital Records Forensics: A New Science and
Academic Program for Forensic Readiness. Journal Of Digital Forensics, Security And
Law. doi: 10.15394/jdfsl.2010.1075
Flory, T. (2016). Digital Forensics in Law Enforcement: A Needs Based Analysis of Indiana
Agencies. Journal Of Digital Forensics, Security And Law. doi:
10.15394/jdfsl.2016.1374
Garfinkel, S. (2011). Column: File Cabinet Forensics. Journal Of Digital Forensics, Security
And Law. doi: 10.15394/jdfsl.2011.1103
Gogolin, G. (2013). Digital forensics explained. Boca Raton, FL: CRC Press.
Hannay, P. (2011). Kindle Forensics: Acquisition & Analysis. Journal Of Digital Forensics,
Security And Law. doi: 10.15394/jdfsl.2011.1093
Larson, S. (2014). The Basics of Digital Forensics: The Primer for Getting Started in Digital
Forensics. Journal Of Digital Forensics, Security And Law. doi:
10.15394/jdfsl.2014.1165
Marshall, A. (2009). Digital Forensics. Chichester: John Wiley & Sons.
Parasram, S. Digital Forensics with Kali Linux.
Pollitt, M., & Shenoi, S. (2010). Advances in digital forensics. New York:
Springer/International Federation for Information Processing.
Ray, I., & Shenoi, S. (2011). Advances in digital forensics IV. New York: Springer.
Sammons, J. (2015). The basics of digital forensics. Amsterdam: Syngress Media.
Steel, C. (2014). Idiographic Digital Profiling: Behavioral Analysis Based On Digital
Forensics. Journal Of Digital Forensics, Security And Law. doi:
10.15394/jdfsl.2014.1160
94