Digital Forensic Investigation of Forensic Images

This project aims to conduct digital forensic investigation of forensic images related to clown content. The case file identification process, deleted files information and goals of the case file are presented in this text. The text also provides information on software installation and presentation of offence related content.

Table of Contents
1 Project’s Scope..................................................................................................................2
2 Presentation of Offence related content..........................................................................2
3 Case file Identification......................................................................................................3
4 Goals of the case file........................................................................................................12
5 Quantity of the Files.......................................................................................................17
6 Software Installed...........................................................................................................23
References...............................................................................................................................24
1

1 Project’s Scope
The primary target of the following project refers to carry digital forensic investigation
of the forensic images. To conduct this investigation an effective tools is necessary. The
Western Australia states have not given the access of digital content related to clown, due to
illegal access, or for owning and distributing the digital content related to the clowns. To
access the digital content of the clown the malware is used and the following investigation
also requires digital content’s investigation which is related to the clowns. It was claimed that
the law enforcement is created where the witness asserts to access the clown related data
inside the organization’s workplace. But, there are certain actions, where specific content of
the clown is accessed without being in the organization’s workplace. The observation shows
that the original hard drive is wiped out by the junior digital forensics investigator and the he
has performed a good job with sound forensic investigation knowledge. Here, Clart is
assumed to be the suspect, who accessed the clown content. Yet, it is not confirmed that the
laptop belongs to Clark. It is required that the investigator evaluate the laptop’s forensic
image. It is stated by Clark that the malware infected the laptop, which allowed the potential
content to appear on it.
2 Presentation of Offence related content
The offence related content’s presented must be provided by the user. Here, the
allegations refer to creating the law enforcement, as claimed by the witness claims to access
the clowns related data inside the organization’s workplace. But, certain content of the clown
are accessed without being in the workplace of the organization. Moreover, the junior digital
investigator receive the forensics image of the laptop which has content of the clown that has
performed logical acquisitions. From the system, the original hard drive is wiped out by the
junior digital forensics investigator and the he has performed a good job with sound forensic
investigation knowledge (Boddington, 2016). Thus, being a senior digital forensic
investigator, I have to seize the laptop with the orders of the court and conduct better
investigation.
7 Zip Extraction
The give case file is extracted here, for which 7 zip must be utilized by the user.
The above screenshots determine the process of extracting the files. As soon as the extraction
process completes, the user is suggested to look for the autospy software tool and download,
to install on the system, for getting help related to digital forensics investigation. This is a
2

pretty cool and effective tool for investigation. When the installation completes, the tool must
be opened and then proceed by selecting new case, which actually creates a new case. The
step displayed below is a demonstration for this process (Carlton & Matsumoto, 2011).
Then, once the new case windows opens, it will have the following optional information to be
filled:
1. Case number
2. Examiner name
3. Contact details
4. Notes
The other details that has to be filled are, case name, case type and the base directory. Digital
forensics Case 01 is the name of the case, which is shown in the following screenshots to
demonstrate how this case is saved in the base directory. The directory has to be browsed first
to save it. It is suggested to select, single user as a case type, and then proceed by clicking the
Next button. Once all the necessary details are filled, enter the Finish button, which creates
the case file (Cohen, 2011). The following screenshots are the examples of what is explained
in the above paragraph. Adding the data source once the case file is created is necessary, as it
will comprise of raw bit data. Make sure to choose the unallocated disk image, as validated in
the below screenshot. Next proceed with browsing and selecting the forensic images files.
Continue by pressing the next button, as shown below. Then ensure the case file is configured
in the ingest modules and continue by entering on the Next button (Cohen, 2012). Make it
obvious to add the data sources, in the new case file. As mentioned earlier, adding the
provided forensic images is a must, to help figure out the case.
As, the user will be able to find the evidence for the digital forensic investigation (Computer
forensics, 2010).
3 Case file Identification
Here, the details of the forensics image from the case file is been found, with the help
of digital forensics analysis.
182.7z.002 Case File Identification
3

The below screenshot describes the step where the correct data file is selected to find
the case file details.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table (Flory,
2016).
The single regular expression, email address and a single literal keyword search are present in
the case file where, as demonstrated in the following screenshot, the case file has the email
address key search containing three files.
The below table represents the details that are utilized for displaying the provided case file’s
outcome.
182.7z.003 Case File Identification
The below screenshot describes the step where the correct data file is selected to find
the case file details (Gogolin, 2013).
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
4

The case file’s deleted files’ details are represented in the below mentioned table (Hannay,
2011).
The single regular expression, email address and a single literal keyword search are present in
the case file where, as demonstrated in the following screenshot, the case file has the email
address key search containing three files.
The result of the case file are represented in the below mentioned table (Larson, 2014).
182.7z.004 Case File Identification
The below screenshot describes the step where the correct data file is selected to find
the case file details.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file (Maras, 2015).
The result of the case file are represented in the below mentioned table (Meyer, 2014).
The single regular expression, email address and a single literal keyword search are present in
the case file where, as demonstrated in the following screenshot, the case file has the email
address key search containing three files.
The result of the case file are represented in the below mentioned table (Philipp, Cowen &
Davis, 2010).
5

182.7z.005 Case File Identification
The below screenshot describes the step where the correct data file is selected to find
the case file details.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file (Pollitt & Shenoi, 2010).
The case file’s deleted files’ details are represented in the below mentioned table.
The result of the case file are represented in the below mentioned table.
182.7z.006 Case File Identification
The below screenshot describes the step where the correct data file is selected to find
the case file details (Ray & Shenoi, 2011).
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table.
The single regular expression, email address and a single literal keyword search are present in
the case file where, as demonstrated in the following screenshot, the case file has the email
address key search containing three files (Sammons, 2015).
6

The result of the case file are represented in the below mentioned table.
182.7z.007 Case File Identification
The below screenshot describes the step where the correct data file is selected to find
the case file details.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table.
The single regular expression, email address and a single literal keyword search are present in
the case file where, as demonstrated in the following screenshot, the case file has the email
address key search containing two files.
The result of the case file are represented in the below mentioned table.
182.7z.008 Case File Identification
The below screenshot describes the step where the correct data file is selected to find
the case file details.
7

The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table.
The single regular expression, email address and a single literal keyword search are present in
the case file where, as demonstrated in the following screenshot, the case file has the email
address key search containing two files.
The result of the case file are represented in the below mentioned table.
182.7z.009 Case File Identification
The below screenshot describes the step where the correct data file is selected to find
the case file details.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table.
182.7z.010 Case File Identification
The below screenshot describes the step where the correct data file is selected to find
the case file details.
8

The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table.
The single regular expression, email address and a single literal keyword search are present in
the case file where, as demonstrated in the following screenshot, the case file has the email
address key search containing one file.
The result of the case file are represented in the below mentioned table.
182.7z.011 Case File Identification
The below screenshot describes the step where the correct data file is selected to find
the case file details.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table.
The single regular expression, email address and a single literal keyword search are present in
the case file where, as demonstrated in the following screenshot, the case file has the email
address key search containing three files.
The result of the case file are represented in the below mentioned table.
9

182.7z.012 Case File Identification
The below screenshot describes the step where the correct data file is selected to find
the case file details.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table.
The single regular expression, email address and a single literal keyword search are present in
the case file where, as demonstrated in the following screenshot, the case file has the email
address key search containing three files.
The result of the case file are represented in the below mentioned table.
182.7z.013 Case File Identification
The below screenshot describes the step where the correct data file is selected to find
the case file details.
10

The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table.
The single regular expression, email address and a single literal keyword search are present in
the case file where, as demonstrated in the following screenshot, the case file has the email
address key search containing two files.
The result of the case file are represented in the below mentioned table.
182.7z.014 Case File Identification
The below screenshot describes the step where the correct data file is selected to find
the case file details.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table.
182.7z.015 Case File Identification
The below screenshot describes the step where the correct data file is selected to find
the case file details.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table.
11

4 Goals of the case file
The accessed, utilized and the deleted files from the digital content must be utilized by
the investigation of the case. This is what the following section is all about, which is
represented with appropriate figures, to clearly understand the process to display the deleted
files’ information ("Basics of Computer Forensics", 2016).
182.7z.002 Case File Indent
The below screenshot describes the step where the correct data file is selected to find
the case file details.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table (Budowle,
2011).
182.7z.003 Case File Indent
The below screenshot describes the step where the correct data file is selected to find
the case file details.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file (Carlton & Worthley, 2010).
The case file’s deleted files’ details are represented in the below mentioned table.
182.7z.004 Case File Indent
The below screenshot describes the step where the correct data file is selected to find
the case file details ("Digital Forensics - Elsevier", n.d.).
12

The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table (Federici,
2013).
182.7z.005 Case File Indent
The below screenshot describes the step where the correct data file is selected to find
the case file details.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file ("Forensic Examination of Digital Evidence: A Guide for Law ...", n.d.).
The case file’s deleted files’ details are represented in the below mentioned table.
182.7z.006 Case File Indent
The below screenshot describes the step where the correct data file is selected to find
the case file details.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table (HU, LIU &
HE, 2010).
13

182.7z.007 Case File Indent
The below screenshot describes the step where the correct data file is selected to find
the case file details.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file (Kearns, 2010).
The case file’s deleted files’ details are represented in the below mentioned table.
182.7z.008 Case File Indent
The below screenshot describes the step where the correct data file is selected to find
the case file details (Kessler, 2012).
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table.
182.7z.009 Case File Indent
The below screenshot describes the step where the correct data file is selected to find
the case file details (Lai, 2013).
14

The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file ("Open Source Digital Forensics Tools - digital evidence", n.d.).
The case file’s deleted files’ details are represented in the below mentioned table.
182.7z.010 Case File Indent
The below screenshot describes the step where the correct data file is selected to find
the case file details (Quick, Martini, Choo & Shavers, 2014).
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table.
182.7z.011 Case File Indent
The below screenshot describes the step where the correct data file is selected to find
the case file details (Science needs for microbial forensics, n.d.).
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table.
15

182.7z.012 Case File Indent
The below screenshot describes the step where the correct data file is selected to find
the case file details (Wright, 2012).
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table.
182.7z.013 Case File Indent
The below screenshot describes the step where the correct data file is selected to find
the case file details.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table.
182.7z.014 Case File Indent
The below screenshot describes the step where the correct data file is selected to find
the case file details.
16

The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table.
182.7z.015 Case File Indent
The below screenshot describes the step where the correct data file is selected to find
the case file details.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
The case file’s deleted files’ details are represented in the below mentioned table.
5 Quantity of the Files
The forensics image file is utilized to make a clear determination of how many file are
available in the system. The following section is all about this.
182.7z.002 Quantity of Case File
The below screenshot describes the step where the user is suggested to select the
correct data file, to find the case file details like quantity.
As demonstrated in the following screenshot, the case file has the email address key search
containing three files.
182.7z.003 Quantity of Case File
The below screenshot describes the step where the user is suggested to select the
correct data file, to find the case file details like quantity.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
17

As demonstrated in the following screenshot, the case file has the email address key search
containing three files.
182.7z.004 Quantity of Case File
The below screenshot describes the step where the user is suggested to select the
correct data file, to find the case file details like quantity.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
As demonstrated in the following screenshot, the case file has the email address key search
containing two files.
182.7z.005 Quantity of Case File
The below screenshot describes the step where the user is suggested to select the
correct data file, to find the case file details like quantity.
As demonstrated in the following screenshot, the case file has the email address key search
containing one file.
None of the files are present in the system’s case file.
182.7z.006 Quantity of Case File
18

The below screenshot describes the step where the user is suggested to select the
correct data file, to find the case file details like quantity.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
As demonstrated in the following screenshot, the case file has the email address key search
containing two files.
182.7z.007 Quantity of Case File
The below screenshot describes the step where the user is suggested to select the
correct data file, to find the case file details like quantity.
The below screenshot reveals that there is one file that is deleted from the provided case file.
As demonstrated in the following screenshot, the case file has the email address key search
containing one file.
182.7z.008 Quantity of Case File
The below screenshot describes the step where the user is suggested to select the
correct data file, to find the case file details like quantity.
19

The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
As demonstrated in the following screenshot, the case file has the email address key search
containing one file.
182.7z.009 Quantity of Case File
The below screenshot describes the step where the user is suggested to select the
correct data file, to find the case file details like quantity.
The below mentioned screenshot reveals that there is one file that is deleted from the
provided case file.
None of the files are present in the system’s case file.
182.7z.010 Quantity of Case File
The below screenshot describes the step where the user is suggested to select the
correct data file, to find the case file details like quantity.
The below mentioned screenshot reveals that, there is one file that is deleted from the
provided case file.
As demonstrated in the following screenshot, the case file has the email address key search
containing one file.
20

182.7z.011 Quantity of Case File
The below screenshot describes the step where the user is suggested to select the
correct data file, to find the case file details like quantity.
The below mentioned screenshot reveals that, there is one file that is deleted from the
provided case file.
As demonstrated in the following screenshot, the case file has the email address key search
containing one file.
182.7z.012 Quantity of Case File
The below screenshot describes the step where the user is suggested to select the
correct data file, to find the case file details like quantity.
The below mentioned screenshot reveals that, there is one file that is deleted from the
provided case file.
As demonstrated in the following screenshot, the case file has the email address key search
containing three files.
182.7z.013 Quantity of Case File
The below screenshot describes the step where the user is suggested to select the
correct data file, to find the case file details like quantity.
21

The below mentioned screenshot reveals that, there is one file that is deleted from the
provided case file.
As demonstrated in the following screenshot, the case file has the email address key search
containing two files.
182.7z.014 Quantity of Case File
The below screenshot describes the step where the user is suggested to select the
correct data file, to find the case file details like quantity.
The below mentioned screenshot reveals that, there is one file that is deleted from the
provided case file.
None of the files are present in the system’s case file.
182.7z.015 Quantity of Case File
The below screenshot describes the step where the user is suggested to select the
correct data file, to find the case file details like quantity.
The below mentioned screenshot reveals that, there is one file that is deleted from the
provided case file.
22

None of the files are present in the system’s case file.
It is concluded that the digital forensics investigation is effectively used to deliver the
necessary information related to the forensics images that were the raw bit data. Moreover,
only a single file is deleted from this case file. Then, it contains several email key word
search files and for an illegal access the third party is utilized.
6 Software Installed
Not even one software was installed on the system, other than the autopsy tool, for
completing this digital forensic investigation (Zawoad & Hasan, 2016).
23

References
Basics of Computer Forensics. (2016). Vestnik Policii, 7(1). doi: 10.13187/vesp.2016.7.20
Boddington, R. (2016). Practical Digital Forensics. Packt Publishing.
Budowle, B. (2011). Microbial forensics. Burlington, MA: Elsevier/Academic Press.
Carlton, G., & Matsumoto, J. (2011). A Survey of Contemporary Enterprise Storage
Technologies from a Digital Forensics Perspective. Journal Of Digital Forensics,
Security And Law. doi: 10.15394/jdfsl.2011.1100
Carlton, G., & Worthley, R. (2010). Identifying a Computer Forensics Expert: A Study to
Measure the Characteristics of Forensic Computer Examiners. Journal Of Digital
Forensics, Security And Law. doi: 10.15394/jdfsl.2010.1069
Cohen, F. (2011). Column: Putting the Science in Digital Forensics. Journal Of Digital
Forensics, Security And Law. doi: 10.15394/jdfsl.2011.1085
Cohen, F. (2012). The Science of Digital Forensics: Recovery of Data from Overwritten
Areas of Magnetic Media. Journal Of Digital Forensics, Security And Law. doi:
10.15394/jdfsl.2012.1131
Digital Forensics - Elsevier. Retrieved from
http://booksite.elsevier.com/samplechapters/9780123742681/Chapter_1.pdf
Federici, C. (2013). AlmaNebula: A Computer Forensics Framework for the Cloud. Procedia
Computer Science, 19, 139-146. doi: 10.1016/j.procs.2013.06.023
Flory, T. (2016). Digital Forensics in Law Enforcement: A Needs Based Analysis of Indiana
Agencies. Journal Of Digital Forensics, Security And Law. doi:
10.15394/jdfsl.2016.1374
Forensic Examination of Digital Evidence: A Guide for Law ... Retrieved from
https://www.ncjrs.gov/pdffiles1/nij/199408.pdf
Gogolin, G. (2013). Digital forensics explained. Boca Raton, FL: CRC Press.
Hannay, P. (2011). Kindle Forensics: Acquisition & Analysis. Journal Of Digital Forensics,
Security And Law. doi: 10.15394/jdfsl.2011.1093
24

HU, Y., LIU, B., & HE, Q. (2010). Survey on techniques of digital multimedia
forensics. Journal Of Computer Applications, 30(3), 657-662. doi:
10.3724/sp.j.1087.2010.00657
Kearns, G. (2010). Computer Forensics for Graduate Accountants: A Motivational
Curriculum Design Approach. Journal Of Digital Forensics, Security And Law. doi:
10.15394/jdfsl.2010.1076
Kessler, G. (2012). Advancing the Science of Digital Forensics. Computer, 45(12), 25-27.
doi: 10.1109/mc.2012.399
Lai, R. (2013). Operations forensics. Cambridge, Mass.: MIT Press.
Larson, S. (2014). The Basics of Digital Forensics: The Primer for Getting Started in Digital
Forensics. Journal Of Digital Forensics, Security And Law. doi:
10.15394/jdfsl.2014.1165
Maras, M. (2015). Computer forensics. Burlington, MA: Jones & Bartlett Learning.
Meyer, T. (2014). Careers in computer forensics. New York: Rosen Publishing.
Open Source Digital Forensics Tools - digital evidence. Retrieved from http://www.digital-
evidence.org/papers/opensrc_legal.pdf
Philipp, A., Cowen, D., & Davis, C. (2010). Hacking exposed, computer forensics. New
York: McGraw-Hill.
Pollitt, M., & Shenoi, S. (2010). Advances in digital forensics. New York:
Springer/International Federation for Information Processing.
Quick, D., Martini, B., Choo, K., & Shavers, B. (2014). Cloud storage forensics. Waltham,
Mass.: Syngess.
Ray, I., & Shenoi, S. (2011). Advances in digital forensics IV. New York: Springer.
Sammons, J. (2015). The basics of digital forensics. Amsterdam: Syngress Media.
Science needs for microbial forensics.
Wright, N. (2012). DNS in Computer Forensics. Journal Of Digital Forensics, Security And
Law. doi: 10.15394/jdfsl.2012.1117
25

Zawoad, S., & Hasan, R. (2016). Trustworthy Digital Forensics in the
Cloud. Computer, 49(3), 78-81. doi: 10.1109/mc.2016.89
26