Digital Forensics Technology Assignment
30 Pages2353 Words206 Views
Added on 2021-05-27
Digital Forensics Technology Assignment
Added on 2021-05-27
ShareRelated Documents
DIGITAL FORENSIC TECHNOLOGY1
Table of Contents1Introduction.......................................................................................................................22Analysis Tool.....................................................................................................................23Investigation......................................................................................................................23.1Creating a case file using Autopsy tool....................................................................33.2Initial Survey..............................................................................................................73.3Documentation Phase..............................................................................................143.4Search for evidence..................................................................................................204Conclusion.......................................................................................................................25References...............................................................................................................................262
1IntroductionThe main objective of this project is to retrieve a forensic image of the USB datastorage device. Farayi is suspected of selling counterfeit International Student Identity Cardsto people who are not entitled to claim the discounts this card brings. An undercover stingoperation was setup to catch Farayi in the act of selling his counterfeit goods. Farayiattempted to sell a counterfeit ISIC card to an undercover officer who was part of the stingoperation. After being arrested and questioned at the local police station, Farayi provided aUSB data stick to be further examined. Under questioning Farayi has stated that all theevidence that can be found is on this USB data stick. This USB storage device has beenprocessed by a forensic imaging technician and the forensic image has been obtained. So Ihave to recover the forensic image of the USB data storage device. Then the copied Data inUSB will be determined. The investigation will be carried out to determine that the hiddendata in USB, the reasons and facts behind the theft.2Analysis ToolThis analysis using two main tool to retrieve a forensic image of the USB data storage device.AutopsyWinMD53InvestigationData recovery is might be helpful for examination in a wide range of ways. A few Datastay introduce even after Data erasure or USB repartitioning (Gogolin et al., 2013). Also,there are numerous alternatives for offenders with specialized know how to shroud Data, forthe most part utilizing a USB supervisor, stenography, encryption and so forth. Discovering,recuperation and remaking of concealed Data can be an extremely tedious and dreary process,however sometimes it might create prove that will split the case. So as to completely see howand why Data stay on a plate, one ought to find out about the idea of putting away Data on aUSB. A USB part is a unit of settled size characterized when record framework is made(generally 512 bits). More seasoned hard USBs may have some 'squandered' storage roomoutwardly tracks, as intelligently each track is partitioned into break even with number ofdivisions. It is conceivable sometimes to shroud Data in the space between areas on thebigger outside tracks. This is known as the division hole. A few Data recuperationadministrations might have the capacity to find and recover Data that is covered up in thishole. Erased records and slack space When a working framework composes a document to3
USB, it dispenses a specific number of segments. The quantity of areas designated reliesupon the restrictions of the working framework and setup choices made by the frameworkoverseer. The areas allotted and their area on the plate are recorded in a registry table for lateraccess. At the point when the record is erased, the space initially dispensed to it is essentiallyset apart as unallocated. The genuine Data stays on the USB (Larson, 2014).3.1Creating a case file using Autopsy toolUser needs to create the case file to open the provided the DD image file. The belowscreenshots is shows the new case creations. First, enter the case name as Unit09 and browserthe base directory. Then click Next button to enter the optional information. Here, we will select the data sources to add the data sources for created case file. So, selectthe unallocated space image file and click the next button to proceed the adding the datasources. It is shown below (Pollitt and Shenoi, 2010).4
After, browse the data source path to select the DD image file. It is shown below.Then, configure the DD image file to ingest modules and click the next button. It is shownbelow.5
End of preview
Want to access all the pages? Upload your documents or become a member.
Related Documents
Digital Forensics and Practiceslg...
|34
|4777
|156