Digital Theft and Recovery Procedures

This project discusses digital theft and recovery procedures. It includes the use of Winhex digital forensics tool for data recovery and the preparation of a digital forensics report for intellectual property theft.

University
Semester
Networking
Student ID
Student Name
Submission Date
1

Executive summary
We shall be discussing about the Digital theft and recovery procedures in this project.
The project is split in to two parts. In the first part of this project we shall recover, by using
the Winhex digital forensics tool, the scrambled bits for providing the effective data recovery for
digital forensics analysis. In the second part of this project, for the Intellectual property theft for
a new employee of Superior Bicycles Inc, we shall prepare a digital forensics report. At Superior
Bicycles Inc, Jim Shu, an employee had been removed and in his place a new employee Tom
Johnson was taken in. A strange email from Terry Sadler containing the new project details of
Jim Shu was received by the External investor/Contractor, Bob Aspen. As the project looked
interesting and impressive, he forwarded the email to Chris Robinson incase capital investment is
required.
Now for this project, any form of digital photograph as an evidence will be considered for
determining any further data of proprietary Superior Bicycles Inc. We shall make use of tools
like FTK imager and Autopsy tool for further investigation of the USB drive and the data in it.
Finally, after completing the full analysis, we shall prepare a detailed digital forensics report.
This will be further studied and evaluated so as to get a full appraisal for the given project.
2

Table of Contents
Task 1: Recovering Scrambled Bits.........................................................................................................4
Task 2: Digital Forensics Report..............................................................................................................8
1. Introduction and Background......................................................................................................8
2. Analysis..........................................................................................................................................9
3. Findings........................................................................................................................................14
4. Conclusion....................................................................................................................................21
References................................................................................................................................................22
3

Task 1: Recovering Scrambled Bits
Winhex digital forensics tool shall be used in this task for the recovery of the scrambled
data and to get an informative and detailed data recovery for further investigation on the digital
forensics analysis.
We shall follow the below mentioned steps for the recovery of the scrambled bits by
using the Winhex Tool,
Open the Winhex software as shown in the below image (Advances in Digital Forensics
9, 2016).
Open the file by clicking on the file name. Select the provided text file by browsing through the
scrambled bits. The below image shows the scrambled bits of text file as selected,
4

Next as shown in the below image, browse the selected file,
5

Next, run the scrambled bit to display the text format of the file as shown in the below image
(Årnes, 2014).
6

“Congratulations” will display on the screen once the task of the unscrambling bits of the
selected file has been completed. It will be seen as a plain text file (Bodden, 2016).
7

Task 2: Digital Forensics Report
1. Introduction and Background
For the Intellectual property theft carried out by a newly recruited employee of the Superior
Bicycles INC, we shall prepare the digital forensics report. This is the main task of this project.
At Superior Bicycles Inc, Jim Shu, an employee had been removed and in his place a new
employee Tom Johnson was taken in. A strange email from Terry Sadler containing the new
project details of Jim Shu was received by the External investor/Contractor, Bob Aspen. As the
project looked interesting and impressive, he forwarded the email to Chris Robinson incase
capital investment is required. After going through the email, he forwards for further details to
the general counsel, Ralph Benison. Further Ralph passes the email to the IT department, Bob
Swartz and asks him to check for attachments with any emails received by the firm. A little
8

inspection carried out by the IT department, identifies an email and they forward this to Chris
Robinson. A USB drive on the desk of Tom Johnson was found by Chris and that USB was
assigned to Tom for some work related matter. Now our task will be to check the USB drive and
find out if it contained any sensitive and vital data information, like images and files which
belonged to Superior Bicycles Inc. Making use of tools like FTK imager and Autopsy tool, we
shall evaluate the contents of this USB drive found from Tom Johnson’s desk. After this, a
detailed Forensic report will be prepared with all the details of the data inside the USB drive. A
detailed and in-depth study and evaluation of this report will be carried out (Bolt, 2011).
2. Analysis
For the USB Drive, we shall be creating the disk image file by using the FTK images and this
will part of our analysis of the report so mentioned in the above discussion.
Below is the image of the opening of FTK Imager tool, (Gogolin, 2013).
Below image shows the “choose the create disk image file” by clicking on the File
9

Next select the source evidence type USB as Physical Drive from the options and click on
next .The below image is for the same,
Click on the next button after selecting the source folder, the below image displays the same,
10

Next, “Raw DD” should be the destination image type and the image below is representation of
the same,
11

Below image shows the information about the evidence item which will be entered by the user,
Next, enter the image file name as digital forensics after selecting the image destination to
browse the folder, and then enter, which will be as shown in the below image,
12

Below is the image where the disk image is being shown created for our USB drive,(Graves,
2014).
The below image displays the opened file which was created,
13

3. Findings
The newly created image file on the USB Drive will now be examined and analysed for
any vital data and evidence pertaining to the firm. Autopsy tool will be used for this purpose and
we will start by opening this tool,
Enter all the required fields once when the new case has been created on the tool and then put all
the neccesary information. Once done click on the next icon, (Pollitt & Shenoi, 2010).
14

Case number as 001, as an example, can then be entered for the optional case information. After
that click the finish button which is illustrated as below.
Below is the image after creating the case file for the database is carried out,
Below is the image for the new case of the text index created,
15

By selecting the Data source code type, we can add and modify the data source that has to
be created. For the given USB we have created the disk image and the same we shall select as
our as data source. Next click on the next icon as shown in the below image,
Select the created disk image, after browsing the disk image as shown in the below image,
16

The below image displays the added data source for creating the case file,
Thus we shall now have successfully created and added the new case for the created disk
image as provided for the USB and the is displayed below,
17

The below image displays the provided USB drive information,
The below image shows all the data and information of the digital forensics case file,
18

We can see all the images, files, data, attributes etc in the USB drive as per the image below,
19

20

Thus after completing this task we can clearly see more than 1000 files on the USB drive
found on the desk of Tom Johnson and this contains files, images, hidden images, hidden files,
hidden attributes, data etc some of which contains data about the project and there might be some
that may contain sensitive information about the company. By successfully implementing and
using the autopsy and FTK imager, we have retrieved all the hidden data from the USB drive
(Ray & Shenoi, 2011).
4. Conclusion
The project’s goal was to retrieve all the digital information and intellectual property from the
USB drive which belonged to a newly recruited employee of the firm, Superior Bicycles Inc. We
have been able to successfully gather evidence of all the various types of files and contents on
the USB drive which legally belonged to the firm, Superior Bicycles Inc. By utilizing the tools
FTK imager and Autopsy tool we successfully were able to analyse the USB drive.
Once the investigation and the analysis was completed, we prepared a detailed digital forensics
report for the same and we shall further study and evaluate this in detail to get more in-depth
information and analysis for this project.
21

ReferencesÅ
rnes, A. (2014). Digital forensics.
Bodden, V. (2016). Digital forensics.
Bolt, S. (2011). XBOX 360 Forensics. Burlington: Elsevier Science.
Gogolin, G. (2013). Digital forensics explained. Boca Raton, FL: CRC Press.
Graves, M. (2014). Digital archaeology. Upper Saddle River, N.J.: Addison-Wesley.
Pollitt, M., & Shenoi, S. (2010). Advances in digital forensics. New York: Springer/International
Federation for Information Processing.
Ray, I., & Shenoi, S. (2011). Advances in digital forensics IV. New York: Springer.
Springer-Verlag New York Inc. (2016). Advances in Digital Forensics 9.
22

23