Digital Forensics Case Study: Clowning About Again Detailed Analysis

This case study delves into a digital forensic investigation concerning illegal access, ownership, and distribution of digital content related to clowns in Western Australia. The investigation was initiated following a witness report of an individual accessing clown-related content at their workplace. A computer was seized and a logical acquisition was performed using FTK Imager; however, the original hard drive was subsequently wiped. The suspect denies accessing the content, claiming the computer may have been compromised by malware. The analysis utilizes the Autopsy digital forensics tool to examine the logical acquisition, focusing on identifying accessed, used, and potentially deleted files, including web searches, device attachments, operating system information, EXIF metadata, installed programs, web history, recent documents, web downloads, encryption suspects, web cookies, operating system user accounts, and web bookmarks. The investigation aims to determine the intent behind accessing the digital content and quantify the files involved to build a case.