Digital Forensics Investigation Report - COIT12201, T2, 2019

This report presents a comprehensive digital forensics investigation, focusing on the analysis of digital evidence using the Autopsy tool. The investigation involves examining several E01 files, including charlie-2009-12-11.E01, charlie-work-usb-2009-12-11.E01, and charlie-2009-12-11.mddramima...Read More

Running head: Electronic Crime and Digital Forensics
Electronic Crime and Digital Forensics
Name of the Student
Name of the University
Author Note

Electronic Crime and Digital Forensics 1
Table of Contents
Digital forensic:..........................................................................................................................2
Activity One:..............................................................................................................................2
The steps for using autopsy in digital forensics are:..............................................................3
Investigation:..........................................................................................................................4
charlie-2009-12-11.E01:....................................................................................................4
charlie-work-usb-2009-12-11.E01:..................................................................................16
charlie-2009-12-11.mddramimage.zip:............................................................................22
Bibliography:............................................................................................................................30

2Electronic Crime and Digital Forensics
Digital forensic:
The digital forensics is a branch of forensic science that encompasses the
investigation and recovery of material that are found in devices that are digital. They have
relation with the computer crime. The term digital forensics was used as a synonym for the
forensics that are related to computer. It has been expanded in order to cover the investigation
of all the devices that are able to store data that are digital. The digital forensics has a variety
of applications. The most common applications among them is to support a hypothesis before
a civil or a criminal court. The criminal can also be featured in the sectors that are private like
during the investigations of the corporate or investigation of intrusion. The aspect of an
investigation that are technical are divided into sub branches that relates to the devices such
as computer forensics, network forensics, and forensics that are related to mobile devices.
The digital forensics requires the acquisition, preservation, documentation, analysis and
interpretation of the evidences from different storage media types. It is not only limited to the
hand held devices and laptops and desktops but it also extends to data in transit that are then
transmitted across networks that are private or public. The autopsy is a platform for the
forensics that are digital in nature and the interface that is graphical to the sleuth kit and the
other types of tools of digital forensics.
Activity One:
The autopsy tool will be used for the investigation of the files. The autopsy is software
that makes the employ of programs that are open source simpler. The open source programs
and the plug ins are used in the sleuth kit. The user interface that is graphical shows the
results from the search of forensics of the volume that are underlying thus making it easier for
the people who are investigating to flag the sections of data that are pertinent. The autopsy
tool is maintained by Basis Technology Corp. With the help of the programmers that are from

3Electronic Crime and Digital Forensics
the community. The community sells training and the support services in order to use the
product. The autopsy tool is designed for the following purposes:
 Centralized: The tool should offer a consistent and standard mechanism in order to access
all the modules and the characteristics.
 Extensible: The user can be capable of adding new features by the creation of plug-in that
can examine all or part of the data source that are underlying.
 Multiple users: The autopsy tool can be usable by one of the investigators or coordinate
the working of a time.
 Ease of use: The autopsy tool should offer the historical tools and wizards in order to
make it easier for the users to repeat the stages without much reconfiguration.
The steps for using autopsy in digital forensics are:
Step 1: The first step is to open the autopsy tool. The autopsy tool can be opened in two
ways. First click on applications then 11- forensics and then autopsy.
Step 2: The autopsy application opens; a terminal opens that shows the information of the
program along with the details of the connection in order to open the browser of forensic
autopsy.
Step 3: In order to open the autopsy browser, the mouse should be positioned over the link
that s in the terminal, right click and choose the option of open link.
For doing the activity one the autopsy tool has been used. There are 3 files in the
activity one that are needed to be investigated.

4Electronic Crime and Digital Forensics
Investigation:
charlie-2009-12-11.E01:
For the investigation, firstly the file has been added as the data source. There are 824
image files that are hidden within the. E01 file. All of the image files can be shown after
decryption. The result that has been get after the investigation are given below:
After full investigation, it has been found that there are 51 video files. The results have been
shown in the screenshot below.

5Electronic Crime and Digital Forensics
After investigation it has been seen that there are 168 audio files, they are as follows:
There are 298 archives within the file, the result is given below:

6Electronic Crime and Digital Forensics
Within the file there are 43 database files are also existed.
There are some documents that are existed within the file. There are 743 html files, the
evidence is provided via the screenshot given below:

7Electronic Crime and Digital Forensics
There are ms office files too that are existed as seen in the screenshot there are 25 files that
are office related such as .doc, .ppt, .odt and .xls.
There are 23 pdf files.
There are 551 text files, they are given in the screenshot below:
There are 11 rich texts.
There are executable files too such as .exe, ..dll, .cmd they are provided in the screenshot
below. It has been found that xcopy software has been used for coping files from Pat’s
system.
Below are the command files that are found, the cmd files are used for the login purpose.

8Electronic Crime and Digital Forensics
There are 1395 deleted files, that are:

9Electronic Crime and Digital Forensics
The encrypted files are as follows:
Below the files are the database files that are resources.

10Electronic Crime and Digital Forensics

11Electronic Crime and Digital Forensics
charlie-work-usb-2009-12-11.E01:
By investigation this file the results that have been got are given below:
The images that have been found by the investigation are:

12Electronic Crime and Digital Forensics
These images are the proof that the system was accessed by someone else.
These are the files that were deleted.

13Electronic Crime and Digital Forensics
The email addresses that have been found are:
charlie-2009-12-11.mddramimage.zip:
By investigation this file the results that have been got are given below:
There are 2 image files:

14Electronic Crime and Digital Forensics
3 database files are there:
The similar email addresses are also found.

15Electronic Crime and Digital Forensics
• Who is spying on Pat?
Jo was doing spy on Pat.
• How are they doing it?
They were doing by using the remote server connection.
Can you identify specific methods or software they have used to facilitate this?
Xcopy software was used for spying.
• Is anyone else involved?
Charlie is also involved in this case.

16Electronic Crime and Digital Forensics
Bibliography:
Casey, E., Back, G. and Barnum, S., 2015. Leveraging CybOX™ to standardize
representation and exchange of digital forensic information. Digital Investigation, 12,
pp.S102-S110.
Chung, H., Park, J. and Lee, S., 2017. Digital forensic approaches for Amazon Alexa
ecosystem. Digital Investigation, 22, pp.S15-S25.
Conlan, K., Baggili, I. and Breitinger, F., 2016. Anti-forensics: Furthering digital forensic
science through a new extended, granular taxonomy. Digital investigation, 18, pp.S66-S75.
Conlan, K., Baggili, I. and Breitinger, F., 2016. Anti-forensics: Furthering digital forensic
science through a new extended, granular taxonomy. Digital investigation, 18, pp.S66-S75.
Gupta, J.N., Kalaimannan, E. and Yoo, S.M., 2016. A heuristic for maximizing investigation
effectiveness of digital forensic cases involving multiple investigators. Computers &
Operations Research, 69, pp.1-9.
Kouwen, A., Scanlon, M., Choo, K.K.R. and Le-Khac, N.A., 2018. Digital forensic
investigation of two-way radio communication equipment and services. Digital
Investigation, 26, pp.S77-S86.
Lillis, D., Becker, B., O'Sullivan, T. and Scanlon, M., 2016. Current challenges and future
research areas for digital forensic investigation. arXiv preprint arXiv:1604.03850.
Lutui, R., 2016. A multidisciplinary digital forensic investigation process model. Business
Horizons, 59(6), pp.593-604.
Mink, D., Yasinsac, A., Choo, K.K.R. and Glisson, W., 2016. Next generation aircraft
architecture and digital forensic.

17Electronic Crime and Digital Forensics
Montasari, R., 2016. Review and assessment of the existing digital forensic investigation
process models. International Journal of Computer Applications, 147(7), pp.41-49.