FCM 753: Digital Forensic Investigation Report for Suspect's Computer

This report details a digital forensic investigation of a suspect's computer, following an arrest and search warrant execution. The investigation involves analyzing a computer image file using Autopsy, focusing on the identification, preservation, evaluation, documentation, and presentation of digital evidence. The report outlines the importance of digital forensics in identifying cybercriminals and protecting organizational data. The investigation reveals various types of files, including image, video, database, text, and executable files, along with web bookmarks, cookies, and email addresses. The report includes MD5 and SHA1 hash values for the image file, and provides details on the files found, including metadata. The report also explores potential encryption and web history, cookies, and email addresses. The conclusion emphasizes the need for precise standards in digital forensics for court proceedings, and the application of forensics in various sectors, including criminal and civil cases, and private investigations. References to relevant research papers are included.

Running head: FCM 753 Digital Forensic
FCM 753 Digital Forensic
Name of the Student
Name of the University
Author Note

FCM 753 Digital Forensic 1
Executive summary:
The purpose of this report is to discuss about digital forensic. The digital forensic helps in
designing processes at a suspected scene of crime that helps to make sure that the digital
evidences got is nor corrupted. It also helps in generating a report of computer forensics that
provides an entire report on the procedure of investigation. The police have made an arrest as
well as they secured a search warrant for the home of the suspect. At the time of executing
the warrant, the police have investigated that a there is an image file of computer storage
which may contain lot of information. Autopsy will be used for investigating the image file.

2FCM 753 Digital Forensic
Table of Contents
Introduction and Background:....................................................................................................3
Digital forensic:..........................................................................................................................3
Importance of digital forensic:...................................................................................................4
Collection summary:..................................................................................................................4
Investigation report:...................................................................................................................8
Conclusion:............................................................................................................................344
Timeline:................................................................................................................................345
Tool used:...............................................................................................................................346
References:.............................................................................................................................347

3FCM 753 Digital Forensic
Introduction and Background:
The purpose of this report is to discuss about the digital forensic. Digital forensics is
defined as the procedure of preservation, recognising, extraction and the documentation of
evidences of computer that can be utilised by the court of law. The police have made an arrest
as well as they secured a search warrant for the home of the suspect. At the time of executing
the warrant, the police have investigated that a there is an image file of computer storage
which may contain lot of information. It is a science of discovering the evidences from the
media those are digital like mobile phones, computer, network or a server. It offers the team
of forensic with the best methods and tools in order to resolve the complex cases those are
related to digital. Digital forensics assists the team of forensic to evaluates, inspects
recognises and preserves the evidences those are digital present on the different types of
electronic devices. In this report the Autopsy tool will be used for investigating the forensic
image file.
Digital forensic:
There are various procedures of performing the digital forensics. They are
Identification, Preservation, Evaluation, Documentation and Presentation.
There are mainly three kinds of digital forensics. These include the following:
 Disk forensics
 Network forensics
 Wireless forensics
There are major challenges those are faced by digital forensics. These include:
 The increase is the number of personal computers and maximized use of internet
 Easy availability of tools of hacking

4FCM 753 Digital Forensic
 It helps various companies to capture essential information if their systems of
computer or the networks are compromised
 It efficiently tracks down the cyber criminals
 It assists in order to protect the money of the organization and the time of the
organization.
 It permit to extract, process and then interpret the evidences those are factual so that it
can prove the actions of cyber criminals in the court.
Importance of digital forensic:
The important objectives of utilising computer forensics are as follows:
 It assists to find out the motive that is behind the crime and find the main culprit.
 Designing processes at a suspected scene of crime that helps to make sure that the
digital evidences got is nor corrupted
 Generating a report of computer forensics that provides an entire report on the
procedure of investigation.
 Preserving the evidences by following the custody chain
 Acquisition and duplication of data. recovering the files and the partitions those are
deleted from the digital media in order to extract the evidences and then authenticate
them.
Collection summary:
After investigation a lot of evidences has been found in the disk image file. They are
as follows:
Badguy image:

5FCM 753 Digital Forensic
Hash value:
MD5 SHA1
36989b20f73621372fda4ab5bdcca0b
e
82294085f8f5f17f4857c5ebcf292de6b8c542f
0
Image files:

6FCM 753 Digital Forensic
Video files:
Database files:

7FCM 753 Digital Forensic
Text files:
Rich text:

8FCM 753 Digital Forensic
Exe files:
Investigation report:
Exif metadata:
Date Taken Source File
2004-04-09
08:17:00
ART
/img_BadGuyWin7.E01/vol_vol3/ProgramData/Microsoft/Windows
NT/MSScan/WelcomeScan.jpg
2004-04-09
08:17:00
ART
/img_BadGuyWin7.E01/vol_vol3/Windows/winsxs/amd64_microsoft-windows-
fax-common_31bf3856ad364e35_6.1.7601.17514_none_6a2ab458674011dc/
WelcomeScan.jpg
2008-02-07
11:33:11
ARST /img_BadGuyWin7.E01/vol_vol3/Users/Public/Pictures/Sample Pictures/Tulips.jpg
2008-02-07
11:33:11
ARST
/img_BadGuyWin7.E01/vol_vol3/Windows/winsxs/amd64_microsoft-windows-
photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be/
Tulips.jpg
2008-02-11 /img_BadGuyWin7.E01/vol_vol3/Users/Public/Pictures/Sample

9FCM 753 Digital Forensic
11:32:24
ARST Pictures/Jellyfish.jpg
2008-02-11
11:32:24
ARST
/img_BadGuyWin7.E01/vol_vol3/Windows/winsxs/amd64_microsoft-windows-
photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be/
Jellyfish.jpg
2008-02-11
11:32:43
ARST /img_BadGuyWin7.E01/vol_vol3/Users/Public/Pictures/Sample Pictures/Koala.jpg
2008-02-11
11:32:43
ARST
/img_BadGuyWin7.E01/vol_vol3/Windows/winsxs/amd64_microsoft-windows-
photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be/
Koala.jpg
2008-02-11
11:32:51
ARST
/img_BadGuyWin7.E01/vol_vol3/Users/Public/Pictures/Sample
Pictures/Lighthouse.jpg
2008-02-11
11:32:51
ARST
/img_BadGuyWin7.E01/vol_vol3/Windows/winsxs/amd64_microsoft-windows-
photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be/
Lighthouse.jpg
2008-02-18
05:07:31
ARST
/img_BadGuyWin7.E01/vol_vol3/Users/Public/Pictures/Sample
Pictures/Penguins.jpg
2008-02-18
05:07:31
ARST
/img_BadGuyWin7.E01/vol_vol3/Windows/winsxs/amd64_microsoft-windows-
photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be/
Penguins.jpg
2008-03-14
13:59:26
ARST
/img_BadGuyWin7.E01/vol_vol3/Users/Public/Pictures/Sample
Pictures/Chrysanthemum.jpg
2008-03-14
13:59:26
ARST /img_BadGuyWin7.E01/vol_vol3/Users/Public/Pictures/Sample Pictures/Desert.jpg
2008-03-14
13:59:26
ARST
/img_BadGuyWin7.E01/vol_vol3/Windows/winsxs/amd64_microsoft-windows-
photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be/
Chrysanthemum.jpg
2008-03-14
13:59:26
ARST
/img_BadGuyWin7.E01/vol_vol3/Windows/winsxs/amd64_microsoft-windows-
photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be/
Desert.jpg
2008-03-24
16:41:53
ART
/img_BadGuyWin7.E01/vol_vol3/Users/Public/Pictures/Sample
Pictures/Hydrangeas.jpg
2008-03-24
16:41:53
ART
/img_BadGuyWin7.E01/vol_vol3/Windows/winsxs/amd64_microsoft-windows-
photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be/
Hydrangeas.jpg
Web bookmarks:
URL Title Date Created Program Domain
http://go.microsoft.com/
fwlink/?LinkId=121315
Web Slice
Gallery.url
2013-09-16
01:22:30 ART
Internet
Explorer
go.microsoft.c
om
http://go.microsoft.com/
fwlink/?LinkId=129791 USA.gov.url
2013-09-16
01:22:33 ART
Internet
Explorer
go.microsoft.c
om
http://go.microsoft.com/
fwlink/?LinkId=129792
GobiernoUSA.go
v.url
2013-09-16
01:22:33 ART
Internet
Explorer
go.microsoft.c
om

10FCM 753 Digital Forensic
http://go.microsoft.com/
fwlink/?LinkId=50893
IE Add-on
site.url
2013-09-16
01:22:30 ART
Internet
Explorer
go.microsoft.c
om
http://go.microsoft.com/
fwlink/?LinkId=54729 MSN.url
2013-09-16
01:22:30 ART
Internet
Explorer
go.microsoft.c
om
http://go.microsoft.com/
fwlink/?LinkId=55143 MSN Autos.url
2013-09-16
01:22:30 ART
Internet
Explorer
go.microsoft.c
om
http://go.microsoft.com/
fwlink/?LinkId=68921 MSN Sports.url
2013-09-16
01:22:30 ART
Internet
Explorer
go.microsoft.c
om
http://go.microsoft.com/
fwlink/?LinkId=68922
MSNBC
News.url
2013-09-16
01:22:30 ART
Internet
Explorer
go.microsoft.c
om
http://go.microsoft.com/
fwlink/?LinkId=68923 MSN Money.url
2013-09-16
01:22:30 ART
Internet
Explorer
go.microsoft.c
om
http://go.microsoft.com/
fwlink/?LinkId=68924
MSN
Entertainment.url
2013-09-16
01:22:30 ART
Internet
Explorer
go.microsoft.c
om
http://go.microsoft.com/
fwlink/?LinkId=68925
Windows Live
Mail.url
2013-09-16
01:22:30 ART
Internet
Explorer
go.microsoft.c
om
http://go.microsoft.com/
fwlink/?LinkId=68927
Windows Live
Spaces.url
2013-09-16
01:22:30 ART
Internet
Explorer
go.microsoft.c
om
http://go.microsoft.com/
fwlink/?LinkId=69172
Get Windows
Live.url
2013-09-16
01:22:30 ART
Internet
Explorer
go.microsoft.c
om
http://go.microsoft.com/
fwlink/?LinkId=70742
Windows Live
Gallery.url
2013-09-16
01:22:30 ART
Internet
Explorer
go.microsoft.c
om
http://go.microsoft.com/
fwlink/?linkid=140813
Microsoft
Store.url
2013-09-16
01:22:30 ART
Internet
Explorer
go.microsoft.c
om
http://go.microsoft.com/
fwlink/?linkid=44661
IE site on
Microsoft.com.ur
l
2013-09-16
01:22:30 ART
Internet
Explorer
go.microsoft.c
om
http://go.microsoft.com/
fwlink/?linkid=55424
Microsoft At
Home.url
2013-09-16
01:22:30 ART
Internet
Explorer
go.microsoft.c
om
http://go.microsoft.com/
fwlink/?linkid=68920
Microsoft At
Work.url
2013-09-16
01:22:30 ART
Internet
Explorer
go.microsoft.c
om
https://
ieonline.microsoft.com/
#ieslice
Suggested
Sites.url
2013-09-16
01:22:53 ART
Internet
Explorer
ieonline.micro
soft.com
Web cookies:
URL Date/Time Name Value
2013-09-24
23:48:11 ART
adadvi
sor.net/
2013-09-16
01:24:25 ART ab
0001%3A9CPJ3rUbYppOGmD7eyw
IX%2FN2aOUswRha
adnxs.
com/
2013-09-16
01:24:18 ART sess 1
atdmt.c
om/
2013-09-24
23:48:12 ART MUID
147652629A706E11027557289E706
C24
bing.co
m/
2013-09-25
00:25:01 ART SRCHD
MS=3015565&SM=1&D=3002662
&AF=MSN005
bluekai
.com/
2013-09-16
01:24:25 ART bkc
KJ0nRsHQmsfJpwYpluy/
0sEQ8sJQtet59zyczCZWhHARQMz
pG4eUobnvhf9QI9Y7Zydk

11FCM 753 Digital Forensic
boston.
com/
2013-09-16
01:25:04 ART bcpage 0
bs.serv
ing-
sys.co
m/
2013-09-25
00:25:15 ART eyeblaster FLV=-1&RES=2
c.atdmt
.com/
2013-09-16
01:22:48 ART SRM_A
147652629A706E11027557289E706
C24
c.bing.
com/
2013-09-16
01:23:16 ART MR 0
c.msn.
com/
2013-09-16
01:22:48 ART MR 0
crwdcn
trl.net/
2013-09-16
01:24:25 ART _cc_cc
"ACN4nGNQSDYzMEs1NTFPsTBI
skhKTUyxsDAwTDNMTEq1SDY3
SrFgAIIgs%2Fbf%2F%2F%2F%2F
%2F8fAwOioyqwnDBJjYE2818nIw
MTBwPCfkZGBESgX81ICVWDh8
X5UgcQDC1AFJhqgmcHAw52wi5
mB4SxEiGUrhIYp4U7YiVuyXfAw
bkmu1jg8kvUN
%2BIx9jVuSrwKPsZyPF
%2BGWDOC5j1uyYNE53JIydUa4J
ZW5buGWBADzqmL6"
double
click.n
et/
2013-09-24
23:50:43 ART id
cd5965652000093||t=1379305375|
et=730|
cs=002213fd48b37bd4d72207c71d
dynami
cyield.
com/
2013-09-16
01:24:18 ART DYID 504059620
exelato
r.com/
2013-09-16
01:24:27 ART ud
eJxrWVyWWnRgUUnxaccrvQv
%252F7TazXhzq6XKLQcE41cggM
dnU0Mw8OdXI0sgs2TjZMM0yycL
czNDc1DjJcHFRShojADsJFrQ
%253D
flashtal
king.co
m/
2013-09-16
01:24:09 ART flashtalkingad1 "GUID=208541B48BA6F6"
google.
com/
2013-09-25
00:25:15 ART NID
67=bmuaVn5dnn-RZjzj11VIAV-
sDxuzyFvLBTzCjDF-
v2QZdNOqiwhO72e4YDVz9c_kyZ
0lyclhT4YzfIxkQclIxumlu8ST_PIFd
QeN-
rvOWrqrMvxgAAqDvJqTzqEXUSX
a
gravity
.com/
2013-09-16
01:24:18 ART vaguid
f9d9a9b5462b53434c96bb6c45b4ba
32
ib.moo
kie1.co
m/
2013-09-16
01:24:26 ART ibkukiuno
s=a191274d-6735-483d-a923-
479fda323414&h=&v=0&l=-
8588223014199337935&op=0&m=0
imrwor
ldwide.
com/
2013-09-16
01:24:18 ART V5
AStfNwMVAFYrEhozMSYjIy07IB
kkEVInHlLUrg__
micros
oft.co
2013-09-24
23:48:11 ART
MC1 GUID=dcfa2d1ee594de44ab28a64a8
8738434&HASH=1e2d&LV=20139