Digital Forensics Project: Data Recovery and Report Generation

Desklib provides solved assignments and past papers to help students succeed.

University
Semester
Networking
Student ID
Student Name
Submission Date
1

Executive summary
We shall be discussing about the Digital theft and recovery procedures in this project.
The project is split in to two parts. In the first part of this project we shall recover, by using
the Winhex digital forensics tool, the scrambled bits for providing the effective data recovery for
digital forensics analysis. In the second part of this project, for the Intellectual property theft for
a latest member of Superior Bicycles Inc, this work deals with formulation of a digital forensics
report. At Superior Bicycles Inc, an employee Jim Shu, is removed and in his place a new
employee Tom Johnson was taken in. A peculiar mail has been received from Terry Sadler
containing the new project details of Jim Shu were received by the External investor/Contractor,
Bob Aspen. As the project looked interesting and impressive, he forwarded the email to Chris
Robinson incase capital investment is required.
Now for this project, any form of digital photograph as an evidence will be considered for
determining any further data of proprietary Superior Bicycles Inc. We shall make use of tools
like FTK imager and Autopsy tool for further investigation of the USB drive and the data in it.
Finally, after completing the full analysis, in this work a detailed digital forensics report is
formed. This will be further studied and evaluated so as to get a full appraisal for the given
project.
2

Table of Contents
Task 1: Recovering Scrambled Bits.........................................................................................................4
Task 2: Digital Forensics Report..............................................................................................................8
1. Introduction and Background......................................................................................................8
2. Analysis..........................................................................................................................................9
3. Findings........................................................................................................................................14
4. Conclusion....................................................................................................................................21
References................................................................................................................................................22
3

Task 1: Recovering Scrambled Bits
A tool named Winhex digital forensics, shall be used within this task in order to recover
the scrambled data and to get an informative and detailed data recovery for further investigation
on the digital forensics analysis.
We shall follow the below mentioned steps to recover the scrambled bits by using the
Winhex Tool,
First, Winhex software is to be opened as shown in the below image (Advances in Digital
Forensics 9, 2016).
Open the file by clicking on the file name. Select the provided text file by browsing through the
scrambled bits. The below image shows the scrambled bits of text file as selected,
4

Next as shown in the below image, browse the selected file,
5

Next, run the scrambled bit to display the text format of the file as shown in the below image
(Årnes, 2014).
6

“Congratulations” will display on the screen once the task of the unscrambling bits of the
selected file has been completed. It will be seen as a plain text file (Bodden, 2016).
7

Task 2: Digital Forensics Report
1. Introduction and Background
For the Intellectual property theft carried out by a newly recruited member of the Superior
Bicycles INC, the digital forensics report has been prepared. This is the main task of this project.
At Superior Bicycles Inc, an employee Jim Shu, had been removed and in his place a new
employee Tom Johnson was taken in. A peculiar email from Terry Sadler containing the new
project details of Jim Shu was received by the External investor/Contractor, Bob Aspen. As the
project looked interesting and impressive, he forwarded the email to Chris Robinson incase
capital investment is required. After going through the email, he forwards for further details to
the general counsel, Ralph Benison. Further Ralph passes the email to the IT department, Bob
Swartz and asks him to check for attachments with any emails received by the firm. A little
8

inspection carried out by the IT department, identifies an email and they forward this to Chris
Robinson. A USB drive on the desk of Tom Johnson was found by Chris and that USB was
assigned to Tom for some work related matter. Now our task will be to check the USB drive and
find out if it contained any sensitive and vital data information, like images and files which
belonged to Superior Bicycles Inc. Making use of tools like FTK imager and Autopsy tool, we
shall evaluate the contents of this USB drive found from Tom Johnson’s desk. After this, a
detailed Forensic report will be prepared with all the details of the data inside the USB drive. A
detailed and in-depth study and evaluation of this report will be carried out (Bolt, 2011).
2. Analysis
For the USB Drive, the disk image file shall be produced by using the FTK images and this will
part of our analysis of the report so mentioned in the above discussion.
Below is the image of the opening of FTK Imager tool, (Gogolin, 2013).
Below image shows the “choose the create disk image file” by clicking on the File
9

Next select the source evidence type USB as Physical Drive from the options and click on
next .The below image is for the same,
Click on the next button after selecting the source folder, the below image displays the same,
10

Next, “Raw DD” should be the destination image type and the image below is representation of
the same,
11

Below image shows the information about the evidence item which will be entered by the user,
Next, enter the image file name as digital forensics after selecting the image destination to
browse the folder, and then enter, which will be as shown in the below image,
12