”
Please navigate to the Lab Callout Box within the Content section (see Activities) for this week which also includes detailed instructions for this assignment. All links to open the appropriate documents and to launch the Citrix virtual environment will be found at this location.Examiner NameCMIT 424**Remove / replace all red writing prior to submission**To:Requestor InformationDate:Report DateCase #:XXXXXXTitle:Case Title, I.E. Suspect Name & Type of CaseDate item(s) received:Date received by examinerItem(s) Submitted for Exam:Item#Description Make Model S/N#Case Summary:A summary of the request, i.e. by whom, why, what is being ask to search for and recover,etc. Why is this examination being conducted?Legal Authority:Search warrant, consent, government/organizational property, etc.Software Tools Used:Tool Name Version Used ForEx. Windows 1010.0.17763Operating system of forensiclaptop.Hardware Tools Used:(simulate write blocker(s) and system information)Tool Name S/N# Used ForEx. Tableau TD2u#12345Hard drive imaging.1Preliminary Findings:This is a synopsis of what you found of forensic value i.e. Out of analyzing “x” number offiles, “x” were of forensic value; briefly describe the types of files discovered (you’ll get intothe details in the next section).Also briefly describe the partition and file structure of the media examined i.e. partitions,volume names, sizes, files systems.Details of Examination:(This will typically be the longest part of this document.It is more thanjust answering the case questions!Please be sure to read theassignment deliverables carefully at the end of each lab).Describe your examination procedures performed, i.e. signed for items for examination,photographed evidence, conducted pre/post hash (describe why you perform hash analysis -show both acquisition and verification hash sums), describe tools validation procedures(your forensic hardware and software), anti-virus scans conducted.Documentation of results to include answering questions detailed in the request, etc. This iswhere thefiles of forensic interestare reported on and linked to the case questions /scenario. Findings should be described just not with words but snippets, screen shots, andaddendums when practical.If you feel that some detailed findings would be better placed in an addendum that is fine.Including triage tables, snippets of your findings, and other visual aids will better visuallyguide the reader so consider using those in the labs and definitely the FR1 and FR2assignments. Remember that readers of these reports are often not technical by trade.Including an evidence photo(s) is also best practice (see Addendum A).Conclusion / Recommendations:State the facts only and avoid opinion / emotional explanations. Detail any furtherexaminations that maybe required, interview questions of subject(s) if applicable, whatcould further be done in the investigation from the outcome of your examination, etc.Dispositionof Evidence:Document here the disposition of the items submitted for exam, i.e. stored in evidencecontrol, returned to requestor etc.Report End2Addendum A: PhotosSimulate with pictures of similar devices you can find on the Internet. It is best practices toinclude a picture(s) of the evidence you examined. For example:The following is a photograph of Lenovo Laptop, Model 7834, Serial #765432.PICTURE(s) SHOWN HERE (find an example using “Google Images”)You may want to include the hash values in this area and just refer the reader to Addendum Ain the main document.Example:The following details the forensic image processing.Example: Seagate Hard Drive, 250GB, Serial #12345:Digital Forensics Examiner (DFE) created forensic evidence files of XXXX drive #XXXX.The pre-processing hash results are presented below:MD5 checksum: XXXXSHA1 checksum: XXXXThe forensic processing subsequently created XXXX (X) files (simulated).Forensic Evidence Files Created: XXX.E01 – XXXX.E04 (example with four files)The forensic imaging process involved a post processing hash verification of the contents of theevidence file compared with the pre-processing hash. The hash analysis is presented below.MD5 checksum: XXXX: verifiedSHA1 checksum: XXXX: verifiedThe forensic imaging process successfully created a forensically sound and verifiable bit streamcopy of the hard drive in the form of forensic evidence files.3Addendum B: Steps TakenThese are your notes on the steps you took while conducting the examination. Often, theexaminer must submit their notes along with the forensic report if a case goes to court.I recommend just numbering your steps i.e. 1, 2, 3 in chronological order.Start with how you received the media and describe how you sterilized.For example:1. Original USB drives and CD-Rs received from R. Jones. Items labeled and chain of custody(COC) documentation initiated.2. Forensically sterilized target media prepared using Paladin vX.XX.XXX. After launching thePaladin tool, the target media was physically connected to the workstation running Paladin.Target media was wiped and verified using command “sudo dcfldd pattern=00 vf=/dev/sdc.”Results were a match, verifying the target media was forensically sterile.3. Describe your analysis steps.4. cont’dInclude as many addendums as necessary to fully describe your findings. Ensure that alladdendums are referenced from the summary report.Consider inserting “Bookmarks” (information that you have determined is of evidentiary value)from your EnCase examination either into the “Detailed Findings” section in the summaryreport template or as a separate addendum to fully describe your findings and answer the casequestions (each week’s Lab Lecture document will describe the scenario and case questions tobe answered).Remember to spell check your work before submitting.4
We Write Essays for Students
Tell us about your assignment and we will find the best writer for your paper
Get Help Now!Welcome to originalessaywriters.com, our friendly and experienced essay writers are available 24/7 to complete all your assignments. We offer high-quality academic essays written from scratch to guarantee top grades to all students. All our papers are 100% plagiarism-free and come with a plagiarism report, upon request
Tell Us “Write My Essay for Me” and Relax! You will get an original essay well before your submission deadline.
