Computer Evidence

This project will provide an introduction to digital forensic analysis.

Digital forensic analysis is used to review and investigate data collected through digital communications and computer networks. The National Institute for Standards and Technology (NIST) has defined four fundamental phases for forensic analysis: collection, examination, analysis, and reporting. You will learn more about these concepts as you navigate throughout the steps of this project and read the literature and links found in each step.

There are four steps that will lead you through this project. Begin with Step 1: “Methodology. The deliverables for this project are as follows:

1. Digital Forensic Research Paper: This should be a five-page double-spaced Word document with citations in APA format. The page count does not include diagrams or tables.
2. In a Word document, share your lab experience and provide screenshots to demonstrate that you completed the lab.

When you submit your project, your work will be evaluated using the competencies listed below. You can use the list below to self-check your work before submission.

• 5.3: Use defensive measures and information collected from a variety of sources to identify, analyze, and report events that occur or might occur within the network in order to protect information, information systems, and networks from threats
• 8.6: Provide professional preparation for the field-the process of computer forensics, the broad spectrum of topics within digital forensics and computer crimes, and the role of digital evidence in criminal and civil investigations and information securit
• 8.7: Provide theoretical basis and practical assistance for all aspects of digital investigation and the use of computer evidence in forensics and law enforcement.

Step 1: Methodology

The methodology includes following a systems process. Identify the requirements, purpose, and objectives of the investigation. Click the links below to review information that will aid in conducting and documenting an investigation:

• secure programming fundamentals
• forensics fundamentals

Learn about the investigation methodology. Consider secure programming fundamentals. Define the digital forensics analysis methodology, and the phases of the digital forensics fundamentals and methodology, including the following:

1. preparation
2. extraction
3. identification
4. analysis

This information will help you understand the process you will use during an investigation.

Step 2: Tools and Techniques

Select the following links to learn about forensics analysis tools, methods, and techniques:

1. forensics analysis tools
2. web log and session analysis
3. hash analysis

Step 3: Exploring Forensic Tools

Note: You will utilize the tools in Workspace for this step. If you need help outside the classroom, you can register for the CLAB 699 Cyber Computing Lab Assistance (go to the Discussions List for registration information). Primary lab assistance is available from a team of lab assistants. Lab assistants are professionals and are trained to help you.

Click here to access the instructions for Navigating the Workspace and the Lab Setup.

Explore the tutorials and user guides to learn more about various types of digital forensic tools.

You have now learned about the different types of tools, techniques, and analyses. With digital forensic tools (e.g., FTK Imager) you can create forensic images of local hard drives, floppy disks, Zip disks, CDs, DVDs, entire folders, and even individual files from various places within any media storage device. Many times, the forensic tool that captures the images is interoperable with other tools that aid in the analysis (e.g., EnCase). These tools are integral to information assurance and monitoring, and for tracking all events in the investigation.

Step 4: Digital Forensics Research Paper

Now that you have learned basics of digital forensics analyses and methodology, and have experienced one of the common forensic tools, use the material presented in this project as well as research you’ve conducted outside of the course materials to write a research paper that addresses the following:

1. digital forensic methodology
2. the importance of using forensic tools to collect and analyze evidence (e.g., FTK Imager and EnCase)
3. hashing in the context of digital forensics
4. How do you ensure that the evidence collected has not been tampered with (i.e., after collection)? Why and how is this important to prove in a court of law?

The deliverables for this project are as follows:

1. Digital Forensic Research Paper: This should be a five-page double-spaced Word document with citations in APA format. The page count does not include diagrams or tables.
2. In a Word document, share your lab experience and provide screenshots to demonstrate that you completed the lab.

Submit your deliverables to the assignment folder.

Before you submit your assignment, review the competencies below, which your instructor will use to evaluate your work. A good practice would be to use each competency as a self-check to confirm you have incorporated all of them in your work.

• 5.3: Use defensive measures and information collected from a variety of sources to identify, analyze, and report events that occur or might occur within the network in order to protect information, information systems, and networks from threats
• 8.6: Provide professional preparation for the field-the process of computer forensics, the broad spectrum of topics within digital forensics and computer crimes, and the role of digital evidence in criminal and civil investigations and information securit
• 8.7: Provide theoretical basis and practical assistance for all aspects of digital investigation and the use of computer evidence in forensics and law enforcement.