M4A1: Conducting a Digital Forensic Examination of Digital Evidence

Image of an investigating officer writing report in front of an open laptop
Image Source: www.istockphoto.com

In this activity, you will complete a lab/forensic examination of digital evidence using Autopsy (Links to an external site.) [website: http://www.sleuthkit.org/autopsy/].

This activity will address module outcomes 1 to 4. Upon completion of this activity, you will be able to to do the following:

Define the steps necessary to conduct a digital forensic examination. (CO# 1, 2)
Explain how ANAB-ASCLD (ANSI-ASQ National Accreditation Board and American Society of Crime Laboratory Directors)/Lab certification requires adherence to standards, including complying with the training manual. (CO# 3, 5)
Describe what the peer review process is as it pertains to digital examination of forensic evidence. (CO# 2, 3, 5)
Demonstrate how to use the free, open source forensic tool, Autopsy, to conduct a digital forensic analysis. (CO# 1, 3, 5)
You will first connect the computer (simulating it as the suspect’s laptop) to a Write Blocker, and then document the steps taken to complete the forensic exam in a report format. The Forensic Examination report can be found here:

Moulin, J. (2015). Digital forensic report template (Links to an external site.) [DOCX file size 54.9 KB]. Digital Forensics. Retrieved from https://www.joshmoulin.com/digital-forensics-incident-response-forms-policies-and-procedures/

The case number that will be used for this Report is 2017-0001.
You will not need to record anything in the “Removed” section of the examination report. For the “Distribution” section of the report, check the case number that will be used for this Report that is 2017-0001 “Other,” and the suspect will be defined as “Involved.” A summary of the digital examination can be recorded in the appropriate area of the digital examination report template as well as any other information that is appropriate.

This scenario involves a Dell laptop E6460 computer that was seized pursuant to a lawfully obtained search warrant that implicates a male subject known as John Doe, who had uploaded illegal Child Pornography (CP) from a website and shared photos in a peer-to-peer network. You will examine the laptop for unauthorized photos (contraband also known as child pornography, which will be denoted as three photos of kittens) contained in computer files. If performed correctly, three photos will be found.

Once you have connected the laptop computer to a Write Blocker and then accessed the Autopsy Tool, you will follow instructions contained in the following link:

Autopsy User Documentation 4.0. (n.d.). Autopsy user’s guide (Links to an external site.). Retrieved from https://www.sleuthkit.org/autopsy/docs/user-docs/4.0/

You will then examine the hard drive and conceptualize an examination of the suspect Dell laptop, using your own laptop/computer for the purposes of this exercise. You will search for the three photos containing contraband (CP) in the user account, John Doe. Once the photos are located, they will be exported onto a CD/DVD and identified as # item 1F, Evidence CD/DVD, analysis results for #item 1. The export of the evidence CD is not required; however, it is important to note that exporting the contraband images for court purposes would be the step taken.

You will document the steps taken to complete the digital forensic examination of the laptop. Go to the following site for guidance:

Moulin, J. (2014, May 10). Disheveled digital forensics: The impact of inconsistent standards, certifications, and accreditation (Links to an external site.). Digital Forensics. Retrieved from https://www.joshmoulin.com/disheveled-digital-forensics-the-impact-of-inconsistent-standards-certifications-and-accreditation/

The downloadable Microsoft Word Evidence Report Template to use in this assignment is titled Digital Forensic Report Template [Docx file size 43.5 KB].

Use the American Psychological Association (APA) style (6th edition) for writing your assignment.