Question

Guide to computer forensics and investigations hands-on project 4-3

Answer 1

In order to examine the USB drive belonging to Terry, the IT person for M57 Patents, and ascertain whether Terry is involved in anything illicit or against company policy, you will need to follow a step-by-step process in computer forensics and investigations.

Here is a guide to help you:

• Start by creating a forensic image of the USB drive to preserve its contents without altering them.
• Analyze the image using forensic tools to identify any suspicious files, folders, or activity. Look for evidence of illicit activities such as unauthorized access or unauthorized transfer of sensitive data.
• Examine file and folder timestamps, metadata, and access logs to trace any unauthorized or suspicious activities back to Terry.
• Recover deleted files and artifacts, if necessary, to gather additional evidence.
• Perform keyword searches to look for any indications of illegal or policy-violating behavior.
• Document all findings, including the steps you took, the evidence you found, and the conclusions you draw.
• Prepare a detailed report summarizing your investigation and present it to the relevant parties for further action if required.

Step-by-step explanation:

In Hands-On Project 4-3 of the "Guide to Computer Forensics and Investigations," you are tasked with examining a USB drive that belongs to Terry, the IT person for M57 Patents. The objective of this project is to determine if Terry is involved in any illicit activities or if he is violating company policies.

Here is a step-by-step explanation of how you can approach this project:

• 1. Preparation: Before you begin the examination, make sure you have the necessary tools and software required for computer forensics analysis. This may include forensic software, write-blocking devices, and hardware for data preservation.

• 2. Acquiring the USB drive: Use a write-blocking device to ensure that no changes are made to the USB drive during the acquisition process. Create a forensic image of the USB drive using specialized software, which will create a bit-by-bit copy of the drive for analysis.

• 3. Analysis of file system: Begin by examining the file system of the acquired USB drive. Use a file system analysis tool to explore the directory structure and metadata of the files. Look for any suspicious or hidden directories, files with unusual names, or files in unexpected locations.

• 4. Carving for deleted files: Perform file carving on the USB drive to recover any deleted files. This process involves searching the drive for file signatures or specific file headers to identify and extract deleted files. Pay attention to any recovered files that might be relevant to the investigation.

• 5. Keyword search: Conduct a keyword search on the USB drive to identify any files or documents containing specific terms or phrases that may be relevant to the investigation. This can be done using forensic software that supports keyword searching capabilities.

• 6. Internet history analysis: Examine the internet browsing history of the USB drive. Analyze web browser artifacts, such as browser cache, cookies, and bookmarks, to determine if Terry has visited any suspicious or unauthorized websites.

• 7. Communication analysis: Look for evidence of communication on the USB drive. This could include email messages, chat logs, or instant messaging conversations. Analyze these communications for any indications of illicit activities or policy violations.

• 8. Timeline analysis: Create a timeline of events based on the timestamps of files, directories, and system logs on the USB drive. This timeline can help establish a sequence of events and identify any suspicious activities or patterns.

• 9. Reporting: Compile all the findings and observations into a comprehensive report. Include detailed information about the analysis performed, any suspicious files or activities identified, and your conclusions based on the evidence.

• 10. Presentation: If required, prepare a presentation summarizing the findings of your investigation. Present the report to the relevant stakeholders, such as management or legal authorities, providing a clear and concise overview of the evidence discovered.

Remember, throughout the investigation process, it is essential to maintain the integrity of the evidence, document your actions and procedures, and follow legal and ethical guidelines for computer forensics investigations.

Your question is incomplete, but most probably the full question was:

Guide to computer forensics and investigations: Hands-On Project 4-3(explain it step by step)

In this project, you examine a USB drive belonging to Terry, the IT person for M57 Patents. Your job is to ascertain whether Terry is involved in anything illicit or against company policy.