Context: [Fictional] The XYZ security team received a notification that suspicious cyber activity is taking place in Wilson Building. Surveillance cameras showed that a person, who could be the suspect, was seen in room Wilson 5000 and then he left. When

TSCF – Assignment 01

Name	ID	Grade/30 pts

In this assignment you will work on the first steps of seizing and imaging an evidence.

Objectives:

· Learning how to seize a digital evidence found on the scene of the incident

· Being aware of the Dos and Don’ts when handling the evidence

· Filling the chain of custody and Learning its importance.

· Identifying the tools, both hardware and software, required for imaging the evidence data

· Preforming the imaging process which can be cloning or just imaging

· Validating the created image of evidence data

Context: [Fictional]

The XYZ security team received a notification that suspicious cyber activity is taking place in Wilson Building. Surveillance cameras showed that a person, who could be the suspect, was seen in room Wilson 5000 and then he left. When the team arrived at the scene, they only found a USB drive that could have been used in implementing the suspicious activity. They decided to seize it so they can perform the needed analysis to identify its content.

Scene Location: Wilson 5000

Evidence: A USB drive [Please use your own USB drive. Try to get a drive with 2 GB to avoid any space issues with your parrot machine, especially if you are using Parrot Linux Live]

· Will a warrant be needed in this case? Justify/Add references [ 5 pts ]

[Based on: Scientific Working Group on Digital Evidence]

· General Instructions: [Seizing the Evidence]

1- Ensure the safety of all individuals at the scene. [X]

2- Protect the integrity of evidence. [X]

3- Evaluate the scene and formulate a search plan. [X]

4- Identify potential evidence. [The USB drive given to you]

5- All potential evidence should be secured, documented, and photographed. [ 5 pts ]

a. For this assignment No need to secure; just document and photograph.

i. Caption for photos/figures is required.

6- Conduct interviews. [X]

7- Any item to be removed from the scene should be properly packaged and secured. [X]

· For Removable Drives:

1- Document the location and condition of all removable media [ 2 pts]

a. For this assignment: The USB drive. For describing the location you can describe any lab in Wilson building or the lab in ovr302.

2- Remove any connected external media (e.g. external drives or thumb drives) after the computer has been powered down. [X]

· Creating the image:

1- Document the tools you plan to use. [ 5 pts ]

a. For this assignment:

i. Hardware [X]

1. Tableau Forensic USB 3.0 Bridge

2. T8u:

a. Firmware:1.5.0.1, Date: 10/31/2016 , Time: 11:47:27

b. Serial: 000ecc13 0008415f

ii. Software.

2- Describe the steps/work plan for creating the image. [ 3 pts ]

a. For each step include a snapshot/print-screen in the report.

i. i.e. Every command and its output have to have a separate print-screen.

3- Create the image using the Parrot Security Linux distribution. [10 pts ]

a. Verifying the disk and the image are important

4- Use the chain-of-custody document to describe the item and fill required information. [ 5 pts]

a. Assume that the evidence was released to another person on the team, and fill the necessary information.

Guidelines:

For the assignment above, you need to do the following:

1- The document you should deliver has to be formatted very well.

2- Form groups of 2 students. Please avoid asking me for exceptions. You can do the assignment alone if you could not find a partner.

a. One submission per group is sufficient.

3- Looking at the points above, you do not need to worry about the steps where there is an [X] mark. Only, you perform the steps marked with points.

4- When adding pictures to the report, you should put a good descriptive caption below each picture.

5- Try to explain what you are doing during the process in a simple language that avoids any slang.

6- The report you will deliver has to have:

a. Table of contents that show all the content of your work, including the parts marked with [X] that you are not asked to do but they have to be in the report.

b. Use references/citations when you are using any external resources such as a tool, a website, book, …etc.

i. The references should appear at the appendix of the report; i.e. at the end of it.

c. Make sure that fonts used are consistent for text and titles.

7- Not following the instructions will result in point deduction; up to %30 of the grade.

8- Submitting after the deadline will result in %10 pints off for each additional day up to %30. After that the assignment will not be accepted and ZERO grade is given.

9- Please start the report with a title page that has names and ID numbers.

EVIDENCE CHAIN OF CUSTODY TRACKING FORM

Case Number: ________________________ Offense: ______________________________

Submitting Officer: (Name/ID#) _______________________________________________

Victim: ______________________________________________________________________

Suspect: _____________________________________________________________________

Date/Time Seized: __________________Location of Seizure: ______________________

Description of Evidence
Item #	Quantity	Description of Item (Model, Serial #, Condition, Marks, Scratches)

Chain of Custody
Item #	Date/Time	Released by (Signature & ID#)	Received by (Signature & ID#)	Comments/Location

APD_Form_#PE003_v.1 (12/2012) Page 1 of 2 pages (See back)

EVIDENCE CHAIN-OF-CUSTODY TRACKING FORM (Continued)

Chain of Custody
Item #	Date/Time	Released by (Signature & ID#)	Received by (Signature & ID#)	Comments/Location

Final Disposal Authority

Authorization for Disposal Item(s) #: __________ on this document pertaining to (suspect): ____________________________________________ is(are) no longer needed as evidence and is/are authorized for disposal by (check appropriate disposal method) ☐ Return to Owner ☐ Auction/Destroy/Divert Name & ID# of Authorizing Officer: ____________________________ Signature: ______________________Date: _______________

Witness to Destruction of Evidence Item(s) #: __________ on this document were destroyed by Evidence Custodian ___________________________ID#:______ in my presence on (date) __________________________. Name & ID# of Witness to destruction: ________________________ Signature: ______________________Date: _______________

Release to Lawful Owner Item(s) #: __________ on this document was/were released by Evidence Custodian ________________________ID#:_________ to Name _____________________________________________________________________________ Address: ________________________________________________ City: ____________________State: _______ Zip Code: __________ Telephone Number: (_____) ___________________________________ Under penalty of law, I certify that I am the lawful owner of the above item(s). Signature: _______________________________________________________ Date: __________________________ Copy of Government-issued photo identification is attached. ☐ Yes ☐ No

This Evidence Chain-of-Custody form is to be retained as a permanent record by the Anywhere Police Department.

APD_Form_#PE003_v.1 (12/2012) Page 2 of 2 pages (See front)