Assignment Files and supporting documents

Discussion

Imagine you are testifying in court about anomalous activity on the network. The attorney asks you how the Internet traffic indicated unusual activity and how you knew this was unusual. Explain how you would answer this question on the stand using two specific examples and discuss how these examples would convince the attorney that your reasoning as to how you knew the internet traffic was unusual was valid.  

Assignment 1

Directions:  Follow the download step and then fully answer each of the questions.

First:

Download a free hash tool or the command line interface. Create word document with one sentence or phrase. Save the word document. Hash the document. Record the hash value. Make one change to the word document (e.g., delete character or word, tap the space bar). Save the word document. Rehash the document. Record the hash value.

After doing the above, answer/do the following questions/prompts:

· Submit the hash values from each version of the document created.

1. What happened when the document had one change?

2. Discuss two functions of hashing.  Why are these functions important and what value can they potentially bring to a criminal case?

3. Discuss the importance of integrity verification and how hashing helps in this initiative.

4. How does the hash value provide integrity for an image or forensic copy? Specifically discuss how this could be valuable for digital evidence.

5. Explain why validation of hashing tools becomes important, and how the validation is different between the use of two different tools.

Assignment 2

Directions:  Follow the download step and then fully answer each of the questions.

First:  Download the enclosed image. Using a search tool, locate the enclosed list of words in the image.

After doing the above, answer/do the following questions/prompts:

· Record the offset or screen shot of their location and place them in a document.

1. Identify and discuss three examples of how searching for a string or part of a string can be valuable in an investigation?

2. Describe a strategy for searching a device with only part of a person’s name. In describing the strategy, address what you would look for and why and how you would search if the partial name was found on a deleted document. Also discuss two pros and two cons of this strategy.

3. Discuss the particularity requirement of the fourth amendment and its application to computer searches. Specifically, assuming that a person who is subject to the search and seizure of their computer as a reasonable expectation of privacy in the contents of the computer (therefore requiring a warrant), how should the particularity requirement be applied to computer searches?

4. Describe why establishing a baseline in memory forensics is important; and equally, describe how rogue processes are identified and why is it important to understand them.

ASSIGNMENT 3

Directions:  Follow the download step and then fully answer each of the questions.

First: Download a free-imaging tool and install it on your computer.  Image a hard drive/USB drive/Media to include the hash value.  Provide a screenshot of your image or log file created once the image is completed.

After doing the above, answer/do the following questions/prompts:

Create a report of the media imaged that includes the screenshot, and specifically discusses the following:

1. Integrity of the evidence including a discussion regarding how you verified the integrity of the image created.

2. How did you verify that the imaging tool created the image? How would you test the tool prior to imaging the media or device? Why would you use this technique to test the tool?

3. Discuss the search technique used for finding documents. Describe a search strategy for the image you created that would find documents with the date “2020” on the device. Use this search strategy- how many total documents are there?

4. Discuss comparison methods used to examine the media image. What comparisons would you make in the image created to eliminate files without “2020” in them?

Format Requirements:

· Paper must be double spaced, 11 or 12 pt font and 1” margins all around.

· All APA 7th edition format requirements must be followed (cover page, in text citations, reference page). Refer to APA/UMGC - learning resources found in the content page of this course.

· You must have resources to support your thoughts/opinions/information.  These must be cited both in text as well as at the end of the document. Your paper should not contain direct quotes, sourced material must be paraphrased.