LAB2 CSEC 650 UMUC.  You have a run a virtual lab, make screen shots and answer questions abou the lab.

1

CSEC650 Lab2 Instructions, Questions, and Grading Criteria

Scoring Range: 0-100 points Weight: 10% of course grade Due date: Sunday, Week 8 ------------------------------------------------------------------------------------------------------------------- General Directions: Preview the lab deliverables in Part I and the questions in Part II below first before starting your lab work. Then, log into UMUC Virtual Lab and perform steps 1 through 50 sequentially using the step-by-step instructions and illustrations given on pages 2-43 of the PDF file named: CSEC 650 Lab2 Write-up.pdf (Lab2- Write-up). During the lab process, you should capture and paste the five screenshots listed under Part I, A into your Word answer file. You also need to take notes during the lab for other deliverables under Part I and for answering the lab questions under Part II which you have previewed. Note: Any updates in the lab system and procedures will be provided separately. Warning: You cannot skip any step or you may not be able to complete the lab and get the expected results. Create ONE Word or PDF answer file named as Lab2-YourFirstInitial-LastName. Include all your deliverables and answers for Part I and Part II below in this ONE file. Submit this ONE file under WebTycho Lab2 Assignment by the due date. Part I: Lab Deliverables (30 points): A. Screenshots (10 points; 2 points each): Capture and paste the following five screenshots into your Word answer file during the lab work. Write one short sentence right before each screenshot to briefly describe what the screenshot is about. 1. A screenshot similar to (may not be exactly the same as) the illustration on page 6 of the Lab2 Write-up. 2. A screenshot similar to (may not be exactly the same as) the illustration on page 16 of the Lab2 Write-up. 3. A screenshot similar to (may not be exactly the same as) the illustration on page 31 of the Lab2 Write-up.

2

4. A screenshot similar to (may not be exactly the same as) the illustration on page 32 of the Lab2 Write-up. 5. A screenshot similar to (may not be exactly the same as) the illustration on page 37 of the Lab2 Write-up. B. Log of Forensic Analysis (10 points): Create a numbered list or a table to document the important step-by-step actions taken by the examiner sequentially for the digital forensic work in this case. Include any relevant date, time, action, devices, tools, data file names, summaries of search results and analysis, etc. C. Report Letter to the Professor (10 points): Write a letter to the Professor listing and explaining clearly and concisely what was attempted, what failed, what was successful, and what was learned through the lab work. Note: For the Report Letter to the Professor, you can use the major action information from the Log of Forensic Analysis deliverable but should focus on the forensic objectives, attempts, and results of accomplishment or failure, followed by a reflection on what you have learned through the lab. Use a business letter format with at least four or five paragraphs related to the forensic work. Part II: Lab Questions (70 points): Give your answer to each of the following questions based on your lab work and relevant readings and course materials. Each original question must be visible. Each answer should be no more than two paragraphs and should be clear and correct in grammar. Any citations of sources should follow proper APA format with a reference section at the end of your Part II answers. 1. Based on the Request for Analysis pdf document, come up with five keywords that would be good to search for in this investigation. 2. What is the hash value of the forensic image during verification of the evidence in Autopsy? You must attach your screenshot for the hash value you obtained during the lab. Does it match the information provided in the Request for Analysis? What is the significance of the hash values matching? 3. Why is it important to keep the source drive with the image as read-only permissions when mounting the drive? 4. What is a dd image? 5. Find a file of interest to this investigation from the image drive by exploring the image in Autopsy and explain why you believe the file is of interest in the investigation.

3

6. Find a deleted file of interest to this investigation from the image drive by exploring the image in Autopsy and explain why you think the file is of interest in the investigation. 7. Why should investigators take notes and annotate time/dates? What is this useful for? 8. What type of file system was the forensic image evidence collected from? 9. Based on the lab, whom was Joey Lawless communicating with? Explain with evidence. 10. Based on reviewing the image, what do you think Joey Lawless was communicating about? Explain with evidence.