information security

MSc in Information Security: INM445

MSci in Computer Science with Cyber-Security:

IN3033

Digital forensics

Lecturer: Andrey Povyakalo

15/07/2016

Take-Home Assignment (Re-sit)

Question 1: Incidents and indecent response (MSc: 20 module marks; MSci: 30 module marks )

From the view point of the incident response planning and forensic readi- ness, contrast and compare the following two individual project submission policies: “new” and “old” (below).

Suggest and discuss 2 risk scenarios for the “new” policy, anticipatory, incident management and long term insident response measures for them.

“Old” policy

. . .

You must submit your report both electronically and in hard copy (two copies). e-submission via Moodle: 10 am on the day of your deadline. You will not be able to submit after your deadline. The e-copy of the project report must be in a single file and in non-password protected PDF format. You must also retain the original source (in Word, for instance) until after you pass the module, and submit it if requested. Appendices can be separate files.

Hard copy submission: TWO copies must be submitted to the Programmes Office by 3 pm on the day of your deadline. Note that the submitted hard copies of your project report will not be returned. Furthermore, they must be bound in Citys standard Project Binder: a maroon hardcover binder with The City Uni- versity London in gold on the front and brass binding screws (re- quiring left hand margins of at least 3 cm). Second-hand binders

1

may be available from the Postgraduate Office at no cost; new binders are available for around 12.00 each from the City Uni- versity branch of Waterstones in Northampton Square. Label the

spine of each copy with your name, your project title, the degree you are studying and the year. Ensure these labels will not come loose. In addition, if your project includes software development, you MUST provide TWO CDs or DVDs containing any source code, with a readme file and/or a user manual that describes how to compile and execute the code. Your CDs must be labelled with the same information as your hard copy reports, so as to ensure that they do not get lost if separated.

. . . ”

“New” policy

“ . . .

You must submit your report electronically via Moodle.

You will not be able to submit after your deadline.

The e-copy of the project report must be in a single file and in non-password protected PDF format.

You must also retain the original source (in Word, for instance), preserving its original timestamps, until after you pass the mod- ule, and submit it if requested.

Appendices can be separate files.

Make sure that documents submitted in electronic version only are such that they will print correctly: on-screen reading is not suitable for every reader and for every document, so your marker may need to print your file. Of course also make sure they will read well on screen.

In addition, if your project includes software development, you must provide two CDs, DVDs or USB drives containing any source code, with a readme file and/or a user manual that de- scribes how to compile and execute the code. Your media must be labelled with the same information as your report, so as to ensure that they do not get lost if separated.

Feel free to submit hard copies of any specific items that are not suitable for on-screen reading (e.g., large diagrams) Please sub- mit the online items to a member of staff (not the hole-in-the- wall submission boxes) the Programmes Office. Please clearly

2

label your submission with: - Name; - Course; - Student num- ber; - Project supervisor. The Programmes Office will supply A4 brown envelopes and standard university binders if required.

On submission you will be required to sign and date as receipt of submission . . . ”

Question 2: Legislation and Regulations (MSc: 20 module marks): MSci: 30 module marks

Conduct literature search, discuss (briefly), contrast and compare two legal frameworks for admissibility of digital evidence:

• based on ACPO guidelines (UK) 1

• based on Daubert criteria (US) 2Are their scopes comparable? Are they solving the similar problems? Are they missing something that other covers? Give examples (case studies) illustrating your analyses.

Question 3: Data recovery, Data Carving and Evidence Anal- ysis (MSc: 40 module marks; MSci: 40 module marks)

• Analise the provided disk image. Find at least 22 pieces of evidence directly related to the digital forensics module INM455

• Pieces of evidence are considered different if their locations on the disk image are different

• Report your findings, justifying their forensic soundness.

[Pieces of evidence: 40%; Methods of obfuscation discussed: 20%; Foren- sic soundness: 20%; Reporting: 20%]

Question 4: Network forensics (MSc only: 20 module marks

• Analise the provided pcap file looking for any signs of malicious activ- ities.

• Report your findings, justifying their forensic soundness.

[Evidence of the software working: 40%; Findings: 40%; Reporting: 20% ]

1 . . . you can start your reading with the lecture 3 notes and ”In Brief”article: http: //www.inbrief.co.uk/court-proceedings/computer-evidence.htm

2 . . . you can start your reading with the paper by Ryan and Shpantzer: http://euro. ecom.cmu.edu/program/law/08-732/Evidence/RyanShpantzer.pdf

3

General recommendations

Consider the lecturer, the second setter and the external examiner as your audience. Please, don’t waste the submission space on the textbook material and trivial introductory discourse, use the references and hyper-links as much as possible. Use the bullet point lists to save the words and make clear points of your answers.

Deadline

11:59pm on Monday 15/08/2016

Submission

All coursework submitted for summative assessment (that is, the final ver- sions of your assignments) should be:

• up to 3,000words in length

• generated as .pdf from a word processor (e.g. Word, LaTeX) on A4 paper size

• name, module code, assignment number and page numbering on each page of the submission

• text set out in one-and-a-half or double line spacing and with generous margins

• electronically submitted via Moodle (see section* 3.17 of the pro- gramme handbook).

Assessment criteria

You can refer to the university assessment and feedback policy by following the link:

http://www.city.ac.uk/__data/assets/pdf_file/0008/68921/assessment_

and_feedback_policy.pdf

4