1. PROCEEDURE

1.1 Use an evidence form to document the evidence given to you.

1.2 Describe the environment of your forensic workstation and the access to the machine. Describe the procedure that you used to download the image file to your work directory.

1.3 Give at least two SHA-based hash function values of the ISO image.

1.4 Explain why multiple hash values are necessary to verify the validity of the image file.

1.5 Explain the procedure that you used before you could access the image file inside the virtual machine.


2. BINARY DETAILS

2.1 Use a table to document the detailed information of the files found in the root directory of the ISO image-file names, file actual sizes and their MD5 hash values.

2.2 Provide a description of any programs you would like to use based on the files identified on the ISO image.


3. FORENSIC DETAILS
3.1 Describe the key words you used to search the ISO image and explain why you chose them. Detail your search result and give your conclusions. (Document your procedure including commands and screenshots.)

4. LEGAL IMPLICATIONS

4.1 List one violation conducted by Mr. Price against Cybercrime Act 2001, and one violation conducted by Mr. Price against the Crimes Act 1958. Back up your answers with definitions.

4.2 Is this case best pursued as a corporate or criminal investigation? Why?