Assignment
Purpose
The purpose of this project is to provide an opportunity for students to apply forensic investigation competencies gained throughout this course.
Required Source Information and Tools
The following tools and resources will be needed to complete this project:
- Course textbook
- Internet access
- Computer with Paraben
- P2 Commander installed
- Outlook.pst (an e-mail archive used in Project Part 2)
Note: Check with your instructor if you do not have access to Paraben P2 Commander. You may be able to download a trial version or use other software, such as Forensic Toolkit (FTK) or EnCase Forensic to complete this project.
Learning Objectives and Outcomes
You will:
• Explain the rationale for computer forensic activities.
• Explain computer forensic investigation procedures.
• Evaluate sources of evidence.
• Analyze laws related computer forensics.
• Apply tools used in forensic investigations.
• Analyze digital evidence.
• Report findings.
• Assess business considerations related to computer forensic investigations.
Deliverables
Part 2: Analyzing an E-mail Archive for an Electronic Discovery Investigation
Scenario
D&B is conducting a very large electronic discovery (eDiscovery) investigation for a major client. This case is so large that dozens of investigators and analysts are working on specific portions of the evidence in parallel to save time and improve efficiency.
Since this is the first time you will be working on this type of investigation for D&B, your manager gives you a "test" (a sample e-mail archive) so she can assess whether you need additional training before you begin working with the rest of the team on the eDiscovery case. Your manager tells you that this archive was extracted from a hard drive image marked "suspect," but at present nothing more is known about the user. She expects you to examine the archive and document all findings that might be of interest to a forensic investigator. She explains that she will use your report to evaluate your investigation skills, logic and reasoning abilities, and reporting methods.
Tasks
• Review the information about e-mail forensics and the Paraben P2 Commander E-mail Examiner feature in the chapter titled "E-mail Forensics" in the course textbook.
• Using the P2 Commander E-mail Examiner, create a case file, select Add Evidence, and import the e-mail archive (filename: Outlook.pst). P2 Commander will automatically begin sorting and indexing if you choose that option.
• Search for information about the user; your goal is to learn as much as possible about who the user is and what he or she has been doing. You may find evidence in the inbox or other mailboxes. You can use the software features to help you keep track of the evidence you identify, for instance, by bookmarking sections of interest and exporting attachments.
• Write a report in which you:
o Document your investigation methods.
o Document your findings. Explain what you found that may be of interest to a forensic investigator, and provide your rationale for including each selection.
Required Resources
- Course textbook
- Outlook.pst file (e-mail archive)
- Internet access
Submission Requirements
- Format: Microsoft Word (or compatible)
- Font: 12-Point, Double-Space
- Citation Style: Follow your school's preferred style guide
- Length: 1 page
Self-Assessment Checklist
- I have applied appropriate evidence collection and handling methods.
- I have correctly identified and analyzed evidence that is relevant to the investigation.
- I have created a professional, well-developed report with proper documentation, grammar, spelling, and punctuation.
https://www.dropbox.com/s/tcesg58divgitki/Outlook-File.rar?dl=0