QUESTION 1:

(a) A financial fraud has happened in BABA Bank. Your services have been retained as forensic examiner to investigate the above case.

While investigating you receive a mail whereby the chairman of the board mentioned, 'it would have been great if we could get the report as soon as possible so that we can take a quick decision'.

i. 'it would have been great if we could get the report as soon as possible so that we can take a quick decision'. As forensic examiner how would you reactto this mail?

ii. While investigating the objective must be clear to you.

What could it be?

iii. What could be your priority in BABA's case?

iv. Give the steps you would be following to investigate this case.

QUESTION 2:

Chain of custody in evidence collection is a very important document when it comes to presenting a computer forensic case in the court of law.

i. Explain the term chain of custody

ii. Why according to you is the chain of custody so important?

iii. In a chain of custody form there are four important information that need to be present.

a) Name the four important points.

b) Design a chain of custody form and fill in appropriately dummy information.

iv. To ensure integrity of evidence collected from a crime scene, there are two main method of doing so. Describe them

QUESTION 3:

(a) Being just employed as junior forensic examiner at SAI computer forensic Ltd, your supervisor told you, 'hey MoonaTambi, we have received a hard disk for examination, I would like you to analyze the areas on this hard disk where we can get hidden information and document your findings'.

Stunned I looked at his face. I said to myself, 'how the hell will i do it'.

Surprisingly the supervisor starts asking:

i. Where data could be hidden? Give two places and explain them in detailed.

ii. What command would you use to take a backup and restore the first sector of the hard disk in Linux?

(b) After that your supervisor has asked the above questions, he realized that you have just been recruited and hence he himself did the analysis. Whenretrieving 'a.ii' he could only get the below information about the hard disk.'MoonaTambi, I have already retrieved the required information, we needthe hard disk size to finalize our report, please calculate the size of it andlet me know', instructed my supervisor with a smile on his face and againadded, 'hope this time I will not have to come and do it. Don't forget it's aWindows machine with FAT 32.'

1. 16,384 cylinders

2. 80 heads

3. 63 sectors per track

(c) Briefly explain the different types of file systems that you as forensic expert would be experiencing.

QUESTION 4:

a)

i. No doubt Air Force Computer Forensics Laboratory must be having a very good Lab setup to perform the tasks mentioned in the case study.

What are the basic configurations that computers Forensics

Lab need to have?

ii. What are the structural design considerations that Air Force Computer Forensics Laboratory must have considered?

b) You have been called to go on a crime scene to see whether there is any digital evidence that must be collected. You noticed a cell phone lying down at the crime scene. You collected the may-be evidence and transport it to your office.

i. Explain the five major points that a forensic examiner needs to observe before embarking on the collection of the cell phone lying down at the crime scene.

ii. Before transporting the evidence to your office, you must have followed certain principle so as not to tamper with the may-be evidence collected. Name the six principles that you followed.