Task 1: Recovering scrambled bits

Scrambled bits on the subject site closer to the assignment due date. You will be required to restore the scrambled bits to their original order and copy the plain text in your assignment.

Deliverable: Describe the process used in restoring the scrambled bits and insert plain text in the assignment.

Task 2: Revealing hidden information from an image

For this task I will provide an image with hidden information in it. You will be required to reveal the hidden information.

Deliverable: Describe the process used to reveal the hidden information from the image and copy the revealed information in the assignment in plain text.

Task 3: Forensics Report

In this major task you are assumed as a Digital Forensics Examiner. Considering a real or a hypothetical case you are required to produce a formal report consisting of facts from your findings to your attorney who has retained you. You are free to choose a forensics scenario which can be examination of a storage media (HDD, USB Drive etc), spoofed email, unscrambling bits, revealing information from an image or any other appropriate scenario you can think of.

Rationale

This assessment task covers data validation, e-discovery, steganography, reporting and presenting, and has been designed to ensure that you are engaging with the subject content on a regular basis. More specifically it seeks to assess your ability to:

Determine the legal and ethical considerations for investigating and prosecuting digital crimesanalyse data on storage media and various file systemscollect electronic evidence without compromising the original data;evaluate the functions and features of digital forensics equipment, the environment and the tools for a digital forensics lab;compose technical tactics in digital crimes and assess the steps involved in a digital forensics investigation;prepare and defend reports on the results of an investigation

Successfully revealing hidden text from an image

Hidden text is revealed. Tool used to reveal the text is mentioned and justification to use the tool is also provided. The process to reveal the text is clearly described with screenshots inserted of all steps.

Hidden text is revealed. Tool used to reveal the text is mentioned but the justification is not very clear. The process to restore the text is described with some screenshots.

Hidden text is revealed. Tool used to reveal the text is mentioned but the justification is not very clear. The process to restore the text is described but no screenshots provided.

Hidden text is revealed. No justification of tool used is provided, process seems to be somewhat vague. 

Hidden text is revealed but not matching with the original text. Tool is not mentioned and process is not described.

Task 3: Forensics report

Criteria

HD

100% - 85%

DI

84% - 75%

CR

74% - 65%

PS

64% - 50%

FL

50% - 0

Introduction:

Background, scope of engagement, tools and findings

All elements are present, well expressed, comprehensive and accurate.

All elements are present and largely accurate and well expressed.

All elements are present with few inaccuracies.

Most elements are present possibly with some inaccuracies.

Fails to satisfy minimum requirements of introduction.

Analysis: relevant programs, techniques, graphics

Description of analysis is clear and appropriate programs and techniques are selected. Very good graphic image analysis.

Description of analysis is clear and mostly appropriate programs and techniques are selected. Good graphic image analysis.

Description of analysis is clear and mostly appropriate programs and techniques are selected. Reasonable graphic image analysis.

Description of analysis is not completely relevant. Little or no graphics image analysis provided.

Fails to satisfy minimum requirements of analysis.

Findings:

specific files/images, type of searches, type of evidence, indicators of ownership

A greater detail of findings is provided. Keywords and string searches are listed very clearly. Evidence found is very convincing. Indication of ownership is very clear.

Findings are provided, keywords and string searchers are listed. Evidence is sound. Ownership is clear.

Findings are provided, some keywords are listed. Evidence is reasonable which relates to the ownership.

Findings are provided but are somewhat vague. Keywords and strings are not very clear. Evidence found may be questionable.

Fails to satisfy minimum requirements providing findings.

Conclusion:

Summary, Results

High level summary of results is provided which is consistent with the report.

Well summarised results and mostly consistent with the findings. 

Good summary of results.

Able to relate the results with findings. No new material is included.

Satisfies the minimum requirements. Results are not really consistent with the findings.

Fails to satisfy minimum requirements of summarising the results.