Computer Forensics 601 (CF601) Assignment 2: 2013, Individual Assessment This Assignment is a Major Written Report and Presentation

worth 35% of the total course mark. The following information explains the assessment requirements and provides the guide to how the assignment will be graded. The assignment is due Friday 10th May 2013. Assignment 2 is an individual assessment. Students will not be permitted to submit group assignments for assessments. Do not forget to provide the essential, signed Assignment Cover Sheet. Not submitting a signed Assignment Cover Sheet will result in no grade being allocated to the assessment. Written assignments are to be checked for plagiarism using TurnItIn. A copy of YOUR TurnItIn Assignment Report is to be submitted digitally together with a digital copy of your Assignment 2 via BlackBoard on or before midnight of the day due. On successful completion of this Major Assignment you will have acquired the knowledge to: Learning Outcomes 1 Undertake basic computer forensic operational tasks, having developed an introductory understanding of the identification, preservation, extraction and documentation of computer evidence using computer forensic techniques and software. 2 Conduct a preliminary investigation requiring an appreciation of computer forensic techniques and practices. 3 Prepare appropriate and necessary documentation to support presentation of evidence in a court of law. Professional Skill Outcomes 1. Become a contributing member of a computer forensics investigation team. 2. Assist in the formulation and implementation of a policy to accommodate corporate computer forensics requirements. 3. Contribute to corporate due diligence and governance processes relating to computer forensic activities. 4. Instigate an investigation and know at which point in time to invite and pass an investigation to law enforcement agency personnel. 5. Use the computer forensics tools and techniques to capture an image, find and analyse digital evidence data, and maintain the integrity of the chain of evidence, and report finding in an adversarial environment. 6. Undertake the necessary documentation associated with basic computer forensic operational tasks. The Scenario Due to your superior understanding of information systems, information security and to your reputed computer forensic expertise you have recently been employed by Galactic Avionics Corporation (GAC) to assist the senior management team develop a holistic solution to their corporations Business Information Management System (BIMS). Your appointment is the result of a Boardroom decision instructing Galactic Avionics Corporation senior management to adopt a proactive approach in regard to information security. A small team of experts has been appointed in compliance with this instruction. This Boardroom decision has been prompted by recent extraordinary events resulting in big data and big data analytic issues along with cloud computing issues and the increasing adoption by staff to use small personal digital devices while conducting corporate business. In addition to

these pressing internal matters, GAC management is concerned about social interactions and reactions between corporate personnel and people outside the corporation especially client based personnel. Of particular concern to GAC is the increasing prevalence of small digital devices and social media blurring the boundaries between work and leisure. Galactic Avionics Corporation provides aircraft instrumentation and associated data services to not only Boeing, Airbus, Lockheed Martin, and McDonnell Douglas but also to a number of smaller aircraft manufacturers. Government contracts are lucrative and competition is spirited and occasionally operational requirements result in contractors pushing legal and ethical boundaries. Your immediate supervisor is the Chief Information Officer but your employment contract specifies that in certain circumstances regarding secret corporate matters you may report directly to the Chief Executive Officer or the Chairman of the Board of Directors. The Chief Information Officer has stated that GAC Board Chairman, Sir James Hardy-Avago, is a traditionalist with an atmospheric physics related PhD. Sir James is interested in knowing who is sharing corporate data, both within the organisation and more particular with others outside the organisation. He not only wants to know who is sharing information but also what data is being shared and how it is being communicated. Your particular contribution to this new GAC team is to assist in developing a holistic business process framework for the management of digital evidence. It is imperative that the framework fits neatly into the corporations Business Information Management System. The business process framework for the management of digital evidence is expected to provide a proactive approach to this perceived potential problem. As such the framework must accommodate at least the following data related issues: Legalities and practicalities of monitoring people and their behaviour with corporate data Corporate data classification: restricted public, data owners / custodians / managers / internal users / external users. Categorise the transmission of data: location to location / person to person / and modes of transmission. Categorise the technologies connecting people with corporate data: traditional inhouse devices, small portable digital devices, social media, ownership & possession of devices Corporate personnel classification: access, permission & rights, data responsibility. Categorise the types of social interactions and reactions between personnel with the organisation and people outside the corporation. Your task is to provide the necessary expert advice in a written report setting out the criteria required for the preservation of digital evidence in a forensically sound manner. Your Report should set out the considerations necessary to protect GAC digital data with an emphasis on small personal digital devices. Important considerations will include: identification, extraction, preservation, documentation and interpretation. Your report will necessarily address how corporate data might become evidence, how that evidence relates to corporate policy and legal rulings, how evidence will be collected and preserved, the tools to be used, staff reporting lines, escalation of incident reporting, and other essential matters of your determining. Your report is to be submitted to the CEO and is intended to form the basis of the proposed corporate procedural manual. The Assignment The assignment draws on materials addressed in lectures, laboratories, in-class activities, discussions, and readings regarding computer forensic issues associated with the management of digital forensic evidence. The assignment scenario provides information explaining the assignments context. You are required to prepare and present a written report specifying guidelines for a holistic business process framework for the management of digital evidence. This framework will form the basis of policy formulation and the associated procedural manuals that will eventuate in order to manage forensically sound digital evidence relating to all corporate data.

Do not forget to provide the essential, signed Assignment Cover Sheet. Not submitting a signed Assignment Cover Sheet will result in no grade being allocated to the assessment. Written assignments are to be checked for plagiarism using TurnItIn. A copy of YOUR TurnItIn Assignment Report is to be submitted digitally together with a digital copy of your Assignment 2 via BlackBoard on or before midnight of the day due. Marking Guide Marking Criteria Structure & Presentation of Forensic Report Professional non-academic Industry report, Table of Contents, Page Nos, Signed Assignment Cover Sheet, Appropriate Headings, Aims and Scope of Report, Correct language and grammar, , logical structure, integrated and flow of themes, etc. Assignment Research Depth and appropriateness of research materials, quality of sources, spread of source media. Citations & Referencing Correct use of Chicago Referencing, citations to support discussion, quality and breadth of reference materials Final Grade 35% Rating Poor <-> Excellent Comments by Lecturer Your Grade

I look forward to working with you and seeing the results of your work!

Colin J. Armstrong
Lecturer School of Information Systems Curtin University Building : 408 : 3038 Phone : 08 9266 7198 E-Mail : Colin.Armstrong@cbs.curtin.edu.au CRICOS Provider Code 00301J