Issuu

Guide to Computer Forensics and Inves�ga�ons 7e Bill Nelson, Amelia Phillips, Christopher Steuart (Solu�ons Manual All Chapters, 100% Original Veriﬁed, A+ Grade) Part 1: Page 1-298 Part 2: Page 299-538

Part 1 Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 1: Understanding the Digital Forensics Profession and Investigations

Solution and Answer Guide

BILL NELSON, AMELIA PHILLIPS, CHRIS STEUART, ROBERT S. WILSON, GUIDE TO COMPUTER FORENSICS AND INVESTIGATIONS , 7TH EDITION, ISBN: 9780357672884; MODULE 1: UNDERSTANDING THE DIGITAL FORENSICS PROFESSION AND INVESTIGATIONS

Table of Contents Activities - Solutions .......................................................................................................... 2 Activity 1-1.................................................................................................................................. 2 Review Questions - Answers ............................................................................................. 3 Hands-On Projects - Solutions .......................................................................................... 7 Project 1-1 .................................................................................................................................. 7 Project 1-2.................................................................................................................................. 9 Project 1-3................................................................................................................................. 11 Project 1-4 ................................................................................................................................ 13 Case Projects - Solutions ..................................................................................................15 Case Project 1-1 ....................................................................................................................... 15 Case Project 1-2....................................................................................................................... 16 Case Project 1-3....................................................................................................................... 16 Case Project 1-4....................................................................................................................... 17

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 1: Understanding the Digital Forensics Profession and Investigations

Activities - Solutions ACTIVITY 1-1 Estimated Time: 30 minutes Objective: Configure Autopsy for a new case and analyze the image file of George Montgomery’s USB drive. Before You Begin: • •

•

Download and install Autopsy as described in Note 15. Create Work folder C:\Work\Module_01\Activity_01-1 (referred to as your Work folder in the steps). Download to your Work folder the following files provided with the module: • Activity_01-1.001

To perform the analysis, complete the following steps: 1. Start Autopsy for Windows. 2. In Autopsy’s Welcome window, click the New Case button. In the New Case Information window, enter Activity_01-1 in the Case Name text box (see Figure 1-15), and click Browse next to the Base Directory text box. Navigate to and click your Work folder. Make sure the Single-User option button is selected for Case Type, and then click Next. [Figure 1-15 New Case Information window of Autopsy] 3. On the Optional Information pane, type Activity_01-1 in the Case Number text box and your full name in the Name text box in the Examiner section (see Figure 1-16), and then click Finish to start the Add Data Source Wizard. 4. In the Select Type of Data Source to Add area of the Add Data Source window, click the Disk Image or VM File button (see Figure 1-17), and then click Next. 5. In the Select Data Source pane of the next window, click the Browse button next to the Path text box, navigate to and click your Work folder, click the Activity_01-1.001 file, and then click Open. Click Next. 6. Keep the default settings in the Configure Ingest Modules window. Click Next and then click Finish. [Figure 1-16 Optional Information pane of Autopsy] [Figure 1-17 Add Data Source window of Autopsy] Next, complete these steps to display the contents of the acquired data: 1. In the Tree Viewer pane on the left, expand Views, File Types, By Extension, and Documents by clicking the plus sign next to each folder (see Figure 1-18). 2. Under Documents, click Office. In the Result Viewer (upper-right pane), click the last file, Contract with Martha.docx, to display its contents in the Content Viewer (lower-right pane). 3. Right-click Contract with Martha.docx, select Add File Tag, and click Tag and Comment.

4. In the Select Tag dialog box, click the New Tag button. In the New Tag section of the Create Tag dialog box, type Recovered Office Documents in the Tag Name text box (see Figure 1-19), click OK, and then click OK again. 5. Right-click Contract with Martha.docx again, and then click Extract File(s). In the Save window, click Save, and then click OK. [Figure 1-18 Expanded tree view of files in Autopsy] [Figure 1-19 Create Tag dialog box in Autopsy] 6. In the Tree Viewer pane, click the plus sign to expand the Deleted Files folder, and then click the All (2) folder. Next, you will select the files and explore what is there. 7. In the Result Viewer pane, click ~$George Presentation.pptx. In the Content Viewer pane, make note of George’s last name, then click File, and then click Exit to close Autopsy. 8. Open Notepad, and type George’s first and last names as they appeared in the Content Viewer pane in step 7. Save this file as Activity_01-1_George to your Work folder and exit Notepad. 9. Start File Explorer and navigate to subfolder Activity_01-1\Export in your Work folder and copy the file Contract with Martha.docx to your Work folder. 10. Submit to your instructor the following files: • •

Activity_01-1_George.txt Contract_with_Martha.docx Solution Guidance: This activity is a brief introduction to Autopsy for Windows. By completing the steps in this activity, students should learn how to initiate a digital forensics examination and how to navigate and use some of the features available in Autopsy. To show successful completion of this activity, students should submit the two documents listed in the final step. For examples of the contents of these documents, see the following solution files: • Solution_Activity_01-1_George.pdf • Solution_Contract with Martha.pdf

Review Questions - Answers 1.

Digital forensics and data recovery refer to the same activities. True or False? Answer: False Explanation: In data recovery, you typically know what you’re looking for. Digital forensics is the task of recovering data that users have hidden or deleted, with the goal of ensuring that the recovered data is valid so it can be used as evidence.

2. Criminal proceedings in the United States must use procedures that adhere to which of the following? a. Third Amendment b. Fourth Amendment c. First Amendment d. None of these choices Answer: b. Fourth Amendment Explanation: The Fourth Amendment to the U.S. Constitution (and similar amendments to individual state’s constitutions) protects a person’s right to be secure in their person, residence, and property against unreasonable search and seizure. 3. The triad of computing security includes which of the following? a. Detection, response, and monitoring b. Vulnerability assessment, detection, and monitoring c. Vulnerability/threat assessment and risk management, network intrusion detection and incident response, and digital investigation d. Vulnerability assessment, intrusion response, and monitoring Answer: c. Vulnerability/threat assessment and risk management, network intrusion detection and incident response, and digital investigation Explanation: Vulnerability/threat assessment and risk management, network intrusion detection and incident response, and digital investigation are each different groups focused on computing security (as shown in Figure 1-1). All three groups work together to conduct digital technology investigations. 4. What is the purpose of maintaining a network of digital forensics specialists? Answer: The purpose of maintaining a network of digital forensics specialists is to learn from experts who specialize in areas different from your own in case you need help on an investigation. It is not possible to be an expert at every single subject, so having a connection to a network of specialists can be extremely valuable for investigators. 5. Policies can address rules for which of the following? a. When you can log on to a company network from home b. The Internet sites you can or can’t access c. The amount of personal email you can send d. All of these choices Answer: d. All of these choices Explanation: Policies can address rules for acceptable use of a variety of company resources, including the company network and email. Such policies can make internal investigations go more smoothly, since they define what is acceptable and unacceptable usage or behavior with respect to corporate resources.

6. A warning banner should contain information about ____________. (Choose all that apply.) a. who can use the site b. who owns the computer c. the content of websites d. consequences of misuse Answer: a. who can use the site; b. who owns the computer; d. consequences of misuse Explanation: Warning banners are used by organizations to avoid litigation by end users of a computing asset by reminding the end user who can use the site and who owns the computing resources and noting possible consequences for violating the acceptable use policies. 7. Under normal circumstances, a private-sector investigator is considered an agent of law enforcement. True or False? Answer: False Explanation: Only after a private-sector investigator turns over evidence to law enforcement does a private-sector investigator become an agent of law enforcement. Prior to this, the private-sector investigator’s role is to minimize risk for the organization. 8. List two types of digital investigations typically conducted in a business environment. Answer: Types of digital investigations typically conducted in a business environment include fraud, embezzlement, insider trading, espionage, and email harassment. These are the typical crimes committed by an employee or contractor. 9. What is professional conduct, and why is it important? Answer: Professional conduct includes ethics, morals, and standards of behavior, all of which affect a professional’s credibility. It is important that a digital investigator maintains objectivity and confidentiality, continues to expand their knowledge, and conducts themselves with integrity to maintain their reputation as a respected and impartial investigator. 10. What is the purpose of an affidavit? Answer: An affidavit (or declaration) is a sworn statement in support of facts about or evidence of a crime. It is submitted to a judge with a request for a search warrant before seizing evidence. 11. What are some ways to determine the resources needed for an investigation? Answer: After gathering background about the case, identify potential artifacts and the tools required to recover those artifacts. Call on other people that are specialists if needed. Determine the OS of the suspect computer, and list the software needed for the examination.

12. List three items that should be on an evidence custody form. Answer: Items that should be included on an evidence custody form include the case number, the name of the investigator assigned to the case, the nature of the case, the location where evidence was obtained, and a description of the evidence. Refer to the single and multi-evidence forms covered in the module, as shown in Figures 1-12 and 1-13. 13. Why should you do a standard risk assessment to prepare for an investigation? Answer: You should do a standard risk assessment to prepare for an investigation to help you identify problems that might happen when conducting the investigation. Performing the assessment can help you anticipate possible challenges you might face when conducting an investigation, such as when investigating a person with superior knowledge of computers (e.g., their computer could be set to erase the hard drive when someone tries to change the logon password). 14. When collecting computer components as evidence, you should place them in antistatic bags. True or False? Answer: True Explanation: Computer components collected as evidence should be placed in antistatic bags to protect them from electrostatic discharge (ESD), which can harm the components and the data stored on them. 15. Why should evidence media be write-protected? Answer: Evidence media should be write-protected to ensure sure data isn’t altered, which preserves the integrity of the evidence. 16. List three items that should be in your case report. Answer: Items that should be in your case report include an explanation of basic computer and network processes, a narrative of the steps you took, a description of your findings, and any log files generated from your analysis tools. See the discussion of report writing in the “Completing the Case” section of the module. 17. Why should you critique your case after it is finished? Answer: Based on the principle of continuous improvement (i.e., ascertain if mistakes were made and determine how to avoid them in the future), you should critique your case after it is finished to improve your work, identify what items went well, and what processes or documents need updating.

18. What term do you use to refer to all the people who have had physical possession of the evidence? a. Professional investigators b. Chain of custody c. Legal custody d. Physical tracking Answer: b. Chain of custody Explanation: Chain of custody is the route evidence takes from the time the investigator obtains it until the case is closed or goes to court. A document showing the chain of custody lists everyone who has had physical possession of the evidence. 19. Data collected before an attorney issues a memo for an attorney-client privilege case is protected under the confidential work product rule. True or False? Answer: False Explanation: For data to be protected by the work product rule, it must be labeled as confidential work product. Data without this label is not protected by work product and hence not legally confidential. It is, therefore, subject to discovery by opposing counsel

Hands-On Projects - Solutions Project 1-1 Estimated Time: 30 minutes for the lab; 30 minutes to evaluate and write the report Objective: Evaluate the USB drive obtained from a crime scene. Before You Begin: • • •

Create Work folder C:\Work\ Module_01\Project_01-1. Download and install Autopsy for Windows as described in Note 15. Download to your Work folder the following file provided with the module:

•

Project_01-1.001

The case in this project involves a suspicious death. Joshua Zarkan found his girlfriend’s dead body in her apartment and reported it. The first responding law enforcement officer seized a USB drive. A crime scene evidence technician skilled in data acquisition made an image of the USB drive with FTK Imager and named it Project_01-1.001. Following the acquisition, the technician transported and secured the USB drive and placed it in a secure evidence locker at the police station. You have received the image file from the detective assigned to this case. He directs you to examine it and identify any evidentiary artifacts that might relate to this case.

To process this case, follow these steps to evaluate what is on the image of the USB drive: 1. Start Autopsy for Windows, and click the New Case icon. In the New Case Information window, enter Project_01-1 in the Case Name text box, and click Browse next to the Base Directory text box. Navigate to and click your Work folder, and then click Next. 2. In the Optional Information pane, type Project_01-1 in the Case Number text box and your name in the Examiner Name text box, and then click Finish. 3. In the Add Data Source window, in the Select Type of Data Source to Add pane, and click Disk Image or VM File. Click the Next button. In the Select Data Source pane, click the Browse button next to the Path text box, navigate to and click your Work folder, click the Project_011.001 file, and then click Open. Click Next. 4. In the Configure Ingest Modules pane, click Select All, then uncheck Central Repository, click Next, and then Finish. (Note: An error message appears in the lower-left corner of the screen if Central Repository box is checked.) 5. When the Ingest modules complete their processing, in the Tree Viewer pane, click the relevant plus signs to expand Views, File Types, By Extension, and Documents. 6. From the Tree Viewer pane click the subfolder Office. 7. In the Result Viewer pane, right-click the Sylvias Assets.xls file, and click Extract File(s). In the Save dialog box, click Save to save the files automatically in Autopsy’s case subfolder: Work\Module_01\Project_01-1-1\Export. Click OK on the dialog box that appears. 8. Next, in the Tree Viewer pane, click the subfolder Plain Text. 9. In the Result Viewer pane, right-click the suicide1.txt file, and click Extract File(s). In the Save dialog box, click Save to save the files automatically in Autopsy’s case subfolder: Work\Module_01\Project_01-1\Export. Click OK on the dialog box that appears. 10. Exit Autopsy. Examine the extracted files. Reread the description of the case, and write a short report of no more than three paragraphs, including facts from any contents you found. In the report include the following items: • • • •

At the beginning: your name as examiner, the Case name and number, a title for the case, and date of your examination. An introduction describing the information about the examination. A description of your findings. A conclusion that can be drawn from your findings.

11. Then save the report as Project_01-1_Report.doc to your Work folder. 12. Submit to your instructor the following files: • • •

Project_01-1_Report.doc suicide1.txt Sylvias Assets.xls

Solution Guidance: Students should be able to find two files of interest to this case. The first file, in Autopsy’s Documents folder, is a text message pleading for help. The second file, in Autopsy’s Plain Text folder, is an Excel spreadsheet containing the victim’s assets and their values. Students’ reports should include basic information about each file found on the USB drive. For examples of the exported files and the student-created report, see the following solution files: • Solution_Project_01-1_Report.pdf • Solution_suicide1.pdf • Solution_Sylvias Assets.pdf

Project 1-2 Estimated Time: 20 to 30 minutes Objective: Determine if a former employee committed industrial espionage. Before You Begin: • • •

Download and install Autopsy for Windows as described in Note 15. Create Work folder C:\Work\Module_01\Project_01-2. Download to your Work folder the following file provided with the module: • Project_01-2.001

In this project, you work for the IT Security Department of a large corporation. Your duties include conducting internal digital investigations and forensics examinations on company computing systems. A paralegal from the Legal Department, Dorothea May, asks you to examine a USB drive belonging to an employee who left the company and now works for a competitor. The Legal Department is concerned that the former employee might possess sensitive company data. Dorothea wants to know whether the USB drive contains anything relevant. In addition, she tells you that the former employee might have had access to confidential documents because a coworker saw him accessing his manager’s computer on his last day of work. These documents consist of nine files containing the word “confidential.” She wants to know whether the USB’s bit-stream image file has these documents. To process this case, make sure the Project_01-2.001 file has been extracted to your Work folder, and then complete these steps: 1. Start Autopsy for Windows; if you exited it at the end of the previous project. If the previous project is open, click Case, Close Case from the menu. Click the New Case icon. In the New Case Information window, enter Project_01-2 in the Case Name text box, and click Browse next to the Base Directory text box. Navigate to and click your Work folder, and then click Next. 2. In the Optional Information window, type Project_01-2 in the Case Number text box and your name in the Examiner text box, and then click Finish. 3. In the Add Data Source window, go to the Select Type of Data Source to Add pane, and click Disk Image or VM File. Click the Next button. In the Select Data Source pane, click the Browse

button next to the Path text box, navigate to and click your Work folder, click the Project_012.001 file, and then click Open. Click Next. 4. In the Configure Ingest Modules pane, click Select All, then uncheck Central Repository, click Next, and then Finish. (Note: An error message appears in the lower-left corner of the screen if Central Repository box is checked.) 5. Click the Keyword Search button in the far upper-right corner of the screen, type confidential in the text box, and then click Search. 6. In the Result Viewer pane, a new tab named Keyword search 1 – confidential opens. Click each file to view its contents in the Content Viewer pane. 7. In the Result Viewer pane’s Keyword search 1 – confidential tab, click the first file in the list, then press Ctrl+A to select all files. 8. Right-click the highlighted files, point to and click Add File Tags from the dropdown menu, and click Recovered Office Documents. 9. Click Generate Report at the top. In the Generate Report window, click the Select and Configure Results Modules - Excel Report button, and then click Next. 10. In the Generate Report window, click the Project_01-2 check box in the Select which data sources(s) to include pane, and then click Next. 11. In the Configure Report pane, click the All Tagged Results button, and then click Finish. 12. When the Complete message appears in the Report Generation Progress window, click the Excel Report hyperlink to open the report. Save the Excel file as Project_01-2_Report.xlsx to your Work folder. Then in the Report Generation Progress window, click Close, and exit Autopsy. 13. Using your word processing application, write a memo to Dorothea listing the filenames and the associated file paths in which you found a hit for the keyword. Save the memo as Project_01-2_Memo.docx. 14. Submit to your instructor the following files: • •

Project_01-2_Memo.docx Project_01-2_Report.xlsx Solution Guidance: Students should have successfully located nineteen files with the word “confidential.” Information about these files is in the Excel file Project_012_Report.xlsx’s on the Keyword Hits tab. The memo should list the path and filenames listed in the spreadsheet file. For examples of the spreadsheet and memo, see the following solution files: • Solution_Project_01-2_Memo.pdf • Solution_Project_01-2_Report_Data_Source_Usage.pdf • Solution_Project_01-2_Report_Keyword_Hits.pdf • Solution_Project_01-2_Report_Metadata.pdf • Solution_Project_01-2_Report_Summary.pdf • Solution_Project_01-2_Report_Tagged_Files.pdf

Project 1-3 Estimated Time: 30 minutes for the lab, 45 minutes to analyze and write the report Objective: Find specific file types in a date range and create tagged files. Before You Begin: • •

Create Work folder C:\Work\Module_01\Project_01-3. Download to your Work folder the following file provided with the module: • Project_01-3.001 file

You’re an IT security specialist for Superior Sailmakers, a company that makes sails for sloops and yawls. The company sells rigging and sails to many sailboat makers who compete against one another. Johanna Corson who works in the Human Resources Department notifies you that she has received an anonymous letter with an old USB drive. The letter states that a former Superior Sailmakers employee, Ralph Williams, had possession of photos from 2021 to 2022 that contained trade secrets belonging to ACE Sailboats. The letter also states that after Mr. Williams ended his employment at Superior Sailmakers in October 2022, he used the photos on the USB drive to get hired by Smith Sloop Boats, a competitor of ACE Sailboats. Both sailboat manufacturers are customers of Superior Sailmakers. Johanna tells you that another specialist has already made an image of the USB drive in the Expert Witness format (with an .001 extension). She wants you to examine its contents for any photograph files to determine whether the anonymous complaint is true. She also asked that you determine if there are any photos with create or last access dates of October 2022. After your examination, you need to generate a report that Johanna will send to the Legal Department along with a memo summarizing this investigation and your findings. The Legal Department will then determine whether any violations of trade secret or intellectual property laws might have occurred. Follow these steps to get started: 1. Start Autopsy for Windows, and click the New Case icon. In the New Case Information window, enter Project_01-3 in the Case Name text box, and click Browse next to the Base Directory text box. Navigate to and click your Work folder, and then click Next. 2. In the Optional Information window, type Project_01-3 in the Case Number text box and your name in the Examiner Name text box, and then click Finish. 3. In the Add Data Source window, go to the Select Type of Data Source to Add pane, and click Disk Image or VM File. Click the Next button. In the Select Data Source pane, click the Browse button next to the Path text box, navigate to and click your Work folder, click the Project_01-3.001 file, and then click Open. Click Next. 4. In the Configure Ingest Modules window, click Select All, then uncheck Central Repository. Click Next and then Finish. Because you’re looking for photos of sailboats that were copied to the USB drive sometime during October 2022, perform the following steps: 1. In the Tree Viewer pane, click the relevant plus signs to expand Views, File Types, By Extension, and Images.

2. In the Result Viewer pane, scroll to the right, if necessary, until the Modified Time column is in view. Sort the column by clicking the Modified Time header. 3. Scroll down until you find the first file with a starting month of October 2022, and then click the file to view it in the Content Viewer. Press the down arrow on the keyboard to view all files created or modified in October 2022. 4. Ctrl+click every file that has a photo of a boat or part of a boat taken in October 2022. Right-click the selection, point to Add File Tags, and click Follow Up. 5. In the Tree Viewer pane, scroll down and click the relevant plus signs to expand Tags, and Follow Up, and then click the File Tags folder. 6. In the Result Viewer pane, click the Thumbnail tab to view the tagged photos. 7. Create a report by clicking Generate Report at the top. In the Generate Report window, click the HTML option button in the Select and Configure Report Modules pane, and then click Next. 8. In the Select which data source(s) to include pane, click the check box for Project_01-3.001 if it is not already checked, and then click Next. 9. In the Configure Report pane, click Specific Tagged Results button, click the Follow Up check box, and then click Finish. 10. In the Report Generation Progress window, click the HTML Report pathname to view the report. When viewing the report, click the links to examine the tagged files. 11. In the browser, click Case Summary, located in the left pane of the report, and print the screen to a PDF file named Project_01-3_Autopsy_Report_Case_Summary.pdf. 12. In the left pane of the report, click Tagged Files, and print the screen to a PDF file named: Project_01-3_Autopsy_Report_ Tagged_Files.pdf. 13. In the left pane of the report, click Tagged Files, and print the screen to a PDF file named: Project_01-3_Autopsy_Report_ Tagged_Images.pdf. 14. When you’re finished, close the Web browser, and click Close in the Report Generation Progress window, and exit Autopsy. 15. Using your word processing application, write a memo providing an overview of the case and summarizing your findings. Save the file as Project_01-3_Memo.docx. 16. Submit to your instructor the following files: • • • •

Project_01-3_Autopsy_Report_Case_Summary.pdf Project_01-3_Autopsy_Report_Tagged_Files.pdf Project_01-3_Autopsy_Report_Tagged_Images Project_01-3_Memo.docx

Solution Guidance: Students should be able locate and tag four JPEG files that appear in the Autopsy report. The memo should start with a summary overview of the investigation followed by references to the Autopsy report. Because the Autopsy report is in HTML, the students should submit a PDF file of the HTML’s Case Summary, Tagged Files, and Tagged Images pages using the Web browser’s Print function. For examples of files the students submit, see the following solution files: • Solution_Project_01-3_Autopsy_Report_Case_Summary.pdf • Solution_Project_01-3_Autopsy_Report_Tagged_Files.pdf • Solution_Project_01-3_Autopsy_Report_Tagged_Images.pdf • Solution_Project_01-3_Memo.docx For complete screenshots of the three HTML webpages showing their entire content, see the following solution files: • Solution_Project_01-3_Autopsy_HTML_Case_Summary.pdf • Solution_Project_01-3_Autopsy_HTML_Tagged_Files.pdf • Solution_Project_01-3_Autopsy_HTML_Tagged_Images.pdf

Project 1-4 Estimated Time: 15 minutes Objective: Extract existing, non-deleted, files from a disk. Before You Begin: • •

Create Work folder C:\Work\Module_01\Project_01-4. Download to your Work folder the following data files provided with the module: • Project_01-4.001

Sometimes discovery demands from law firms require a digital forensics examiner to recover only allocated data from a disk. This project shows you how to extract just the files that haven’t been deleted (that is, the allocated files) from an image. For this project, you are to extract all allocated files from the digital forensics image file. Complete these steps: 1. Start Autopsy for Windows. Click the New Case icon. In the New Case Information window, enter Project_01-4 in the Case Name text box, and click Browse next to the Base Directory text box. Navigate to and click your Work folder, and then click Next. 2. In the Optional Information window, type Project_01-4 in the Case Number text box and your name in the Examiner Name text box, and then click Finish. 3. In the Add Data Source window, go to the Select Type of Data Source to Add pane, and click Disk Image or VM File. Click the Next button. In the Select Data Source pane, click the Browse button next to the Path text box, navigate to and click your Work folder, click the Project_01-4.001 file, and then click Open. Click Next.

4. In the Configure Ingest Modules window, click Select All, then uncheck Central Repository. Click Next and then Finish. 5. In the directory tree viewer, clicking the relevant plus signs to expand Views, File Types, and By Extension. Under the By Extension folder are several subfolders representing file types, as you have seen in previous projects. Next to each file type subfolder is a number enclosed in parentheses, which indicates the number of files of this type that Autopsy found. 6. Click the first subfolder with numbers greater than zero to view the files, as shown in Figure 1-22. [Insert Figure 1-22 Expanded folders showing the number of files per folder] 7. In the Result Viewer pane, scroll to the right, if necessary, until the Flags(Meta) column is in view. Click the Flags(Meta) header to sort the list of files, which displays all allocated files to the top of the list as shown in Figure 1-23. [Insert Figure 1-23 Sorting Flags(Meta)] Note 17 In the Result Viewer pane, allocated (not deleted) files have a paper sheet or picture icon to the left of the filename. Deleted (unallocated) files have a red X over the paper sheet icon, and unallocated files that have been corrupted and recovered by Autopsy have a diagonal broken bar icon. 8. Scroll to the left until the Name column is visible in the Result Viewer pane. If there are allocated files, they will be at the top of this list. Ctrl+click each allocated file, then rightclick the highlighted files, and then click Extract File(s). 9. In the Save dialog box, click Save to save the files automatically in Autopsy’s case subfolder: Work\Module_01\Project_01-4\Export 10. Repeat steps 6 through 9 to extract all other allocated files. 11. When you are finished, write a brief memo that lists all the files you exported, and save the file as Project_01-4_Memo.docx. 12. Leave Autopsy running for the next project. 13. Submit to your instructor the following file: •

Project_01-4_Memo.docx

Solution Guidance: Student should have located and exported two allocated files from the Images subfolder and four allocated files from the Office subfolder. The files are as follows: • 6-Lin_tomb.jpg • 16-Gettysbg.jpg • 18-magnaCt.doc • 19-USConst.doc • 20-USDeclar.doc • 22-Botany.doc Note that each student’s extracted files will have the same file names, but different prefix numbers. Autopsy automatically assigns a unique prefix number followed by a hyphen for all extracted files names. This prefix number is not consistent between different runs of Autopsy on the same computer or between different computers running Autopsy. For an example of the memo that students should submit, see the following solution file: • Solution_Project_01-4_Memo.pdf

Case Projects - Solutions Case Project 1-1 Estimated Time: 60 minutes Objective: Decide the best approach for the case. Before You Begin: •

Create Work folder C:\Work\Module_01\Case_Project_01-1.

An insurance company has asked your digital forensics firm to review a case for an arson investigation. The suspected arsonist has already been arrested, but the insurance company wants to determine whether there is any contributory negligence on the part of the victims. The evidence used by the suspect is a laptop and tablet. What procedure would you follow? Using the guidelines listed in the “Taking a Systematic Approach” section of this module, write a one- to two-page memo that includes an outline of your approach for this case and save it as Case_Project_01-1_Memo.docx. When you have completed this case project, submit to your instructor the following file: •

Case_Project_01-1_Memo.docx Solution Guidance: The purpose of this case project is to have the students review and apply the elements listed in the “Taking a Systematic Approach” section of this module. In the outline, the students should be encouraged to think through the different steps and develop their own thoughts on how to apply these elements to all digital forensics’ investigations. For an example of an outline memo, see the following solution file: • Solution_Case_Project_01-1_Memo.pdf

Case Project 1-2 Estimated Time: 60 minutes Objective: Form a hypothesis for a case and create a list of possible evidence to examine. Before You Begin: •

Create Work folder C:\Work\Module_01\Case_Project_01-2.

Jonathan Simpson owns a construction company. One day a subcontractor calls him, saying that he needs a replacement check for the job he completed at 1437 West Maple Avenue. Jonathan looks up the job on his accounting program and agrees to reissue the check for $12,750. The subcontractor says that the original check was for only $10,750. Jonathan looks around the office but can’t find the company checkbook or ledger. Only one other person has access to the accounting program. Jonathan calls you to investigate. After reviewing the facts from Jonathan, determine the steps necessary to ascertain if this is an actual case of theft or a clerical mistake. How should you proceed? Write a one-page letter detailing the known facts of the case and the steps Jonathan needs to take to gather the necessary evidence for this examination. Save the report as Case_Project_01-2_Letter.docx. Submit to your instructor the following file: •

Case_Project_01-2_Letter.docx Solution Guidance: Although there was a discrepancy reported between the check originally received by the subcontractor and what the accounting program listed, the most likely explanation is that a simple data entry error occurred. The digital forensics examiner should always consider that a discrepancy is the result of a mistake, without any ill intent. Even for a case that might be a simple mistake, however, the digital forensics examiner must always treat the evidence and other associated information for the case as possible evidence of a crime. Preserving the evidence is the first concern—even for incidents that may have no civil or criminal concerns. For an example of the student-created letter, see the following solution file: • Solution_Case_Project_01-2_Letter.pdf

Case Project 1-3 Estimated Time: 60 minutes Objective: Prepare for an attorney-client privileged case. Before You Begin: •

Create Work folder C:\Work\Module_01\Case_Project_01-3.

You are the digital forensics examiner for a large corporation. You receive a telephone call from a lawyer with an outside law firm that is retained by your company’s legal department. The outside law firm is Melbourne & Schaffel Law Group, and the attorney’s name is Nariko Bortoletti. Nariko informs you that Melbourne & Schaffel will be representing your employer in a possible criminal indictment against some senior executives. She directs you to collect the laptop

computers of all C-level executives as well as a senior division president. At the end of the call, Nariko provides you with her contact information: • • •

Telephone: 555-555-0115 Cell Phone: 555-555-0128 Email: nariko.bortoletti@mslawyers.biz

Because this is the first you have heard about this case, you inform Nariko that you will need to check with your company’s legal department about this request and will respond to her as soon as possible. You contact one of the lead litigation attorneys in your company’s legal department and explain the request to him. The litigation attorney tells you that he will call you back after he gets more details about the possible investigation. Within five minutes, the litigation attorney calls you back and informs you that he has spoken to Nariko Bortoletti. The litigation attorney instructs you to collect the computers. Before doing this, you need to email Nariko requesting the following information: • • •

List of persons laptops to collect (defendants/plaintiffs names) Actions to take when the evidence is collected (evidence preservation and processing) Case communication security (attorney-client privilege needs)

Using the information described in the “Attorney-Client Privilege Investigations” section of this module, write a one-page email message (use a word processor application to create the message) to Nariko Bortoletti requesting a formal memo that clearly provides the information requested by your company’s litigation attorney. Save the memo-email as Case_Project_01-3_Email.docx. Submit to your instructor the following file: •

Case_Project_01-3_Email.docx Solution Guidance: Students should create a one-page memo styled as an email message addressed to the outside attorney (Nariko Bortoletti). The email message should ask for more specific information about whose computers should be collected and what should be done with them. Following this information request, the students should ask for a specific memo that clearly states that all communications be protected under the rules of attorney-client privilege. For an example of the type of email students should write, see the following solution file: • Solution_Case_Project_01-3_Email.pdf

Case Project 1-4 Estimated Time: 30 minutes Objective: Determine what is needed to start a digital forensics examination. Before You Begin: •

Create Work folder C:\Work\Module_01\Case_Project_01-4.

Your supervisor directs you to create a checklist for new examiners in your organization to use when gathering digital evidence to process digital evidence. Apparently, many of the

examiners have been unprepared when collecting digital evidence, which has caused delays and confusion in case processing. Using the information provided in the “Conducting an Investigation” section of this module, develop a simple checklist that covers what to gather before an investigation is started. The checklist should be easy to follow with minimal explanations. In addition to the items listed below, include additional information you might need for a case: • • • • • • •

Case title Case number Examiner’s name Date and time Description of the case A list of tasks and material for the case Comment or notes related to each listed item

Save the checklist as Case_Project_01-4_Exam_Checklist.docx. Submit to your instructor the following file: •

Case_Project_01-4_Exam_Checklist.docx Solution Guidance: Students will need to review the “Conducting an Investigation” section of this module and create a simple high-level checklist that can be used to initiate a digital forensics investigation. This form should address only the resources required to prepare for an examination, as was described in this module. For an example of the information that should appear on this form, see the following solution file: • Solution_Case_Project_01-4_Exam_Checklist.pdf

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

Solution and Answer Guide

BILL NELSON, AMELIA PHILLIPS, CHRIS STEUART, ROBERT S. WILSON, GUIDE TO COMPUTER FORENSICS AND INVESTIGATIONS , 7TH EDITION, ISBN: 9780357672884; MODULE 2: REPORT WRITING AND TESTIMONY FOR DIGITAL INVESTIGATIONS

Table of Contents Activities - Solutions .......................................................................................................... 2 Activity 2-1 ................................................................................................................................. 2 Review Questions - Answers ............................................................................................. 5 Hands-On Projects - Solutions ........................................................................................ 14 Project 2-1................................................................................................................................. 14 Project 2-2 ................................................................................................................................ 16 Project 2-3 ................................................................................................................................ 17 Project 2-4 ................................................................................................................................ 18 Project 2-5 ............................................................................................................................... 20 Case Projects - Solutions ..................................................................................................21 Case Project 2-1....................................................................................................................... 21 Case Project 2-2 ..................................................................................................................... 23 Case Project 2-3 ..................................................................................................................... 24 Case Project 2-4 ..................................................................................................................... 26 Case Project 2-5 ..................................................................................................................... 27

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

Activities - Solutions Activity 2-1 Estimated Time: 20 minutes Objective: In preparation for creating a formal report, repeat the examination of George Montgomery’s USB drive, and create detailed examiner notes of every step taken during the analysis. Before You Begin: • •

Create Work folder C:\Work\Module_02\Activity_02-1. Download to your Work folder the following files provided with the module: • Activity_02-1_Examiner_Notes.xlsx • Activity_02-1.001

For this activity, you will complete the initial steps required to create a formal digital forensics report by analyzing the data on George Montgomery’s USB drive using Autopsy and creating an examiner notes log file. Complete the following steps: 1. Open the file Activity_02-1_Examiner_Notes.xlsx. 2. In cell C3 of the spreadsheet, type your name. In cells C4 and C5, type Activity_02-1. In the Date and Start Time columns, enter the current date and time as shown in Figure 2-5. Save the file, and leave it open to record your activities during the forensics examination. [Figure 2-5 Examiner notes spreadsheet] 3. Start Autopsy for Windows. 4. In Autopsy’s Welcome window, click the New Case button. In the Case Name text box in the New Case Information window, enter Activity_02-1, and click Browse next to the Base Directory text box. Navigate to and click your Work folder. Make sure the Single-User option button is selected for Case Type, and then click Next. 5. In the Case Number text box in the Optional Information window, type Activity_02-1, and enter your full name in the Name text box in the Examiner section. Click Finish to start the Add Data Source Wizard. 6. In the Select Type of Data Source To Add area of the Add Data Source window, click the Disk Image or VM File button, and then click Next. 7. In the Select Data Source area of the Add Data Source window, click Browse, navigate to your Work folder in the Open window, click the Activity_02-1.001 file, click Open, and then click Next in the Select Add Data Source window. 8. In the Configure Ingest area of the Add Data Source window, click Select All and click Next. 9. When the ingest configuration completes, click Finish.

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

10. In cell B8 of the examiner notes spreadsheet, note the time you started the activity, and in cell C8, add a statement indicating that you started Autopsy and loaded the file Activity_021.001. An example entry would be, “Started Autopsy and added forensic image file Activity_021.001 using Autopsy for Windows, version 4.18.0.” Next, you will locate all the relevant document files. Follow these steps, and for every entry in the examiner notes spreadsheet, note the time each activity was started: 1. In the Tree Viewer pane on the left, click to expand Views, File Types, By Extension, and Documents. 2. Under Documents, click Office. In the Result Viewer (upper-right pane), click the file, Contract with Martha.docx, to display its contents in the Content Viewer (lower-right pane). 3. Right-click Contract with Martha.docx. In the drop-down menu, click Add File Tag, and then click Recovered Office Documents in the Tag Name text box. 4. In cell C9 of the examiner notes spreadsheet, type a statement indicating that you examined the content of the file Contract with Martha.docx, and describe the content of the message. 5. Repeat steps 2, 3, and 4, and examine the following files: George Presentation.pptx, ~$George Presentation.pptx, Inventory and sales.xlsx, and Notes.doc. When finished, update the examiner notes. 6. In the Tree Viewer pane, click and expand the Tags folder and the Recovered Office Documents folder. Then, in the Result Viewer pane, click the Contract with Martha.docx file to highlight it. Press Ctrl1A to highlight all tagged files. 7. In the Result Viewer pane, right-click the highlighted files, and click Extract File(s) as shown in Figure 2-6. In the Save dialog box, click Save and then OK. [Figure 2-6 Extracting files from Autopsy] Note 6 Autopsy will store extracted files in the subfolder Export under the Work folder’s case folder. An example for this path would be: C:\Work\Module02\Activity_02-1\Export. 8. In Autopsy’s main window, click Tools and then Generate Report. In the Generate Report, Report Modules dialog box, click HTML Report, and then click Next. 9. In the Select which data source(s) to include dialog box, click Check All, and then click Next. 10. In the Configure Report dialog box, click All Tagged Results, and then click Finish. 11. When the Report Generator completes, click the link to the report to open it in your web browser, and then click Close in the Report Generation Progress window.

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

12. Save and close the spreadsheet file Activity_02-1_Examiner_Notes.xlsx. In the Export subfolder copy for this Autopsy examination submission to your instructor the five files that were also retrieved (note, your exported files may have different prefix numbers). Close Autopsy. Submit to your instructor the following files: • • • • • •

Activity_02-1_Examiner_Notes.xlsx 12-Contract with Martha.docx 14-George Presentation.pptx 16-Inventory and sales.xlsx 18-Notes.doc 22-~$George Presentation.pptx

Note 7 When a report is generated in Autopsy, a folder is created containing the HTML report (titled “report.html”) as well as a subfolder titled “content.” The content subfolder contains the data that is viewable from the report.html file. Autopsy automatically appends the current date and time to the folder name and saves it in the Base Directory designated when the case was created. An example of the file path for the HTML report is: C:\Work\Module02\Activity_02-1\Reports\ Activity_02-1 HTML Report mm-dd-yyyy-hh-mm-ss\report.html. The HTML report can be viewed with your browser by double-clicking the file report.html in File Explorer. Solution Guidance: This activity is designed to show students how to examine files, write examiner notes, and create an HTML report using Autopsy for Windows. The student’s Activity_02-1_Examiner_Notes.xlsx file should have sufficient details to provide accurate and complete information for a formal report. For an example of the types of notes that should be included (at minimum) in the examiner notes file, see the following solution file: • Solution_Activity_02-1_Examiner_Notes.pdf For an example of the HTML file that students should submit, see the following solution file: • Solution_Activity_02-1 HTML Report mm-dd-yyyy-hh-mm-ss.zip

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

Review Questions - Answers 1.

Which of the following rules or laws requires an expert to prepare and submit a report? a. FRCP 26 b. FRE 801 c. Neither d. Both Answer: a. FRCP 26 Explanation: Rule 26, Federal Rules of Civil Procedure requires that parties who anticipate calling an expert witness to testify must provide a copy of the expert’s written report that includes all opinions, the basis for the opinions, and the information considered in coming to those opinions (law.cornell.edu/rules/frcp/rule_26). The report must also include related exhibits, such as photographs or diagrams, and the witness’s curriculum vitae listing all the publications they contributed to during the preceding 10 years.

2. For what purpose have hypothetical questions traditionally been used in litigation? a. To frame the factual context of rendering an expert witness’s opinion b. To define the case issues for the finder of fact to determine c. To stimulate discussion between a consulting expert and an expert witness d. To deter a witness from expanding the scope of their investigation beyond the case requirements Answer: a. To frame the factual context of rendering an expert witness’s opinion Explanation: The law requires an expert who doesn’t have personal knowledge about the specific event or system to state opinions as responses to hypothetical questions. Those questions can ask the expert witness to express an opinion based on hypothetical facts without referring to a particular system or situation. In this regard, you as a forensics investigator (an expert witness) differ from an ordinary witness. You didn’t see or hear the incident in dispute; you’re giving evidence as an opinion based on professional knowledge and experience, even if you might never have seen the system, data, or scene. 3. Which of the following is an example of a written report? a. A search warrant b. An affidavit c. Voir dire d. Examiner notes Answer: b. An affidavit Explanation: A written report may, depending on circumstances, be an affidavit or a declaration. Because this type of report is sworn to under oath (and penalty of perjury or comparable false-swearing statute), it demands attention to detail, carefully limiting the focus of what is written, and providing thorough documentation and support of what is written.

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

4. What is the term for destroying a report before the final resolution of a case? (Choose all that apply.) a. Voir dire b. Discovery c. Motion in limine d. Spoliation Answer: d. Spoliation Explanation: Destroying a report could be considered destroying or concealing evidence—called spoliation, which could subject your client to monetary, evidentiary, or other more severe sanctions. 5. An expert witness can give an opinion in which of the following situations? (Choose all that apply.) a. The opinion, inferences, or conclusions depend on special knowledge, skills, or training not within the ordinary experience of laypeople. b. The witness has been shown to be qualified as a true expert in the field. c. The witness testifies to a reasonable degree of certainty (probability) about their opinion, inference, or conclusion. d. Hypothetical questions of a witness can only apply to particular situations. Answer: a. The opinion, inferences, or conclusions depend on special knowledge, skills, or training not within the ordinary experience of laypeople; b. The witness has been shown to be qualified as a true expert in the field; c. The witness testifies to a reasonable degree of certainty (probability) about their opinion, inference, or conclusion. Explanation: As an expert witness, you can testify to an opinion or a conclusion, if these basic conditions are met: The opinion, inferences, or conclusions depend on special knowledge, skill, or training not within the ordinary experience of lay witnesses or jurors. You have been shown to be qualified as a true expert in the field (which is why a curriculum vitae is important). You must testify to a reasonable degree of certainty (probability) about your opinion, inference, or conclusion. At minimum, as an expert witness, you must know the relevant data (facts) on which your opinion, inference, or conclusion is based, and you must be prepared to testify in response to a hypothetical question that sets forth the underlying evidence. 6. What is the standard format used when submitting reports electronically to U.S. federal courts and in most state courts? Answer: Attorneys can submit documents electronically in many courts; the standard format in (US) federal courts and most state courts is Portable Document Format (PDF).

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

7. When writing a report, what is the most important aspect of formatting? a. A neat appearance b. Size of the font c. Clear use of symbols and abbreviations d. Consistency Answer: d. Consistency Explanation: The way you format text in a report is less important than being consistent in applying formatting. For example, if you indent paragraphs, be sure all are indented. Use fonts consistently, and use consistent heading styles throughout (for example, major headings in bold with initial capitals, minor headings in italics, and so forth). Follow the same guideline throughout for units of measure; for example, use “%” or “percent”, but don’t use both. In other words, establish a template and stick to it. 8. Automated tools help you collect and report evidence, but you are responsible for doing which of the following? (Choose all that apply.) a. Explaining your formatting choices b. Explaining the significance of the evidence c. Explaining in detail how the software works d. Explaining any limitations or uncertainty that applies to the findings Answer: b. Explaining the significance of the evidence; d. Explaining any limitations or uncertainty that applies to the findings Explanation: A report generator for a digital forensics tool will only display the findings from an examination. It is up to the examiner to provide explanations about the meaning and any limitations of the findings to judges, attorneys, and jurors. 9. What criteria should be considered when assessing a written report? (Choose all that apply.) a. The report should appeal to the reader. b. Information should be relevant and well organized for the reader. c. The report’s language should be simple and direct. d. A variety of terms should be used throughout the report. Answer: a. The report should appeal to the reader; b. Information should be relevant and well organized for the reader; c. The report’s language should be simple and direct. Explanation: A report must be tailored to the potential reader, so they find it easy to read and understand. The ideas and organization should be relevant and clearly organized, with grammar and vocabulary that is simple and direct. Technical terminology should be used consistently, and punctuation and spelling must be accurate and consistent throughout the report. Reports should be written in logical order to facilitate logical thinking to guide the reader. Be sure to define acronyms and abbreviations used in the report.

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

10. Describe the major advantages of automated forensics tools in report writing? Answer: By using automated forensics tools in report writing, you can incorporate the log files and reports generated by these tools into your written reports. The generated files are in a format that is easy to incorporate into an electronic document. Digital forensics tools can create a lot of information that can be difficult to transfer into a narrative report. With the automated report functions available in many digital forensics tools, details of evidence findings can be easily incorporated into a report to ensure that the report is complete. 11. What advantages are offered by the report generator feature of many digital forensics tools? (Choose all that apply.) a. A digital forensic report generator will create a detailed HTML report that includes such things as the date and time a file was last accessed, as well as the content of files identified by the examiner examination. b. A digital forensic report generator eliminates the need to write a narrative report. c. A digital forensic report generator automatically provides sufficient explanation of the evidence. d. A report generated in HTML format can be easily incorporated into another electronic document using the hyperlink feature available in many word processors. Answer: a. A digital forensic report generator will create a detailed HTML report that includes such things as the date and time a file was last accessed, as well as the content of files identified by the examiner examination; d. A report generated in HTML format can be easily incorporated into other electronic document using the hyperlink feature available in many word processors. Explanation: A typical digital forensics program’s report generator will produce a report that contains discovered evidence and related information about the computer, such as the size of the disk drive being examined. The generated report findings of evidence do not include an explanation of what the evidence is and how it relates to the investigation. For cases not requiring a formal report, the examiner will need to provide an oral briefing of the findings. For investigations that require a formal report, a written report should be created that explains what evidence was found and how it relates to the case. 12. Which of the following describes expert witness testimony? (Choose all that apply.) a. Testimony designed to assist the jury in determining matters beyond the ordinary person’s scope of knowledge b. Testimony that defines issues of the case for determination by the jury c. Testimony resulting in the expression of an opinion by a witness with scientific, technical, or other professional knowledge or experience d. Testimony designed to raise doubt about facts or witnesses’ credibility

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

Answer: a. Testimony designed to assist the jury in determining matters beyond the ordinary person’s scope of knowledge; c. Testimony resulting in the expression of an opinion by a witness with scientific, technical, or other professional knowledge or experience Explanation: A digital forensics investigator testifying as an expert witness needs to communicate complex information to nontechnical persons, such as jurors, attorneys, and judges. It is the investigator’s responsibility to make sure they understand how you formulated an opinion from the evidence to arrive at your opinion. 13. When using graphics while testifying, which of the following guidelines apply? (Choose all that apply.) a. Make sure the jury can see your graphics. b. Practice using charts for courtroom testimony. c. Your exhibits must be clear and easy to understand. d. Be overprepared by having additional graphics that explain more complex or supporting issues. Answer: a. Make sure the jury can see your graphics; b. Practice using charts for courtroom testimony; c. Your exhibits must be clear and easy to understand. Explanation: When using graphics as part of your testimony presentation, it is important to make sure the jury can see them clearly. Graphics should be big, bold, and simple so that the jury can see them easily. Consider factors such as glare and adequate contrast to ensure easy visibility. Make sure you practice using the graphics so you are comfortable referring to them when testifying. Exhibits should be clear and easy to follow, especially for nontechnical jurors and the judge. 14. What kind of information do fact witnesses provide during testimony? (Choose all that apply.) a. Their professional opinion on the significance of evidence b. Definitions of issues to be determined by the finder of fact c. Facts only d. Observations of the results of tests they performed Answer: c. Facts only; d. Observations of the results of tests they performed Explanation: Fact witnesses may testify about facts relating to a case, including facts related to their observation of a crime or incident. A fact witness may also provide testimony regarding technical matters relating to a case, such as technical information about a computer system or network configuration. A fact witness might also testify about the number of files recovered using a keyword search or regarding their observations about the condition a computer when it was recovered from an incident or crime scene.

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

15. How should you respond to a question you don’t understand when testifying? Answer: If you are asked a confusing or awkward question that you don’t understand, simply ask that the attorney rephrase the question. This allows the attorney to better formulate their question and gives you more time to think about how to best answer it. 16. What should you do if you realize you have made a mistake or misstatement during a deposition? (Choose all that apply.) a. If the deposition is still in session, refer back to the error and correct it. b. Decide whether the error is minor and, if so, ignore it. c. If the deposition is over, make the correction on the corrections page of the copy provided for your signature. d. Call the opposing attorney and inform them of your mistake or misstatement. e. Request an opportunity to make the correction at trial. Answer: a. If the deposition is still in session, refer back to the error and correct it; c. If the deposition is over, make the correction on the corrections page of the copy provided for your signature. Explanation: Testimony in a deposition can be stressful since there is no judge or opposing attorney to object to the questions being asked. Questions from the attorney can be designed to elicit answers from you that are contrary to the facts as you know them so that your answers favor their client. If you make a mistake, correct it, and get back on track with your testimony. After the deposition has ended, if you realized you misspoke or made a mistake in your testimony notify the attorney that you would like to correct the error. 17. Which of the following are types of depositions? (Choose all that apply.) a. Testimony preservation b. Peer testimony c. Discovery d. Prestige testimony Answer: a. Testimony preservation; c. Discovery Explanation: There are only two types of depositions: testimony preservation and discovery. A testimony-preservation deposition may be requested by your client to preserve your testimony in case of schedule conflicts or health problems. These depositions are often video recorded in addition to the written transcript, and your testimony is entered by playing the video recording for the jury. A discovery deposition is part of the discovery process for trial. The opposing attorney who requested the deposition often conducts the equivalent of a direct examination and a cross-examination.

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

18. As a fact or expert witness at trial, what must you always remember about your testimony? a. You are responsible for the outcome of the case. b. Your duty is to report your technical or scientific findings or render an honest opinion. c. Avoid mentioning how much you were paid for your services. d. Always address the judge when responding to questions from the attorneys. Answer: b. Your duty is to report your technical or scientific findings or render an honest opinion. Explanation: For your credibility as a witness, you must be as truthful as possible. Any less than being truthful will damage your reputation. When responding to questions from attorneys in a jury trial, always face the jury. 19. Before testifying, you should do which of the following? (Choose all that apply.) a. Create an examination plan with your retaining attorney. b. Make sure you have been paid for your services and the estimated fee for the deposition or trial. c. Exercise appropriate grooming. d. Type all the draft notes you took during your investigation. Answer: a. Create an examination plan with your retaining attorney; b. Make sure you have been paid for your services and the estimated fee for the deposition or trial. Explanation: The examination plan helps ensure sure that you and the attorney understand each other in terms of the technical matters of the investigation and your opinion of the case. By talking and developing the examination plan with the attorney, both of you will be prepared for your testimony. If you are working as an independent digital forensics examiner, never proceed with a case before a payment for your services has been made. 20. Which of the following describes the purpose of the voir dire? (Choose all that apply.) a. To exclude certain evidence through a pretrial motion b. To create an examination plan by an expert witness c. To determine the qualifications of a witness as an expert d. To make corrections to your testimony after a deposition Answer: c. To determine the qualifications of a witness as an expert Explanation: During voir dire for an expert witness, the attorney guides the expert through their CV. The amount of detail in this examination depends on several factors, but they all relate to how much advantage the attorney sees in the witness’s qualifications. After the attorney has completed this examination, they ask the court to accept the witness as an expert. Opposing counsel might object, however, and is allowed to examine the witness, too. Cross-examination typically happens only if the opposing attorney thinks there’s something to gain from it.

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

21. What is a motion in limine? a. A motion to dismiss the case b. The movement of molecules in a random fashion c. A pretrial motion for the purpose of excluding certain evidence d. A pretrial motion to revise the case schedule Answer: c. A pretrial motion for the purpose of excluding certain evidence Explanation: A motion in limine is a pretrial motion asking the judge to exclude or limit the use of certain evidence. It allows the judge to decide (when the jury isn’t present) whether certain evidence should be admitted. 22. Your curriculum vitae is which of the following? (Choose all that apply.) a. A necessary tool to be an expert witness b. A generally required document to be made available before your testimony c. A detailed record of your experience, education, and training d. A description of your skills as they apply to the current case Answer: a. A necessary tool to be an expert witness; b. A generally required document to be made available before your testimony; c. A detailed record of your experience, education, and training Explanation: Your curriculum vitae (CV) lists your education, training, and professional experience and is used to qualify your testimony. For forensics examiners, this document is a necessary tool for serving as an expert witness and it generally must be made available before you testify. FRCP Rule 26, requires the examiner's curriculum vitae be included as part of their report (unless bona fides are integrated into the report). Make sure your CV reflects your professional background. Unlike a job resume, it should not be geared toward a specific trial. Most important, keep your CV current and date it for version control. If your CV is more than three months old, you probably need to update it to reflect new cases and additional training. 23. The most reliable way to ensure that jurors recall testimony is to do which of the following? a. Present evidence using oral testimony supported by hand gestures and facial expressions. b. Present evidence combining oral testimony and graphics that support the testimony. c. Wear bright clothing to attract jurors’ attention. d. Emphasize your points with humorous anecdotes. e. Memorize your testimony carefully.

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

Answer: b. Present evidence combining oral testimony and graphics that support the testimony. Explanation: Oral testimony supported by graphical presentations is an effective way to impart information and help your listeners retain it. Your exhibits must be clear and easy to understand. Graphics should be big, bold, and simple so that the jury can see them easily. Consider factors such as glare and adequate contrast to ensure easy visibility. If necessary, make smaller copies of graphics for jurors so that they can see details better. 24. If you’re giving an answer that you think your attorney should follow up on, what should you do? a. Change the tone of your voice. b. Argue with the attorney who asked the question. c. Use an agreed-on expression to alert the attorney to follow up on the question. d. Try to include as much information in your answer as you can. Answer: c. Use an agreed-on expression to alert the attorney to follow up on the question. Explanation: Responding to a question with a sentence that communicates limitations or qualifications might be important, if a simple yes or no doesn’t answer the question completely and accurately. If you need to have your attorney expand a line of questions on redirect, have an agreed-on expression you can use to signal him, such as “This question requires a more complex answer, but the short answer is yes (or no).” 25. In answering a question about the size of a hard drive, which of the following responses is appropriate? (Choose all that apply.) a. “It’s a very large hard drive.” b. “The technical data sheet indicates it’s a 3-terabyte hard drive.” c. “It’s a 3-terabyte hard drive configured with 2.78 terabytes of accessible storage.” d. “I was unable to determine the drive size because it was so badly damaged.” Answer: b. The technical data sheet indicates it’s a 3-terabyte hard drive; c. It’s a 3-terabyte hard drive configured with 2.78 terabytes of accessible storage; d. I was unable to determine the drive size because it was so badly damaged. Explanation: When testifying as an expert witness, state only the facts needed to answer the question. If you know the answer to the question being asked, provide a short answer that includes only the facts. For instance, if you are asked the size of a particular hard drive, specifically state the size of the hard drive if you were able to determine it. If you do not know the answer to a question, clearly state that you do not know or that you were unable to determine an answer to the question, Then follow up with a brief explanation regarding why you are unable to answer the question, such as, “The drive was so badly damaged that I was unable to determine its size and manufacture’s name.”

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

26. Which items should be included in your curriculum vitae? (Choose all that apply.) a. Previous expert testimony b. Education and training c. Work experience d. Training and presentations you have conducted Answer: a. Previous expert testimony; b. Education and training; c. Work experience; d. Training and presentations you have conducted Explanation: Your curriculum vitae (CV) lists your education, training and professional experience and is used to qualify your testimony. It should include all related and unrelated schooling, training, and work performed throughout your life. Also make note of any professional training you provided or contributed to, and include a testimony log that reflects every testimony you have given as an expert. For forensics examiners, keeping this document updated and complete is crucial to supporting your role as an expert and showing that you’re constantly enhancing your skills through training, teaching, and experience. 27. When working for a prosecutor, what should you do if the evidence you found appears to be exculpatory and isn’t being released to the defense? a. Keep the information on file for later review. b. Bring the information to the attention of the prosecutor, then to their supervisor, and finally to the judge (the court). c. Destroy the evidence. d. Give the evidence to the defense attorney. Answer: b. Bring the information to the attention of the prosecutor, then to their supervisor, and finally to the judge (the court). Explanation: All potential exculpatory information and evidence must be brought forward and revealed to all parties to ensure that the investigation and trial are conducted to the highest level of honesty and forthrightness.

Hands-On Projects - Solutions Project 2-1 Estimated Time: 60 minutes Objective: Complete a checklist to help organize your writing in preparation for writing a formal investigation report. Before You Begin: • • •

Complete Activity 2-1. Create Work folder C:\Work\Module_02\Project_02-1. Download to your Work folder the following data files provided with the module: • Project_02-1_Report_Writing_Guide_Checklist.xlsx

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

•

Download to your Work folder the following files you previously created: • Activity_02-1_Examiner_Notes_2-1.xls • The Autopsy report (report.html) created in Activity 2-1

For this activity, you will be initiating the steps necessary to write a report from the findings in Activity 2-1. You will fill out a checklist that will help identify the readers of the report, the report’s purpose, and the required format and style of the final report. Because this is the first step in the drafting of the report, not all sections of the checklist need to be completed. Leave blank any section for which you lack information or content, and include a header as a reminder for you to complete later in the final report. As a reminder, this case centers around George Montgomery, an employee who is missing from work. Known facts about this case include the following: •

This case was initiated as an investigation into the whereabouts of a missing employee and has turned into an investigation about possible employee abuse of company resources.

•

The missing employee appears to have been conducting a side business using a company computer.

•

One small-capacity USB drive was recovered from the employee’s assigned computer.

•

The requesting manager has some technical knowledge of information systems.

The objectives to be addressed in this report include the following: •

Attempt to determine George Montgomery’s location.

•

Attempt to determine the reasons that George Montgomery and another employee, Martha, are absent from work.

•

Give a statement indicating what resources were used to perform this examination.

•

Give a statement regarding what was found from this examination.

•

Provide an opinion about your findings.

It will be necessary to make assumptions for some of the items and questions in this checklist. Use your best judgment when completing this form. Complete the following steps: 1. Open the file Project_02-1_Report_Writing_Guide_Checklist.xlsx. 2. Open and review the report.html file and the Activity_02-1_Examiner_Notes.xlsx file to answer the questions in rows 4 through 28 in Project_021_Report_Writing_Guide_Checklist.xlsx, part of which is shown in Figure 2-7. [Figure 2-7 Example of a report-writing checklist] 3. Next, answer the questions in rows 30 through 32. For these questions, use your judgment. 4. When you have completed entering information into the spreadsheet, save it and then close it. Submit to your instructor the following file: •

Project_02-1_Report_Writing_Guide_Checklist.xlsx

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

Solution Guidance: Students should create and fill in answers to questions in the checklist. The answers they provide should be short, concise, and specific to the checklist questions. Student should be allowed to make assumptions regarding the reader of the report in their responses. For questions that ask specifics about the examination, answers should state facts found during the examination. For an example of the file that students should submit, see the following solution file: • Solution_Project_02-1_Report_Writing_Guide_Checklist.pdf

Project 2-2 Estimated Time: 60 minutes Objective: Use a fact-collection questionnaire to organize your findings from a digital forensics examination. Before You Begin: • • • •

Complete Activity 2-1 and Project 2-1. Create Work folder C:\Work\Module_02\Project_02-2. Download to your Work folder the following data files provided with the module: • Project_02-2_Fact_Collection_Questionnaire.xlsx Download to your Work folder the following files you previously created: • Activity_02-1_Examiner_Notes.xlsx • Project_02-1_Report_Writing_Guide_Checklist.xlsx • The Autopsy report (report.html) created in Activity 2-1

This project will be used to help organize the facts discovered during a digital forensics examination along with the observations and opinions of the digital forensics investigator. This information will be used to create a detailed outline for a report. Complete the following steps: 1. Open the file Project_02-2_Fact_Collection_Questionnaire.xlsx. 2. In cell B3, enter your name as the examiner; in cell B4, type Use of Company Resources for the case name; and in cell B5, type Montgomery_72022 as the case number. 3. In cell B9, type Unauthorized Computing Activity of George Montgomery for the title of the report. 4. In cell B10 (Is a cover sheet needed?), type No. 5. Using information from the Autopsy report.html file from Activity 2-1, the Project_02-1_Report_Writing_Guide_Checklist.xlsx file, and the Activity_021_Examiner_Notes.xlsx file, continue answering the remaining questions in Preliminary_022_Fact_Collection_Questionnaire.xlsx rows 13 through 38. 6. When you have finished entering information into this spreadsheet, save it and close it. Submit to your instructor the following file: •

Project_02-2_Fact_Collection_Questionnaire.xlsx

7. Proceed to the next project.

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

Solution Guidance: The purpose of this project is to show students how to use a checklist to ensure all the evidence is correctly identified and documented after a digital forensics examination to ensure that no facts are overlooked and left out of the final report. Students should answer as many of the questions in file Project_02-2_ Fact_Collection_Questionnaire.xlsx as possible. For an example of the file that students should submit, see the following solution file: • Solution_ Project_02-2_ Fact_Collection_Questionnaire.pdf

Project 2-3 Estimated Time: 60 minutes Objective: Build a report outline using a questionnaire to organize the information obtained from the digital forensics examination. Before You Begin: • • • •

Complete Activity 2-1, Project 2-1, and Project 2-2. Create Work folder C:\Work\Module_02\Project_02-3. Download to your Work folder the following data files provided with the module: • Project_02-3_Report_Outline_Checklist.xls Download to your Work folder the following files you previously created: • Activity_02-1_Examiner_Notes.xlsx • Project_02-1_Report_Writing_Guide_Checklist.xlsx • Project_02-2_Fact_Collection_Questionnaire.xlsx • The Autopsy report (report.html) created in Activity 2-1

For this project, you will merge your notes from Activity 2-1, Project 2-1, and Project 2-2, and enter information into the outline checklist file Project_02-3_Report_Outline_Checklist.xlsx. This outline checklist will be used in Project 2-4 to write a report. To complete this outline for the report, complete the following steps: 1. Open the file Project_02-3_Report_Outline_Checklist.xlsx. 2. Open and review the contents of your answers in the following files: • • •

Activity_02-1_Examiner_Notes.xlsx Project_02-1_Report_Writing_Guide_Checklist.xlsx Project_02-2_Fact_Collection_Questionnaire.xlsx

3. After reviewing your notes from the three files listed in step 2, go to the Project_023_Report_Outline_Checklist .xlsx file and type Unauthorized Computing Activity of George Montgomery in cell B5 for the title of the report. In cell C7, type This will be a short report. (See Figure 2-8.) [Figure 2-8 Example of a report outline checklist] 4. For the remaining rows of the Narrative Content from Questionnaire column, write brief responses in complete sentences to the questions that appear in the first column. In the

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

Reminder Notes from Checklists column, add any additional comments, observations, and thoughts you have for each question. 5. When you have completed entering information into this spreadsheet, save it and close it. Submit the following file to your instructor: •

Project_02-3_Report_Outline_Checklist.xls Solution Guidance: Students are to review the following files, and add the pertinent information to the file Project_02-3_Report _Outline_Checklist.xlsx: • Activity_02-1_Examiner_Notes.xlsx • Project_02-1_Report_Writing_Guide_Checklist.xlsx • Project_02-2_ Fact_Collection_Questionnaire.xlsx • The Autopsy report (report.html) created in Activity 2-1 For each item listed in the “Report Section Headers” column in the Project_023_Report _Outline_Checklist.xlsx file, students should write brief responses in complete sentences in the “Narrative Content from Questionnaire” answer column. In the “Reminder Notes from Checklists” column, students should list information they may want to include in the final report to ensure that the report is complete and accurate. For an example of the file that students should submit, see the following solution file: • Solution_Project_02-3_Report _Outline_Checklist.pdf

Project 2-4 Estimated Time: 120 minutes Objective: Write an informal report based on the information obtained from the examiner notes, checklist, and questionnaires in Activity 2-1, Project 2-1, Project 2-2, and Project 2-3. Before You Begin: • • •

•

Complete Activity 2-1, Project 2-1, Project 2-2, and Project 2-3. Create Work folder C:\Work\Module_02\Project_02-4. Download to your Work folder the following data files provided with the module: • Project_02-4_Informal_Report.docx • Project_02-4_Report_Revision_Checklist.xls Download to your Work folder the following files you previously created: • Activity_02-1_Examiner_Notes.xlsx • Project_02-1_Report_Writing_Guide_Checklist.xlsx • Project_02-2_Fact_Collection_Questionnaire.xlsx • Project_02-3_Report_Outline_Checklist.xlsx • The Autopsy report (report.html) created in Activity 2-1

For this project, you will write an initial draft of a report that will contain information from Activity 2-1, Project 2-1, Project 2-2, and Project 2-3. This will be an informal report for the organization’s management, with fewer sections than would typically be included in a formal

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

report. The information you gathered in the previous activity and projects will be used to write the report. This project will be the first draft of your report. To create the first draft of your report, complete the following steps: 1. Open the following files: • • • • • • • •

Activity_02-1_Examiner_Notes.xlsx Project_02-1_Report_Writing_Guide_Checklist.xlsx Project_02-2_Fact_Collection_Questionnaire.xlsx Project_02-3_Report_Outline_Checklist.xlsx Project_02-4_Informal_Report.docx Project_02-4_Report_Revision_Checklist.xls The Autopsy report (report.html) created in Activity 2-1 A file compression program such as WinZip, WinRAR, or 7-zip

2. In the file Project_02-4_Informal_Report.docx, replace Title of report here for the Report header with Unauthorized Computing Activity of George Montgomery, and type your name as the report author. Enter your institution’s name next to “Organization,” the current date next to the “Date of Report,” and the case number Montgomery_72022 next to “Case Number,” as shown in Figure 2-9. [Figure 2-9 Informal digital forensics report] 3. Copy your answer from cell B9 in the Project_02-3_Report _Outline_Checklist.xlsx file, and paste it in the line below the Introduction heading in Project_02-4_Informal_Report.docx. 4. Copy the contents of cell B11 in the Project_02-3_Report _Outline_Checklist.xlsx file and paste it in the line below the Bona Fides heading in file Project_02-4_Informal_Report.docx. 5. Copy the contents of cells B13, B14, and B15 in the Project_02-3_Report _Outline_Checklist.xlsx file, and paste them under the Case Examination and Findings heading in the report file Project_02-4_Informal_Report.docx. 6. Copy the contents of cells B17, B18, and B19 in the Project_02-3_Report _Outline_Checklist.xlsx the, and paste them under the Conclusion heading in the report file Project_02-4_Informal_Report.docx. 7. Review the following files for any additional information you may have missed, and add it to the file Project_02-4_Informal_Report.docx where appropriate: • • •

Activity_02-1_Examiner_Note.xlsx Project_02-1_Report_Writing_Guide_Checklist.xlsx Project_02-2_Fact_Collection_Questionnaire.xlsx

8. Read through your report and correct the spelling, grammar, and flow of the report. 9. In the Project_02-4_Report_Revision_Checklist.xlsx file, answer the questions in rows 3 through 10, and make any necessary updates or corrections in the file Project_024_Informal_Report.docx. 10. In your Work folder, navigate to the Autopsy subfolder Reports\Activity_02-1 HTML Report mm-dd-yyyy-hh-mm-ss. Compress into one zip file the report.html file and the subfolder content to create the compressed file Activity_02-1 HTML Report mm-dd-yy-hh-mm-ss.zip.

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

11. When finished, save and close all files. Submit to your instructor the following files: • • •

Project_02-4_Informal_Report.docx Project_02-4_Report_Revision_Checklist.xlsx Activity_02-1 HTML Report mm-dd-yy-hh-mm-ss.zip Solution Guidance: Students are to write a report using notes and information from Activity 2-1, Project 2-1, Project 2-2, and Project 2-3 using the following files: • Activity_02-1_Examiner_Notes.xlsx • Project_02-1_Report_Writing_Guide_Checklist.xlsx • Project_02-2_Fact_Collection_Questionnaire.xlsx • Project_02-3_Report_Outline_Checklist.xlsx • The Autopsy report (report.html) created in Activity 2-1 The information collected in these files should be transferred to the file Project_024_Informal_Report.docx in the order prescribed in the steps of this project. After the information has been written into file Project_02-4_Informal_Report.docx, students should revise their report by rereading it and making any necessary spelling and grammar corrections. Students should also check for readability of the report to improve its quality. As part of the revision process, student should use the file Project_024_Report_Revision_Checklist.xlsx as a quality control checklist before finalizing the report. For examples of the files that students should submit, see the following solution files: • Solution_Project_02-4_Informal_Report.pdf • Solution_Project_02-4_Report_Revision_Checklist.pdf • Solution_Activity_02-1 HTML Report mm-dd-yyyy-hh-mm-ss.zip

Project 2-5 Estimated Time: 60 minutes Objective: Review your digital forensics report and prepare for testimony. Before You Begin: • • • •

Complete Activity 2-1 and Project 2-4. Create Work folder C:\Work\Module_02\Project_02-5. Download to your Work folder the following data files provided with the module: • Project_02-5_Testimony_Prep_Checklist.xlsx Download to your Work folder the following files you previously created: • Project_02-4_Informal_Report_First_Draft.doc • The Autopsy report (report.html) created in Activity 2-1

For this project, you will review your report from Project 2-4, and answer the questions in the file Project_02-5_Testimony_Prep_Checklist.xlsx to prepare for testimony. To prepare to testify, complete the following steps:

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

1. Open the file Project_02-5_Testimony_Prep_Checklist. 2. Review Project_02-4_Informal_Report_First_Draft.docx and the report.html Autopsy report created in Activity 2-1. 3. In cell C5 of the Project_02-5_Testimony_Prep_Checklist.xlsx file, type Unknown at this time because no theory was stated by Steve Billings. 4. In cell C6, type, George Montgomery and Martha were conducting personal for-profit business on company computing assets, as shown in Figure 2-10. [Figure 2-10 Completing the testimony prep checklist] 5. Continue answering the remaining questions in the checklist to the best of your knowledge. For any questions you do not have the answers to, type I don’t know. For questions that are not applicable, type Not applicable. 6. When finished, save and close all files. Submit to your instructor the following file: •

Project_02-5_Testimony_Prep_Checklist.xlsx Solution Guidance: Students are to review the file Project_024_Informal_Report_First_Draft.docx and answer the questions in the file Project_025_Testimony_Prep_Checklist.xlsx regarding the digital forensics examination performed in Activity 2-1. For an example of the file that students should submit, see the following solution file: • Solution_Project_02-5_Testimony_Prep_Checklist.pdf in the Solutions folder.

Case Projects - Solutions Case Project 2-1 Estimated Time: 60 minutes Objective: Research and create an outline for a resume and a curriculum vitae (CV). In this Case Project, you will research how to create a resume and CV and develop an outline for both types of documents. From these outlines, you will write a resume and a CV in Case Projects 2-2 and 2-3. Note that a resume is typically one page long, with brief summaries of information written for a specific job. A CV is typically several pages long, with details from your background and experience that are relevant to your career; it should include many more details than a resume. Before You Begin: •

Create Work folder C:\Work\Module_02\Case_Project_02-1.

Complete the following steps: 1. Using your preferred web browser search engine, search for “How do I write a resume.” Review several websites, including some that offer examples of sample resumes, taking notes of the recommendations provided.

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

2. Next, search for “How do I write a curriculum vitae.” Review and take notes of the recommendations provided from several websites, including some that offer examples of CVs. 3. Based on your notes and the sample resumes and CVs you found during your online search, write an outline for your resume and another outline for your CV. Save your resume outline as Case_Project_02-1_resume_outline and your CV outline as Case_Project_02-1_CV_outline in your Work folder. 4. Submit to your instructor the following files: • •

Case_Project_02-1_resume_outline Case_Project_02-1_CV_outline Solution Guidance: Students are to review various websites that have specific instructions on how to write a resume and CV. From their review and notes, they will need to create an outline for both a resume and a CV. The resume outline should have the following sections: • Student’s contact information • Work experience history, including any internships and related volunteer work • Personal achievements and related activities • Education and training • Specific skills related to the requirements of the posted job The CV outline should have the following sections: • Student’s contact information • Formal education • Informal education • Skills • Work history, with detailed descriptions of duties and accomplishments • Awards received from work performed • Publications produced • Presentations given • Certificates and professional licenses Note that students new to digital forensics and those with minimal work history and education can skip those sections that are not relevant for them. The following websites are helpful resources for writing resumes: • indeed.com/career-advice/resumes-cover-letters/writing-a-resume-with-noexperience • topresume.com/career-advice/make-a-great-resume-with-no-work-experience • myperfectresume.com/resume/examples The following websites are helpful resources for writing curriculum vitae: • indeed.com/career-advice/resumes-cover-letters/cv-format-guide • zety.com/blog/how-to-write-a-cv • owl.purdue.edu/owl/job_search_writing/resumes_and_vitas/writing_the_cv.html

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

Case Project 2-2 Estimated Time: 90 minutes Objective: Create a resume tailored to a specific digital forensics job description. Before You Begin: • • •

Complete Case Project 2-1. Create Work folder C:\Work\Module_02\Case_Project_02-6. Download to your Work folder the following data files provided with the module: • Case_Project_02-2_Digital_Forensics_Analyst_Job_Description.pdf • Download to your Work folder the following files you previously created: • Case_Project_02-1_resume_outline • Access the following items: • Research information from Case Project 2-1 • Your education and work history Using the information you gathered while completing Case Project 2-1, create a one-page resume tailored to the job description in the Case_Project_022_Digital_Forensics_Analyst_Job_Description.pdf file. Because you may not possess some of the required skills stated in the job description, include previously unrelated skills and experiences that can be applied to this job description. Note 15 As you progress in your career, routinely update your resume and CV to show your continued growth in experience, education, and training. In addition, when submitting your resume or CV to an attorney (or instructor), convert it to a Portable Document File (PDF) format. Complete the following steps: 1. Using your resume outline and the research you gathered in Case Project 2-1, create a resume for the digital forensics analyst position described in the Case_Project_022_Digital_Forensics_Analyst_Job_Description.pdf file, and save it in your Work folder. To make the writing process easier, have a vision or idea of what the resume should look like as a finished product based on your research. 2. For those just entering the digital forensics field, a resume would typically be one page long; two pages is appropriate for more experienced professionals. Avoid creating a resume longer than two pages. A document longer than two pages is a CV and is not a summary of qualifications for a specific position you are applying for. At the top of your resume, provide your complete and spelled-out mailing address (no abbreviations, such as “New York” instead of “NY”) and, optionally, a professional networking profile link. For this exercise, you may use your institution’s mailing address and phone number as your mailing address and phone number. 3. A resume needs to be formatted for ease of readability. Typically, you have about 5–12 seconds to impress a hiring manager enough that they will consider you for an interview. Use a font size between 10 and 12 points and ensure that the document has the appropriate white space along the margins and between the lines of text. Many employers only receive resumes electronically through an application tracking system (ATS) program. When a resume is received, the ATS program will search it for key words from

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

the job announcement. The resume with the most key word matches will be placed at the top of the list for the hiring manager to review. For more information on how to optimize your resume for an ATS, see these websites: • •

visualcv.com/blog/how-to-beat-the-applicant-tracking-system Jobscan.co/blog/8-things-you-need-to-know-about-applicant-tracking-systems

4. Whenever possible, professional experience included on your resume should reflect the skills and qualifications listed in the job posting. If you do not have anything on point, describe experiences that demonstrate your aptitude for the skills and qualifications described in the job posting. 5. For each job position on your resume, include a one- or two-sentence description of the position, and identify at least three to five accomplishments that illustrate your ability to solve problems, along with quantifiable metrics (e.g., Implemented new inventory control procedures to reduce shrink by 15%). 6. Save your resume using one of the following file names, and submit the file to your instructor as a PDF file or printed on letter- or A4-sized paper: • •

Case_Project_02-2_ATS_version.pdf Case_Project_02-2_NonATS_version.pdf Solution Guidance: Students’ resumes should be brief and concise. Because they may have only minimal training and experience in digital forensics, they should strive to list information that indirectly relates to this profession. Students should be given the option of producing an ATS-compatible or a non-ATS formatted resume. For examples of both styles of resumes, see the following solution files: • Solution_Case_Project_02-2_ATS_version.pdf • Solution_Case_Project_02-2_NonATS_version.pdf

Case Project 2-3 Estimated Time: 4–24 hours Objective: Create a curriculum vitae for a digital forensics examiner. Before You Begin: • • • •

Complete Case Project 2-1. Create Work folder C:\Work\Module_02\Case_Project_02-3. Download to your Work folder the following file you previously created: • Case_Project_02-1_CV_outline Access the following items: • Research information from Case Project 2-1 • Your education and work history

Complete the following steps: 1. Based on your research, prepare your CV with the following information: •

Your contact information

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

•

• •

Education history (starting with the most recent, and nothing lower than postsecondary education; include any post-secondary education you have completed to date if you have not finished your education at the time the document is written) Employment history (starting with the most recent) Professional certifications (starting with the most recent)—presented as: vendor name, certificate title, date, certificate course number, and certificate ID, as in the following example: CompTIA, Downers Grove, Illinois Course: Network1, N10-003 Date: 01/2008 ID: SRSYM7F4K3ZP43PS

•

Expert witness testimony listed as: Plaintiff v Defendant. Case Number. Legal Report Number. (Name of the court, date of decision), as in the following example: Greyhound Lines, Inc. v. Robert Ward, et al. No. 06-1875. 485 F.3d 1032. (8th Cir. April 24, 2007)

• • •

Professional presentations and training Course and workshops attended Specific experience as a subject matter expert

2. Save your CV to your Work folder, and submit it to your instructor for review. (All documents must be submitted as a PDF file or printed on letter- or A4-sized paper.) When submitting your resume use one of the following file names for the project: • •

Case_Project_02-3_ATS_CV-your-name.pdf Case_Project_02-3_NonATS_CV-your-name.pdf

A resume and CV require constant revision to produce a usable product. Expect to allocate 50–80% of your time revising your documents. Review your documents several times, keeping an eye out for clarity of thought, progression, and proper spelling and grammar. When possible, print out the document and read it out loud to identify where you may have spelling, grammar, or syntax errors. Solution Guidance: Students’ CVs should be detailed and should include a list of their training and work history. Because a CV is a list of one’s accumulated life experiences, it should include all work, education, and other related profession experiences. Students should include all accomplishments achieved related to their schooling, employment, and membership in any clubs or social organizations. Students should be encouraged to write brief stories about their accomplishments for specific situations in their lives. For an example of an ATS compatible CV, see the following solution file: • Solution_Case_Project_02-3_CV-CynthiaKazakova.pdf. In addition, students might find helpful information on the following websites, which describe a variety of CV designs: • thebalancecareers.com/cv-samples-and-writing-tips-2060349 • grad.illinois.edu/sites/default/files/pdfs/cvsamples.pdf • standout-cv.com/blogs/cv-writing-advice-blog/115702276-example-of-a-good-cv

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

Case Project 2-4 Estimated Time: 60 minutes Objective: Create a glossary for your report’s reference section. Before You Begin: • •

Create Work folder C:\Work\Module_02\Case_Project_02-4. Access the following items: • Key terms used in Modules 1 and 2 along with reference sources on the web

For this Case Project, you will create a glossary with important terms and definitions related to digital forensics. In addition to the key terms word lists found at the end of Modules 1 and 2, you should include additional words that you think might be of use in a digital forensics report for nontechnical readers. (Note that this will be an ongoing task as you make your way through the remaining modules in this book.) To create your glossary using a spreadsheet application, complete the following steps: 1. Open a new spreadsheet, and type Key Term in cell A1 and Definition in cell B1. Widen columns A and B as shown in Figure 2-11. [Figure 2-11 A digital forensics report glossary spreadsheet] Note 16 When writing definitions for your report, keep in mind that the person reading them will typically have very little technical knowledge. Provide concise and easy-to-understand descriptions and, if necessary, include examples in your definitions for the reader. 2. In each row, in column A, type in the key term word or acronym followed by its definition in column B. Verify your definition from the descriptions in this module, the glossary of this book, or through your preferred web search engine. 3. After you have completed entering the key terms and definitions, review your file carefully. Correct any spelling errors, using the spell check function key (F7), and check the grammar of the definitions. 4. Sort the glossary in alphabetical order by key term by selecting from row 2 through the final row containing a key term and definition. Then click Data, and Sort for Microsoft Excel, or Sort Ascending for LibreOffice Calc. 5. When finished, save your glossary as Case_Project_02-4_Glossary in your Work folder, and submit to your instructor the following file: •

Case_Project_02-4_Glossary.xlsx Solution Guidance: Students should produce a spreadsheet that contains technical terms relating to digital forensics. The key terms selected by the student can vary since they will apply their own judgment regarding which terms to include. Definitions, grammar, and spelling should be verified for correctness and accuracy. Definitions should be concise and easy for the nontechnical reader to understand. For an example of the type of glossary students should submit, see the following solution file: • Solution_Case_Project_02-4_Glossary.pdf

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 2: Report Writing and Testimony for Digital Investigations

Case Project 2-5 Estimated Time: 20 minutes Objective: Create a list of books, articles, journals, and other resources on digital forensics and assorted information technologies for your own reference library (in either hard copy or digital form). Before You Begin: • •

Create Work folder C:\Work\Module_02\Case_Project_02-5. Access the following items: • Resources from online and brick-and-mortar bookstores, libraries, journals, and other resource sites

For this project, start by searching for digital forensics, information technology, and other forensics science books from online libraries and bookstores, such as Barnes & Noble or Amazon. Expand your search to identify specific articles and journals as well as other reference websites that might be helpful to you in your work as a digital forensics investigator. Finally, do a search for companies and organizations that provide advanced digital forensics technical services. Using your preferred word processor program, create a list of these resources. Your list should have the following two sections: • •

The books you have read and books you would like to read Web links for articles, journals, reference sites, how-to guides, and advanced digital forensics technical services

Use a standard bibliography format, such as American Psychological Association (APA) or Modern Language Association (MLA) formats, to list the books and articles. For details on how to write references using any one of these three formats, see the following websites: • •

For APA: writingcenter.uagc.edu/format-your-reference-list For MLA: bibliography.com/mla/mla-book-citation-examples

For your list of references, consider also providing a comment section for personal notes for each book you have read or wish to read. When finished, save your reference list as Case_Project_02-5_References in your Work folder, and submit to your instructor the following file: •

Case_Project_02-5_References.docx Solution Guidance: Students are to research online sources for relevant articles, journals, reference websites, companies, and other organizations connected to digital forensics, related IT topics, and general investigative subjects. From this research they are to create a document that contains a list of these references, along with any notes that provide more information about reference. This list should use APA or MLA bibliography reference formats. Students’ references should only use one format, not both, throughout the entire document. For an example of the type of document students should submit, see the following solution file: • Solution_Case_Project_02-5_References.pdf

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 3: The Investigator’s Laboratory and Digital Forensics Tools

Solution and Answer Guide

BILL NELSON, AMELIA PHILLIPS, CHRIS STEUART, ROBERT S. WILSON, GUIDE TO COMPUTER FORENSICS AND INVESTIGATIONS , 7TH EDITION, ISBN: 9780357672884; MODULE 3: THE INVESTIGATOR ’S LABORATORY AND DIGITAL FORENSICS TOOLS

Table of Contents Activities - Solutions .......................................................................................................... 2 Activity 3-1 ................................................................................................................................. 2 Review Questions - Answers ............................................................................................. 3 Hands-On Projects - Solutions .......................................................................................... 9 Project 3-1.................................................................................................................................. 9 Project 3-2 ................................................................................................................................ 11 Project 3-3 ................................................................................................................................ 12 Project 3-4 ................................................................................................................................ 14 Case Projects - Solutions ................................................................................................. 16 Case Project 3-1....................................................................................................................... 16 Case Project 3-2 ...................................................................................................................... 17 Case Project 3-3 ...................................................................................................................... 18 Case Project 3-4 ...................................................................................................................... 19 Case Project 3-5 ..................................................................................................................... 20

Solution and Answer Guide: Bill Nelson, Amelia Phillips, Chris Steuart, Robert S. Wilson Guide to Computer Forensics and Investigations, 7th Edition, ISBN: 9780357672884; Module 3: The Investigator’s Laboratory and Digital Forensics Tools

Activities - Solutions Activity 3-1 Estimated Time: 5 minutes Objective: Determine file ownership by using the command-line interpreter (CLI) in Windows. Before You Begin: •

Access the following item: •

A computer using the Windows 10 operating system or newer

Complete the following steps: 1. Open a command prompt window by pressing the Windows key and the R key. In the Run input box, type cmd and click OK. 2. At the command prompt, type cd \ and press Enter to take you to the root directory. Create a Work folder for this activity by typing md Work\Module_03\Activity_03-1 and press Enter. 3. At the root directory, type dir /q > C:\Work\Module_03\Activity_03-1\Fileowner.txt and press Enter. 4. In any text editor, open Fileowner.txt to see the results. You should see your file structure and whether the files were generated by the system or by a user. When you’re finished, exit the text editor and close the command prompt window. 5. Submit to your instructor the following file: •

Fileowner.txt Solution Guidance: If students successfully complete this activity, the file Fileowner.txt should list the owners of the directories. For an example of the file that students should submit, see the following solution file: •

Solution_Activity_3-1_Fileowner.pdf