What did you find on the flash drive (what files? In what condition?).

Learning Goal: I’m working on a cyber security project and need an explanation and answer to help me learn.

CASE FACTS:

• A female employee, sales representative, has alleged that another employee, Robert, also a sales representative, has harassed her.
• This employee showed the Human Resources Department 3 messages that were sent to her.
• She had been contacted on her private email, by Robert, who became increasingly aggressive and eventually showed up in a coffee shop while she was with a friend.

YOUR JOB:

• • As part of the investigation into the allegation, Robert’s cubicle was searched and a USB flash drive was found, forensically imaged and handed to you.
  • You have the image file: FlowerGirl.img

• •  Download FlowerGirl.img .
    MD5 of img file = 338ecf17b7fc85bbb2d5ae2bbc729dd5
  • Your job is to analyze it. As you can see this assignment is about “investigating” a case. You have to think critically and evaluate the merits of different possibilities applying your knowledge what you have learned so far and going to learn in next two weeks. Please note there is no step by step direction. As you can see providing a direction will kill the investigation. However, I am happy to supervise this projects. So there is a Discussion Board forum, I enjoy seeing students develop their skills in critical thinking and the expression of their own ideas. Project work naturally leads into argument, whether that’s about the interpretation of data or the validity of a philosophical viewpoint. But remember this is Digital Forensics – we need clear evidence not just raw data.

YOUR REPORT:

You should answer the following questions:

1. What did you find on the flash drive (what files? In what condition?).
2. What actions did you take to analyze?
3. In your opinion, did he harass her or not? Explain why and how you arrived to this conclusion! What did he do?
4. Why was this case called “the flower girl”?

Report Format

Your report format should contain the following items:

1) Title Page

2) Case Background – Tell the background of the case – all of the accusations and details revolving the scope of the investigation.

3) Tools Used – List of the tools used throughout your project

4) Image authentication (and duplication)

5) Analysis details (everything you analyzed (should be broken out into different things you analyzed and what you found or didn’t find). Timeline of events is also important.

6) Conclusion: What did you find overall to support the original claims or not support the original claim. Be sure to discuss all evidentiary artifacts to support your findings.

Important info:

try to address (not just answer) the following questions in your report:

• What did you find on the flash drive? A list of all files contained on the drive and their state and (deleted, not deleted, hidden). List everything including the volume.
• Explanation of the findings: What did you actually do to make the findings into evidentiary value? What actions did you take to analyze? For example: Finding ten bottles of Coke on one’s table is not enough to conclude that one drank all of them. But if you test the caffeine level in the blood, that might help to conclude.
• A time line of events. Extremely important – This will lead the investigation.
• A brief explanation of why the case was called “Flower Girl”? A list of names of people involved. You need to be very careful with this part. Just because you find word ” flower girl” somewhere in the image does not prove that it is related to your case. You need to make it an evidence.
• Your personal verdict on whether the suspect is guilty or not, and why. (This is the Fun part, just concluding the case. Remember you are stepping into the Administration of justice area and this is not a Forensic Analyst’s job) .
• Your analysis should be thorough and complete. It should also be supported by appropriate screen captures! NO points will be given without appropriate screen capture of your analysis.
• All screen captures must accompany a date stamp. Inside the project report, if any screen capture is found without a date stamp, that portion will not be given full credit.