Recovery of Digital Evidence

Recovery of Digital EvidenceIntroductionThe University suspects that a case of wrongdoing has been undertaken by a member of staff within Edge Hill University and the computer forensic team, of which you be part of, has been asked to investigate.You and your team have been asked to launch an investigation into onlyeged utilise of the Universitys IT system. The office used a member of staff has been isolated, sealed and secured.The staff member has been interviewed by IT services as well as the Dead of capability and HR and has subsequently denied all wrongdoing. Items from the staff office have been corned by your team. The evidence recovery has been conducted in a rigorous secure personal manner in lines with a strict methodology.The Principles of Digital EvidenceEvidence Recovery ProcessFrom the start of the process there must be a stipulate way to conduct the investigation, the crime scene is a very delicate place in terms of collection of critical vital evidence, which if left unsecure could be easily be altered or corrupted, therefore its important to follow several account stages, the first beingThe Plan of the investigation Where ar, we going to generate the suspected evidence, i.e. on Computer system, Smart phone, USB, floppy disc, Hard Drive.Should social media i.e., Twitter, Facebook, Chat Forums, be checked for germane(predicate) evidence they may hold.Contact of user ISP for trace historyMobile network contact, may have on online account with online storage.How to conduct the Investigation My Flow PlanRight to Search and raptureIn order to conduct an investigation there are Legal and ethical aspects that are very important and must always be adhered to key points that would always be considered when its decided that evidence will need to be receivedJust because there are several computers in the house doesnt infallible mean that they should all be seized for forensic inspection, the person attending the crime scene must have Reasonab le grounds to remove possessions and there must be justified reasons for doing this.Due to the sensitive nature of the investigation it would always be a necessary moral characteristic that the investigator would be honest and truthful.Consideration as to whether what items are likely to hold key information, i.e. there would no point in seizing a microwave when we are feel at a computer related crime.Consider the offence, narrow down the time period of suspected crime.Items found that are connected to internet are likely to contain key information and should be seized.Documents/booklets, notepads to be seized as they may hold online storage accounts and passwords where information is held.Approach StrategyThis all would be done using a Flow plan for the team to follow as discussed in Assignment 1,Capture of relevant information One of the virtually important steps within the whole process, if mistake is made here then the whole investigation is under threat.The room was secured and isolated to risk the tint of any tampering with evidence.This could basically fail in to a very similar category, this may involve the collection of volatile date.Volatile data is the data that we have at the scheme of the crime that may be lost if the investigator doesnt follow the correct procedure, i.e. recording what state the computer is on at that time. The Volatile data would be stored for example on a PC in the Ram (Random Access Memory) and would contain key information such as website data, chat history etc. that may be key to overall success of the investigation.Bagging in secure bags that are tamper proof insuring that they are labelled acutely with a reference number for later inspection.Suspected member of staff interviewed denied any wrong doing.Analyse of Evidence Evidence has been recovered from the staff office by a colleague within the forensic team, we have found the followingA USB pen drive seized bagged up in secure zipper bagFeedback to be given to give information on where to investigation in going.Each step to be recorded quantify scales availableResources available to investigatorTools that are available for the forensic compend.Data recovered from the USB drive, seems to just be Standard information but further analysis is needed to establish truth.Evidence Seized Note pad with 3 passwords onCabbageApplepear treeUSB device seized from the office. From what we can see on the USB is3 PDFs3 ImagesA word document Titled Payments for paper4youFiles present on USB Un touchedOn the next step of my investigation I will receptive each file without any interference from any Encryption programs.File Payments for papers4you.docxFile 30037888.pdfFile AUP.pfd,File conduct.pdfChocolate 1.jpg.pngEven more chocolate.jpg.pngMore Chocolate.jpg.pngInvestigation of the Evidence For the pupose of the investigation I will now check to see if the items sesiued are extactly as they seem. I do think this step is necessary aspart of the on going in vestigatiion.In order to check individual files, I will use OpenSteg application, the reason to do this is it will check each induvual file in order to establish any obscure files located on the the USB.To do this I will use a programe called OpenSteg which will highlight any hidden informationOpenStego Menu,- As you can see we can Hide or Extract Data from a any file, in this case we will be Extracting the Data from the chosen file.Menu of the file which I wish to look at though OpenStego Chocolate 1On checking the file, it is clear the it needs a password to open it, I will try the 3-password written down on the note pad recovered from the scene, which areAppleCabbage pearIt would appear that there is a file within this picture titledMaster_Sheet.xlsxUpon opening the Excel File it appers that it requires a password of which I have 3 ApplePearCabbageApple and Pear are unsuccessful, but Cabbage has grated me access to the Excel fileIt appears to show Financial transactions from do cument 4 you dated from 2008 to 2016200820092010201120122013201420152016The same was done with the file Even more chocolate.jpg.pngUpon doing this it is clear there is a file hidden within the picture titled Invoice Jan-16.docx As per belowPicture 3 to be checked using OpenStego file name More Chocolate Using password PearInformation from file Jan-15Bring the evidence together as one we could use Encase this would give us a clear understanding of all the evidence together in one file format I have demonstrated in a walk through via screenshotsLanding rogue Encase New case Location and nameFile is now given name Assignment 2 and location.Adding Evidence to the caseLocate relevant file to add the information needed for the investigation.Section of key files to use as evidence.Summary of the EvidenceFrom conducting this investigation certain key points must be established when investigating the caseFacts or fiction and can prove this with hard evidence.Prove that it did happen in th e first place.Are we looking at the right person that is accused?Have any mistakes been made., things been missed or thigs been altered.Forming the whole investigation, we can see from the Time Line, what information and by what process was followedIt is with my pass that the Case be referred to CPS for Criminal Proceedings. Due to the many breachs with in the law, (Data Protection, Computer misuse act, It Computer Policy) and the and the vast amounts of money received, it is unlikely that internal University black-tie proceedings would bring accountability for the thief.In Conclusion, it would also be recommended that upon Criminal Proceedings being initiated, that an order for the Proceeds of Crime Act be classify to recover the ill-gotten gains.