Throughout This Course You Will Be Keeping An Investigative

Throughout This Course You Will Be Keeping An Investigative Journal

Throughout this course, you will be keeping an investigative journal. The purpose of this journal is to archive any artifacts and information that may support your final projects. You will submit it as part of Milestone One and receive points within the milestone rubric for this. Additionally, it will assist you by allowing you to organize information in a chronological order that you can easily retrieve when completing the final projects in the later modules. This journal can be kept as a Word document.

You can compile journal entries within the same document and submit this document as one file submission at the end of the course with your Milestone One submission. In your investigative journal, develop a chain of custody form to be used within a business based on forensic notes for the final project. In your investigative journal, record how data is acquired and the tools used in the final project scenario. In your investigative journal, record network analysis for the final project scenario.

Paper For Above instruction

This investigative journal documents the forensic analysis process involved in investigating suspected intellectual property theft at ACME Construction Company, with additional context from a similar case involving Drew Patrick, a senior manager at a manufacturing firm. Throughout this report, I will outline the steps taken to acquire data, the tools used, the network analysis performed, and the chain of custody procedures followed during the digital forensic investigation.

Introduction

Digital forensic investigations are integral to uncovering illicit activities such as intellectual property theft, especially in high-stakes corporate environments. The analysis described here illustrates the methodical approach to collecting, preserving, and examining digital evidence in a case involving suspected unauthorized data transfer by Drew Patrick, a senior manager at ACME Construction. Proper documentation, adherence to chain of custody protocols, and meticulous data handling ensure the integrity of evidence, crucial for supporting lawful proceedings.

Data Acquisition and Tools Used

The initial phase of the investigation involved comprehensive data collection from suspect systems, including Drew Patrick's workstation and network infrastructure. Creating forensically sound copies of digital media was paramount. Utilizing FTK Imager, a trusted tool in digital forensics, the forensic team captured an exact bit-stream image of Drew’s 500 GB Western Digital hard drive (Rogers et al., 2020). The integrity of the collected data was verified through hash values, specifically MD5 and SHA-1, which matched between the original and the duplicate image, ensuring no alteration occurred during acquisition (Casey, 2011).

Subsequently, forensic examination employed tools like Autopsy and The Sleuth Kit, which facilitated detailed analysis of the NTFS filesystem. These tools enabled filtering, indexing, and keyword searches to identify relevant files, such as SQL databases, Excel spreadsheets, emails, chat logs, and internet history (Casey, 2014). Such comprehensive data acquisition and analysis provide insightful evidence regarding the suspect’s activities.

Chain of Custody Procedures

Maintaining a proper chain of custody is critical in digital investigations to preserve the integrity and admissibility of evidence. The process started with documenting the forensic image’s creation, including the hardware details like the serial number of the hard drive (NB497356F). Each handling step is recorded: from initial seizure of the device, imaging process, storage, to analysis. Hash values recorded at each stage serve as verification that the evidence remains unaltered (Rogers et al., 2020). These meticulous records attest to adherence to legal standards and ensure that the evidence can withstand scrutiny in court proceedings.

Network Analysis

Network analysis involved examining suspect activity across multiple digital vectors. Snort, an open-source intrusion detection system, flagged unusual peer-to-peer (P2P) traffic originating from Drew’s IP address, despite the absence of active logins at the time of file transfer, suggesting the use of an anonymous account or external access (Scarfone & Mell, 2007). Investigation of server logs confirmed repetitive login attempts to the R&D database weeks prior to the transfer window, indicating premeditated access. Additionally, analysis of firewall logs from intrusion prevention systems (IPS) revealed outbound data packets matching proprietary design files transferred to external IP addresses (Mirkovic et al., 2018).

The network logs also uncovered that files were transferred via P2P protocols in breach of corporate policy. Packet capture logs documented the flow of data from Drew’s workstation to external servers, corroborating physical file access logs and file transfer indicators. This triangulation of data sources—network logs, server access records, and endpoint analysis—provides compelling evidence of malicious activity (Kaur & Kaur, 2020).

Conclusion

The investigation into Drew Patrick’s conduct demonstrates the importance of a meticulous approach to digital evidence collection, analysis, and documentation. The forensic process employed securing a proper chain of custody, using industry-standard tools like FTK Imager, Autopsy, and Snort to acquire, analyze, and verify evidence. Network analysis illuminated suspicious activity, including P2P traffic, anomalous account use, and data exfiltration to unauthorized external IP addresses. These findings support further legal action and exemplify best practices in digital forensic investigations within corporate environments.

References

• Casey, E. (2011). Digital Evidence and Computer Crime: Forensic Science, Computers, and the Law. Academic Press.
• Kaur, T., & Kaur, P. (2020). Network Forensics: A Review. Journal of Cyber Security Technology, 4(2), 123-135.
• Mirkovic, J., et al. (2018). Network Traffic Analysis and Incident Response. IEEE Communications Surveys & Tutorials, 20(4), 3418-3440.
• Rogers, M. K., et al. (2020). Forensic Science and Digital Evidence: An Introduction. CRC Press.
• Scarfone, K., & Mell, P. (2007). Guide to Intrusion Detection and Prevention Systems (IDPS). NIST Special Publication 800-94.
• Casey, E. (2014). Digital Evidence and Analysis Techniques. Academic Press.