Digital Forensics MN624

Prepared by: Dr Ammar Alazab Moderated by: Dr Ajay Sharma October 2020

MN624 – Digital Forensics – Final Assessment Trimester 2, 2020
Page 2 of 11
Summary of Marks

Instructions to Candidates:
1. Read the questions carefully.
2. If required, please make logical assumptions and clearly state these in your
answer word document file.
3. Make sure the assessment questions are a total of 8 pages.
4. Write your answers in a separate word file. Do not include the questions from
this document in your submitted document as it will be detected by plagiarism
software and show a high percentage similarity.
5. Clearly write the question number as per this document in your answer word
document.
6. Mapping of questions onto ULO

MN624 – Digital Forensics – Final Assessment Trimester 2, 2020
Page 3 of 11
QUESTION 1 – Digital Forensics Validation [2 x 5= 10 Marks]
a) Explain the data hiding technique(s), used in Figure 1. [5 Marks]
Figure 1 Data Management
b) Examine and analyse the MD5 results given in Figure 2. [5 Marks]
Figure 2 MD5 results
MN624 – Digital Forensics – Final Assessment Trimester 2, 2020
Page 4 of 11
QUESTION 2 – Cloud Forensics and Social Media Forensics [5 x 5= 25 Marks]
Ryan is a hacker who plans to exploit victims by uploading a malicious webpage in the
cloud. He uses a vulnerability to exploit the cloud presence of XYZ Coffee, a legitimate
company. From there, he installs a malware that inserts a malicious payload into web
pages displayed, social media, and hides his malicious activity from the anti-virus. He
then redirects victims to the website, which infects them with malware. In addition, the
hacker used anti forensics tools. Users complain to the legitimate company that they
are being infected, so the company seeks to fix the problem and investigate the crime.
Answer the following questions based on this scenario.
a) Provide a list of potential digital evidence and media that the investigator is going
to seize for possible forensic examination in this case study. How would you gain
access to this evidence? [2+3= 5 Marks]
b) Explain two acquisition methods that you should use in this situation.
[5 Marks]
c) Describe significant challenges with cloud forensics, including forensic acquisition
and evidence preservation.
[5 Marks]
d) Explain what “anti-forensics” is, and provide detail on some anti-forensics tactics that
could be used in this case study. [2+3=5 marks]
e) How should you proceed if the suspect’s computer is running? [5 marks]
MN624 – Digital Forensics – Final Assessment Trimester 2, 2020
Page 5 of 11
QUESTION 3 – Processing Crime and Incident Scenes [3 x 5= 15 Marks]
A company has hired your firm to investigate employee espionage. The company uses
20 TB servers on a LAN. You are permitted to talk to the network administrator who is
familiar with where the data is stored. Please note that company publish a policy stating
their right to inspect computing assets at will. Answer the following questions based on
this scenario.
a) Explain the considerations you should have when deciding what data-acquisition
method to use for your investigation. [5 Marks]
b) Discuss the acquisition method that can be used in this case study. Be sure to
address any customer privacy issues. [5 Marks]
c) Why should companies publish a policy stating their right to inspect computing assets
at will? [5 Marks]
MN624 – Digital Forensics – Final Assessment Trimester 2, 2020
Page 6 of 11
QUESTION 4 – Computer Forensics [2 x 5= 10 Marks]
You are investigating a crime with the analysis of a computer disk but the disk contains
several password-protected files and other files with headers that don’t match the
extension.
a) Explain how to identify the header of the file and determine how their extensions
are mismatched. [5 Marks]
b) Discuss the techniques and tools that can be used to recover the passwords from
the protected files. [5 Marks]
MN624 – Digital Forensics – Final Assessment Trimester 2, 2020
Page 7 of 11
QUESTION 5 – Network Forensics [5 x 5 = 25 Marks]
A new start-up SME (small-medium enterprise) based in Melbourne with an Egovernment model has recently begun to notice anomalies in its accounting and
product records. It has undertaken an initial check of system log files, and there are
many suspicious entries and IP addresses with a large amount of data being sent outside
the company firewall. They have also recently received a number of customer
complaints saying that there is often a strange message displayed during order
processing, and they are often redirected to a payment page that does not look
legitimate. Address the following questions while preparing your report as a digital
forensics investigator.
a) Discuss a general overview of the methodology that you will use, and provide a
reasoned argument as to why the particular method chosen is relevant.
[5 Marks]
b) How should you proceed if your network forensic investigation involves other
companies?
[5 Marks]
c) Explore the techniques and tools that can be used in this situation.
[5 Marks]
d) Describe significant challenges with network forensics in this network, including
forensic acquisition and evidence preservation.
[5 Marks]
e) Identify and explain three types of log files you should examine after a network
intrusion.
[5 Marks]
MN624 – Digital Forensics – Final Assessment Trimester 2, 2020
Page 8 of 11
QUESTION 6: Mobile Forensics [3 x 5= 25 Marks]
You have been assigned a case that needs mobile forensic analysis. A mobile is found from
the suspect’s office, and it might have critical information related to the case.
a) Discuss the information that can be retrieved from this mobile’s SIM card.
[5 Marks]
b) Illustrate the general procedure to access the content on this mobile phone SIM
card.
[5 Marks]
c) Explain measures to validate data on this mobile. [5 Marks]
MN624 – Digital Forensics – Final Assessment Trimester 2, 2020
Page 9 of 11
Marking criteria:
The following marking criteria will be followed for this assessment

MN624 – Digital Forensics – Final Assessment Trimester 2, 2020
Page 10 of 11

MN624 – Digital Forensics – Final Assessment Trimester 2, 2020
Page 11 of 11
Marking Rubric

END OF MAJOR ASSIGNMENT REPLACING
FINAL EXAMINATION