Coursework - Creating a Digital Crime Scene

PLEASE NOTE: This is not the final version, however the content here and the tasks requested of you will not change - therefore you can use this to start planning your coursework.

Abstract
The Red Coursework is an opportunity for you to work as an individual or in a small group (1-3 persons) to create a digital crime scene. You will create an evidence file (.E01) containing artefacts that need to be recovered and artefacts that have been explicitly hidden. You will provide a report detailing the design of your case, the legislation you analysed, and the artefacts that you have put into your case.

This specification should be read along with the lecture material on Data Hiding and Data Recovery. A simple report template is provided on Moodle to assist the completion of this assignment.

The Assignment
For this coursework you will:
• Provide a design, where you provide a narrative of the case and an analysis of relevant legislation to the case.
• You will create a suitable evidence file.
• You will provide a significant number of artefacts in your evidence file that need to be recovered by an analyst looking for evidence using techniques such as search terms, file carving or just looking through the gallery view in a forensic tool.
• You will provide a significant number of artefacts that have been specifically hidden. This could be as simple as flagging a document as ‘hidden' or could involving complex hiding, such as concealing passwords by splicing it into video footage.
• Each member of a group will reflect upon the challenges they had whilst doing this coursework.

Group Selection
The expectation is that this coursework can be completed by an individual. Therefore staff will not allocate you to groups, but you may work in a group of 1-3 people and the volume of work that must be done for a group is proportionally greater. You must not work with members of other groups and the detection of collusion with other groups carries a stringent penalty. We will fail students.
You must select an ‘Operation' from the Moodle page as this gives an initial case idea and highlights as a starter some legislation you may want to consider. You may add further offences to your case if you deem useful. For example, you have selected a hacking case but you may add further offences such as blackmail or indecency.

Case Design Requirements
The requirements of this coursework is that you will provide a detailed narrative of a case along with a critical analysis of the kind of legislation that is involved in such an investigation. You will highlight the points that would need to be proved to prosecute such a crime and detail in your report the artefacts that support, undermine or do not assist the prosecution of the case.
Timeline of the Case
• Narrative of the case
• Showing when key evidence was created in the timeline
• Details of the offenders, victims and witnesses (including equipment/devices)
Legislation (see lecture material for more detail)
• Points to prove
• What the case can prove
• What the case will not prove
• Highlight any artefacts that undermine the prosecution's case.

Evidence Requirements
You will create a suitable evidence file that contains your digital crime scene. This should not just be a folder of artefacts, but rather is must be the image of some suitable file system, be it a memory card, USB stick, mobile phone, virtual disk or actual physical disk.
Create an Image file
• Ensure that there is no extraneous information in the case (e.g. we don't want to see other coursework, or personal pictures in the evidence file).
• In a suitable evidence file format - ideally a compressed E01 file.
• Hash value of the evidence file is included - screenshot from a forensic tool to verify this is correct
• The evidence file(s) uploaded to a suitable location to be downloaded and verified

Artefact Requirements
Previously we have asked students doing this coursework to provide easy, medium and hard artefacts, however this causes problems for both the students and the assessors working out if what they are doing is easy or hard. Therefore we want you to provide Data Recovery (DR) artefacts, and Data Hiding (DH) artefacts. A list of the DR and DH categories are listed below, and see the lecture notes for more detailed examples.
Obviously some of these methods are harder than others, e.g. DR Contents of a file - cat pictures (easy) , versus DR Contents of File System - Deleted cat pictures (medium) or cat pictures in unallocated (hard). Therefore we are requiring you to provide at least one example of every kind of data recovery and data hiding. Yes you can pass without doing all the harder kinds of DR or DH, however the marking scheme reflects the effort required to do these harder artefacts.
Number of artefacts you have to supply: 4 of your choosing + (1 of every type of DR and DH category x every member of the group).
E.g. A group of 2 people will provide 20 artefacts (4 of their choice + 2 x Contents of files, 2 x Contents of applications, 2 x Contents of Operating System Data Structures, 2 x Contents of File System, and Data hiding in 2x User area, 2 x Applications, 2 x Operating System, 2 x File System).

For each artefact you will provide:
• A screenshot of the artefact itself
• A screenshot of the artefact within the evidence file (the meta-data, the data structure it comes from, showing us the data within unallocated clusters etc.)
• A description of the implications of the artefact. Does it support or undermine a prosecution case? Does it prove a point, either by itself or in combination with any other artefacts?
• For the Data Hiding artefacts, a description of how to unhide the artefact
• All passwords used MUST be supplied (for example of a post-it note) or hidden within the evidence somewhere.

Supporting Files/Software Requirement
The software, files or links to online software that are needed to unhide (and have been used to hide) artefacts have to be included within an evidence file. This may be within some kind of software backup folder, or it may be more subtly insinuated into the case. This will be documented by screenshots in the report.
Where there are artefacts that are hints or clues needed to unhide data such as post-it notes or otherwise aide memoire that may have been found at the crime scene, although they might not be evidence or points to prove themselves, these files, pictures or whatever are evidenced with screenshots.
 
Supporting Files:
• Screenshots of the location within your casefile of the software, files or links to supporting material needed to unhide the DH artefacts.
• Hints or clues need to unhide artefacts, even though they may not be evidence themselves, are to be included.

Personal Reflection Requirements
We require each person in the group to provide a personal reflection where you highlight the things you brought to the group work, what was particularly enjoyable, what was particularly challenging and any technical difficulties (if you were able to get around them or if you couldn't during this assignment).
Each person will:
• Highlight their strengths/major contributions to the group
• What they found enjoyable
• What was challenging
• Technical challenges and outcomes

Attachment:- Creating a Digital Crime Scene.rar