Use of Access Data Tools (Forensic toolkit Investigations) Research

I enjoyed and appreciate your last paper. Please I would like you to work on this paper for me. The number of pages and time might be a constraint . I needed more than 6 pages. Thank you.
“Would you be interested in how we “work our magic” in here? If you’ve got a few minutes, I
can demonstrate.”
“I’ll show you how we use a program called FTK Imager to create a forensic image of a
computer. FTK provides one way of gathering information for our reports.”
“In cases like this, there are always so many questions that I usually need to use several
different programs to process the images. I’ll try something called Registry Viewer next, and
then maybe PRTK after that... I’m sure one of 'em will give you the answers you need!”
One of the most commonly used commercial digital forensic tools is Forensic Toolkit from Access Data, more commonly known as FTK. FTK is an integrated tool used in many types of digital forensic investigations, with a particular focus on computers and servers. Additional Access Data tools that are commonly used with FTK include Password Recovery Toolkit (PRTK) and Registry Viewer. FTK Imager, which is license-free, is used to create forensic images of various types of media in a variety of formats. that can be utilized by a wide variety of digital forensic tools. In this project, you will use all four of these Access Data tools in a typical law enforcement scenario.
There are three steps to this project. In those steps, you use FTK and other Access Data tools to image two computers and a thumb drive or USB stick. Each step in the project requires you to respond to detectives' questions based on computer images.
The final assignment is a paper that helps detectives better understand the use of FTK Imager and other Access Data tools to access and image computers and thumb drives. In Step 1, you introduce detectives to the basics of a forensic digital investigation by creating an image using FTK Imager. Let’s begin!
When you submit your project, your work will be evaluated using the competencies listed below. You can use the list below to self-check your work before submission.
1.1 Organize document or presentation clearly in a manner that promotes understanding and meets the requirements of the assignment.
1.4: Tailor communications to the audience.
1.6: Follow conventions of Standard Written English.
1.7: Create neat and professional-looking documents appropriate for the project or presentation.
2.2: Locate and access sufficient information to investigate the issue or problem.
10.3: Demonstrate the appropriate use of multiple digital forensic tools and techniques for imaging and verification.
11.1: Perform report creation, affidavit creation, and preparation to testify.
11.3: Use forensic tools for the investigation of multimedia technologies.
11.4: Demonstrate the ability to gather file system evidence.
Step 1: FTK Imaging Lab Report
One of the first steps in conducting forensic investigations often involves creating an image of forensic evidence. Forensic evidence can be found in operating systems, network traffic (including e-mails), and software applications. To help the detectives in your department understand the digital forensics investigation process better, you have offered to show them how you create an image using FTK Imager. FTK Imager can be used to analyze many types of media including audio, pictures, and videos. Graphics files can be a rich source of forensic evidence.
Because you are pressed for time, you go to the virtual lab and decide to create an image of the “My Pictures” directory on your computer. This process is very similar to making a full computer image, but it takes only a few minutes rather than several hours. You are preparing a report describing the steps that you follow so the detectives can refer to it later. You will include a screenshot and text file (CSEC662_Lab1_Name.ad1) that document your imaging process with information such as hash values.
Step 2: Process an Image from the suspect Mantooth’s computer
Keywords: Examining metadata, File systems, Hexadecimal and ASCII, Operating Systems, Report writing, File system information gathering
In the previous step, you imaged a directory for a forensic report using FTK Imager. Now the detectives have requested additional analysis so you decide to go to the virtual lab and use Registry Viewer to access user account information for the image from the Mantooth computer.
The Mantooth image is a subset of a full computer image. While it is rich in artifacts, it is small enough to process in minutes rather than hours. Registry Viewer provides the ability to view the contents of various types of registry files so it will help to answer some of the questions posed by detectives. You can also investigate the suspect Mantooth's e-mail activity and picture files.
The detectives have requested the following information:
1. Mantooth's first name and a screenshot of a picture.
2. The number of jpg files in the Mantooth evidence file.
3. Names of the e-mail domains from the e-mail in this image, plus the number of sent and received messages and the dates of the oldest and newest sent and received e-mail message for each domain
4. Names of people who have sent an e-mail to or received an e-mail from Mantooth, and the number of e-mails sent or received to and from each person.
5. Information on encryption—whether it was used for any of the e-mail, and if so, what type
6. Evidence of potential criminal activity within this image
7 Information on how PINs were captured.
8. Vehicle Identification Number of the '92 Dodge
9. Identity of Sean and his role in this case
10. Malware that initiates on startup
11. Information on the password(s)—where you found it/them, whether it/they are usable, what it/they are used for
The detectives are also asking for:
1. Summary of findings
2. Case documentation, such as tools used, version, and image hashes
3. Screenshots or other forensic artifacts supporting your responses to the questions
You review your responses and summary information carefully for accuracy and completeness and save them in a single file to be included in your final paper on Using Access Data tools (Step 4).
Just when you think that the detectives are satisfied with the information that you’ve provided, they request even more information on the suspects and the crime. You can’t say no, so you turn to PRTK to help you access that data...
Step 3: Process an Image from the suspect Washer’s computer
Keywords: Examining metadata, File systems, Hexadecimal and ASCII, Operating Systems, File system information gathering
The Mantooth image has provided a lot of new information, but the detectives want more. PRTK is a tool that can uncover it. An image has been taken off the hard drive in a computer belonging to a suspect named Washer.
The Washer image is a subset of a full computer image (similar to the Mantooth image) so processing time is reduced. While it is rich in artifacts, it is small enough to process in minutes rather than hours. You have full confidence that an investigation of the Washer image will approximate the investigation of a full computer image. Registry Viewer allows you to view the contents of various types of registry files, but PRTK can decrypt files as well. Passwords for certain files may be recoverable from other artifacts on the image as well.
The detectives have asked you to analyze the Washer and thumb drive processed images within FTK to ferret out the following facts. You will include your answers to these questions in your final paper on the Use of Access Data tools.
1. What are the AIM usernames for Rasco Badguy and John Washer?
2. What is the current zip code for the AOL IM account registered to Washer?
3. When was AOL IM installed?
Rasco Badguy and John Washer plan to camp.
1. What does Rasco's vehicle look like? Please provide a description. Who might Rasco bring with him?
2. Provide the starting and ending points for their camping trip, as well as the name of the body of water nearby (same as road running along the shore). Find a map and directions to the spot where they will camp.
Please provide this additional information:
1. Document three distinct types of criminal activity that are under consideration and discussion by these individuals.
2. There is a particular piece of software that will support one of the types of criminal activity under consideration. It is being obscured by file manipulation or encryption. Document the name of the file, its function, and what needs to be installed for it to operate properly.
3. Document two names, addresses, and a credit card or account numbers of potential victims.
4. Prove that the file “How To Steal Credit Card Numbers.doc” was opened on the computer.
5. The word “oops” has come up in intercepted traffic. Document what it refers to.
Document three ways this case has familiarity or linkages to any other case you are familiar with.
Several people, in this case, owe money. Document who they are and how much they owe.
Is there anything that links the thumb drive to the Washer image?
Document how many times the administrator account was used and the date of the last login (hint: during 2008).
Once again the detectives are asking for a summary of your investigative procedures and findings so you document the following:
Summary of findings
Case documentation such as tools used, version, and image hashes
Screenshots or other forensic artifacts that support your responses to all questions
You review your responses and summary documentation carefully for accuracy and completeness for you will be including them in your final paper.
Step 4: Submit Final Paper: Use of Access Data Tools
The time has come to combine work products from Steps 1, 2, and 3 into a final paper summarizing the Use of Access Data Tools. You submit it to the detectives (your instructor) and cross your fingers that it contains everything they need to know about the most widely-used tools available for accessing and imaging forensic data.
Before you submit your assignment, review the competencies below, which your instructor will use to evaluate your work. A good practice would be to use each competency as a self-check to confirm you have incorporated all of them into your work.
1.1 Organize document or presentation clearly in a manner that promotes understanding and meets the requirements of the assignment.
1.4: Tailor communications to the audience.
1.6: Follow conventions of Standard Written English.
1.7: Create neat and professional-looking documents appropriate for the project or presentation.
2.2: Locate and access sufficient information to investigate the issue or problem.
10.3: Demonstrate the appropriate use of multiple digital forensic tools and techniques for imaging and verification.
11.1: Perform report creation, affidavit creation, and preparation to testify.
11.3: Use forensic tools for the investigation of multimedia technologies.
11.4: Demonstrate the ability to gather file system evidence.
Note:
- Clearly stating your paper’s direction is critical. Make sure you have a thesis for your papers. Every paper must have a clear thesis statement in the introductory paragraph. Your thesis statement should alert the reader of what you plan to write or argue for. You are welcome to run thesis statements by your professor before ensure you are on the right track.
- Just as the thesis is important, you want to make sure that each body paragraph in a paper relates to that thesis so that the paragraphs have focus. Thus, every paragraph must start with a topic sentence in your own words. The topic sentence is like a mini-thesis, relating to the main thesis, and will be the focus of that paragraph. You will not want your paragraphs, for instance, to start with author information.
- Every paragraph in a paper will be a minimum of three sentences and will have an analysis of each idea. The analysis is critical for showing that you both understand and can apply the concepts, concurrently with your ideas. You want your ideas to be foremost in each paragraph.
- Void first/second person is your writing. Please use the third person.
- Avoid contractions such as "don't" or "isn't". Avoid unfocused words like “it” and “they”, spelling errors, grammatical errors, and punctuation errors. All papers are expected to be spell-checked and are expected to use appropriate English writing techniques.
- Time of deliverable is very important and intext-citation must match reference in APA format.