Mobile Forensics CT117-3-3

Mobile Forensics CT117-3-3

In-course Assignment Information Sheet

Assignment Overview

This coursework will be worth a total of 50% of the module and it is developed to reflect the following learning outcomes:

Evaluate various methods of data acquisition, data tracing and evidence gathering or advanced data-carving techniques for result validation including the advantages and disadvantages of each procedure.

Perform forensic investigation on the incidents surrounding a crime using extracted information from smartphones, including timeline development and link analysis using various mobile forensic tools and techniques used in mobile investigation.

Section A: Research on Recent Tools/Methods in Mobile Forensics (40%)

Part 1

This section is an Group research on latest tools / techniques in digital forensics. Each group should select a unique title in related domains such as:

Mobile Hard Disks Forensics and File SystemsAnalysis

Anti-Forensics Techniques

Data Acquisition and Duplication (Mobile Acquisition is Preferred)

Data Tracing

Evidence Gathering

Advanced Data Carving

Any other relevant domains related to Mobile Forensics

You are required to conduct a research and provide a report on any recent technique, tool or framework that may use by Forensics Investigators in any of aforementioned domains. You are required to critically discuss the requirements and challenges that an investigator faces when performing analysis during a digital forensic investigation in the those incidents.

Section B: Mobile Forensic Investigation (60%)

You are required to produce an investigation report comprised of the evidence gathered and the analysis considering the scenario for this assignment:

You are a mobile forensic investigator and is part of the major case being investigated. The investigation team has passed you the image of a smartphone device belonging to the victim of the crime scene. The image of a Pixel 3, Android was given to you for investigation purpose. You are require to produce a report of your findings.

You have performed a forensic duplication to preserve the evidence that may contain deleted files. You have begun a chain of custody for all the evidence you have collected in case you decided to hand it over to the authorities. Your task is to analyse and investigate the given image file, and extracted evidence to produce a report at the end of the investigations based on the questions below:

Your report should consist but not limited to the following:

Device Information

Hardware Information

Application overviews (Each student select 1 area of analysis)

Messaging,

Contacts,

Calendar,

Maps, Photos,

Accounts IDs

Third Party Applications

Analysis (Timeline, Functional, Relational) //Each member to select 1 within the group.

Presentation Schedule

Guidelines for the Report:

Document the results of your work in a professional and systematic manner, in the form of a computerized report. Only Softcopy reports are to be submitted through MOODLE.

Your completed documentation should meet the following requirements:

Table of contents for every detailed chapter/section.

Abstract

Introduction (for each section)

Section A

Section B

Team member 1

Team member 2

Conclusion

Appendices

References

Workload matrix (each group members tasks must be clearly written and sign by every one).

Submission requirements

Your report must be typed using Microsoft Word with Times New Roman font. Expected length is 2,000 words. You need use to include a word count at the end of the report (excluding title, source code of program & contents pages) Report should be in 1.5 spaces.

The report has to be well presented and should be typed. Submission of reports that are unprofessional in its outlook (dirty, disorganised, inconsistent look, varying coloured paper and size) will not fair well when marks are allocated.

The report should have a one (1) margin all around the page as illustrated below:

Every report must have a front cover. A transparent plastic sheet can be placed in front of the report to protect the front cover. The front cover should have the following details:-

Name

Intake code.

Subject.

Project Title.

Date Assigned (the date the report was handed out).

Date Completed (the date the report is due to be handed in).

All information, figures and diagrams obtained from external sources must be referenced using the APA referencing system accordingly.