Digital forensics investigation report -- 2
Budget: $10 – $400 USD
Nitroba University case study—— given the solution and steps taken
The investigation report must be at least 4 single spaced pages long. Tables showing evidence can be used if desired. The report consist of 3 sections. It must begin with an introductory paragraph describing the scenario and the goals of the investigation: to identify the culprit in the Nitroba harrassment case. The next section should describe the investigation process, with the final section providing your conclusion, identifying the harrasser and showing the evidence proving your identity.
The conclusion must provide multiple sources of evidence identifying the harrasser. It is not sufficient to just identify the harrasser with a single TCP flow. The conclusion must also contain a table of students from the CHEM 109 class whose first or last names are found in at least one network packet. The table should provide the student name and a description of network activities associated with that student.
Your conclusion should provide answers the following questions:
1. Who: who are the person sending the harrassing e-mails. Identify the person by first and last name, e-mail address, IP address, and web browser.
2. When: when did the harrassing communication occur. Wireshark provides times as seconds from the start of the capture by default. You want to report times as 24-hour timestamps in Coordinated Universal Time (UTC).
3. What: what happened on the network during this capture. How did the harrasser send the e-mail and attempt to obfuscate his or her identity.
https://www.youtube.com/watch?v=EioOaAkZ__U
The investigation report must be at least 4 single spaced pages long. Tables showing evidence can be used if desired. The report consist of 3 sections. It must begin with an introductory paragraph describing the scenario and the goals of the investigation: to identify the culprit in the Nitroba harrassment case. The next section should describe the investigation process, with the final section providing your conclusion, identifying the harrasser and showing the evidence proving your identity.
The conclusion must provide multiple sources of evidence identifying the harrasser. It is not sufficient to just identify the harrasser with a single TCP flow. The conclusion must also contain a table of students from the CHEM 109 class whose first or last names are found in at least one network packet. The table should provide the student name and a description of network activities associated with that student.
Your conclusion should provide answers the following questions:
1. Who: who are the person sending the harrassing e-mails. Identify the person by first and last name, e-mail address, IP address, and web browser.
2. When: when did the harrassing communication occur. Wireshark provides times as seconds from the start of the capture by default. You want to report times as 24-hour timestamps in Coordinated Universal Time (UTC).
3. What: what happened on the network during this capture. How did the harrasser send the e-mail and attempt to obfuscate his or her identity.
https://www.youtube.com/watch?v=EioOaAkZ__U