Waiting for answer This question has not been answered yet. You can hire a professional tutor to get the answer.


Normal 0 false false false EN-US X-NONE X-NONE /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes;

Normal 0 false false false EN-US X-NONE X-NONE /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin:0in; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:12.0pt; font-family:"Times New Roman",serif;}

Individual Project: Forensic Examination


You are a computer forensic examiner working for the Department of Homeland Security (DHS).  DHS has been investigating the possible threat of an attack within the U.S. by members of the Chechen mujahideen. 

Your team has been conducting surveillance of suspected terrorist Anwar Tsarni, a Chechen native, currently working as a graduate teaching assistant at George Mason University.  Anwar Tsarni is a known associate of accused Boston Marathon bombers Dzhokhar Tsarnaev and Tamerlan Tsarnaev has traveled to a region with a known Chechen terrorist training camp in the past year.

After a six-month investigation including surveillance and wiretaps of the suspect, a search was conducted of an office located at: 10900 University Blvd. Manassas, VA 20110

You will be investigating a forensic image of a flash drive found during this search.  Investigators suspect it may have critical evidence on it that will lead them to break up a terrorist cell and thwart an attempted attack on the U.S. Your job is to conduct a forensic analysis of the disk and write a forensic report of your findings.


●       You may use any FORENSIC tools available to you.

o   At the very least you should use:

         FTK Imager (to verify the image and hash values)

         FTK Toolkit (to conduct the majority of your investigation) or Autopsy (https://www.sleuthkit.org/autopsy/)

         ExifPro (to examine JPEG files)

You must use the template provided and include the information listed.  DO NOT LEAVE PLACEHOLDER TEXT, REPLACE WITH YOUR ACTUAL INFORMATION.

You will include the “best” evidence items and full analysis from the following categories in your report. Only include the number of items listed.  Do not include more.

●       Documents (3 items)

●       PDF (2 items)

●       Graphics (3 items, minimum 1 must be jpg)

●       Deleted Files (3 items that are not discussed in other categories)

●       HTML or Web-based Files (3 items)

●       OLE Subitems (1 item)

●       All other relevant background information, image verification, etc listed in the template

What to Look For:

●       You may want to extract these files to analyze the technical information and metadata closer. 

●       Remember to look for metadata that may provide you with additional information. 

●       Remember, you are looking for evidence to help break up a terrorist cell and prevent an attack. You may want to look for evidence of parties involved, locations, types of attack, etc. You may also want to establish a timeline – this may be crucial if an attack is imminent.

The Report:

●       Your report will be approximately 5-10 pages OF TEXT (not including your screenshots, lists of evidence, content of evidence files, etc.)

●       You should give a detailed (step by step) explanation of what you did, what you found, and how and where you found it.

●       You may use screen shots and file content as an appendix.

o   Do not include screenshots in the body of your report!!

o   Do not include the content of the evidence files in the body of your report!!

o   Crop your screenshots so only relevant information is showing… I shouldn’t be able to see your desktop or other open files.

●       Follow the “Forensic Report Guidelines” you have been given during lecture.

o   Do not try to analyze the content of files.

o   Stick to the FACTS!

o   Your report should explain the technical aspects (e.x. what is a link file, why is this important, explain it so a non-technical person can understand.)

o   Just giving a list of evidence with no explanation of how you found it and what it means (as far as the technical aspect) is insufficient.  Don’t just say you found it using FTK – explain!

o   Analyze the metadata!

o   You have more than enough evidence on the disk to EASILY write this much text.  If you are having a hard time, you probably missed a significant amount of evidence.


●       Use the template provided

●       Include a title page

●       Text should be single spaced, 0 spacing before & after

●       Font should be set to Arial or Calibri

●       Font should be set to 12 point

●       Margins should be set to 1 inch

●       Paragraphs should be set to Justify (not left, right, or center aligned)

●       You should include headings and subheadings

●       Your report should be in complete sentences, free of grammatical/spelling errors, easy to read, and professional.

●       If you use any outside sources, you must cite them using APA citations

●       Your report must have a red watermark on every page stating: “THIS IS AN EDUCATIONAL PROJECT”.  Any project that does not have this will be a zero.

o   Page Layout – Watermark – Custom Watermark – Text Watermark

o   Change the text to “THIS IS AN EDUCATIONAL PROJECT”

o   Change the color to RED, transparency to 75%

●       Your file must be less than 10MB to be submitted to SafeAssign. 

o   Compress your graphics by using the “Compress Pictures” option in Word. 

o   Choose the smallest file size possible.


●       Remember:  your report should read like a story.  A list of evidence is not sufficient for a report… you need to explain how/where you found the evidence. 

●       You are not a terrorism analyst, so do not try to interpret the evidence… present the facts as you find them.  Remember… you can’t say a specific person did something.

●       This is an individual project.  The GMU honor code will be strictly enforced.   You will submit your assignment through SafeAssign on blackboard.  Only work submitted through SafeAssign will be accepted.


***Also review the rubric for the project


−        I included the case background, my name, who I work for, etc.

−        I verified the hash value before anything else.

−        I included the given hashes and calculated hashed.

−        My report only includes FACTS, no opinions or interpretations.

−        I did not analyze the file content.

−        My report includes the file names of evidence items.

−        My report includes the file paths of evidence items.

−        My report includes the MAC dates and times of evidence items.

−        My report explains if the evidence is a file, deleted file, etc. and explains what this means.

−        Someone could read my report and follow my steps exactly step by step.  (I explain what I did.)

−        Any technical term includes an explanation of what it is, in layman’s terms. (I explain what everything means.)

−        All evidence mentioned in the report is in the appendix.

−        I don’t say a specific person did something. (Usernames are differentiated from a person’s name.)

−        All evidence is documented in the report.

−        I do not have any inaccurate information in my report.


−        I included my watermark.

−        I compressed my graphics and my project is less than 10MB.

−        I followed formatting guidelines for font, line spacing, etc.

−        I do not have screenshots in the body of my report.

−        I do not have file content in the body of my report.

−        My appendix has labels for each evidence item.

−        I spell checked and proofread my report.

−        My report is well formatted and easy to read.

−        I use headings and subheadings.

−        I do not have long paragraphs.

−        Only one evidence item is discussed per paragraph.






Case Background

Case background addressed including:

·        Investigator information including:

o   name

o   who the investigator works for

●       Case information

●       Authority to investigate based on search warrant’s authorization

●       How, when, and where the evidence was obtained

●       What type of evidence is being analyzed

●        How did you process the evidence or get the image file

●       Missing 1-2 items

●       Not addressed or

●       Missing 2 or more items




Hash Value

●       Hash value properly calculated, and

●       Proper steps to calculate the hash value are explained, and

●       Both the hash calculated by the student and the hash value given with the evidence are shown in the report, and

●       Explains the importance of calculating this and what it shows

●       Hash value properly calculated, and

●       Student explains proper steps to calculate, and

●       Shows both the hash calculated by the student and the given hash value, and

●       Does not explain the importance

●       Hash not properly calculated, or

●       Does not show both calculated and given hash values, or

●       Does not explain steps, or

●       Does not explain the importance, or

●       Not addressed




Required Evidence Included

Includes the proper number of relevant examples for all categories:

●       Documents (3 items)

●       PDF (2 items)

●       Graphics (3 items, minimum 1 must be jpg)

●       Deleted Files (3 items that are not discussed in other categories)

●       HTML or Web-based Files (3 items)

●       OLE Subitems (1 item)

●        Some examples included are not relevant, or

●       Missing 1-3 items

●       Majority of examples are not relevant, or

●       Missing more than 3 examples





Report explains:

●       Step by step what was done, includes software and versions, and

●       What was found, and

●       How it was found (more than saying “I found this using FTK” – must explain in detail), and

●       All technical details are explained in terms a jury/non-technical person would understand, and

●       Why the technical information is important or why it is relevant to the case, and

●       Information is accurate and only includes facts

●       Explains what was done, what was found, and how it was found, and

●       Does not explain technical information, or

●       Includes lists of data that is not explained, or

●       Includes all elements but it is not written so a non-technical person would understand

●       Does not explain the technical details in terms a jury would understand, or

●       Does not explain step by step what was done, or

●       Gives a general explanation but is not specific for each evidence item

Show more
Ask a Question