Computer Forensics Investigation – Analysis Of Methamphetamine Drug Activity

Objectives

m57.biz is a patent company newly set up with four main employees; the CEO(Pat McGoo), IT Administrator (Terry), and Jo and Charlie, the two patent researchers. The employees work on site and mainly communicate through e-mail in a windows environment. A workstation used originally at m57.biz is sold to a customer (Greene) in the second hand market; Greene realizes the previous owner did not erase the hard drive and suspicious videos and documents related to metmphetamine drug use; a real problem drug in Singapore and Australia. Greene reports this to the police who start forensics investigations. The provided information include the hard drive sold with the computer and other hard drives as listed below;

The two additional images are provided I different format and while they have no problem with logging, there is suspicion of police negligence and even foul play which is yet to be determined.

The team is given the task of determining and uncovering any evidence either prove or disprove allegations of illegal drug use. The other objective is to determine whether there is evidence of tampering with the provided evidence and possible cover up of the situation. The main objective is to determine whether there was illegal drug use activity involving metamphetamine based on evidence. The evidence is to be presented in a time line format sign posting times when there is belief evidence an offense was committed and comparisons made between evidence found and the dates/ times. Different tools to be used and their relative pros and cons to be discussed. Determine if there are differences between the two provided sets of hard drives because it is purported the two hard drives are from the same computer. The objective is to establish which of the two hard drives is an original. The other objective is to address how to respond to the common defense that the actions were unintentionally committed. To determine, through research, how image files could have been tampered with and ascertain if there are methods that are difficult or even undetectable.

Jo is a patent researcher and is also the main suspect in the case. As a researcher, he is not very well versed with the concept of computer forensics and as such, did not envisage a situation where some information would lead back to him. He therefore did not erase the files and hence the information was uncovered after Greene bought the hard disk in the second hand market. Jo is therefore responsible for the meth videos and literature. To try and cover these actions, m57 finds a way to influence one of the cops to submit a different disk image to save the company reputation.

That the IT administrator (Terry) having access to all these computers, took advantage and downloaded and delved into metamphetamine use and had the information saved on Jo’s office computer. Upon realizing the information has been unearthed, Terry, being proficient in IT, submits a different image to help throw the cops off track during investigations.

Using the Autopsy software, the images were mounted as virtual drives and hash values generated based on the MD5 algorithm. To ensure there was no hash collisions, another set of hashes based on the MD5 were generated.

The OSF was used to obtained from the provided images and to know the owner of the PC alleged to have been Jo’s; the following information was found

Registry File:  C:WindowsSystem32ConfigSYSTEM

Registry Hive:  HKEY_LOCAL_MACHINESYSTEM

Computer Name : Jo-PC

The other information verified to have been from the same PC include the operating system being used and the service pack, as well as the memory information and hard disk size and the file system (which was NTFS). User account information was also obtained using the OSF application as well as the log in details and the list of installed software. Of importance was the VLC media player which was used to play and view the metamphetamine related files found on the PC.  Using OSF, files were searched on the meth and a positive feedback returned using the string search 

References

Camer, D. (2015). Education Exposing tampered recordings using forensic tools. Forensicprotection.com. Retrieved 2 April 2017, from     https://forensicprotection.com/Education_Exposing_tampered_recordings.html

Casey, E. (2011). Digital evidence and computer crime (1st ed.). Waltham: Academic Press.

Goodin, D. (2017). Fatally weak MD5 function torpedoes crypto protections in HTTPS and IPSEC.     Ars Technica. Retrieved 2 April 2017, from https://arstechnica.com/security/2016/01/fatally-weak-md5-function-torpedoes-crypto-protections-in-https-and-ipsec/

Lillard, T. (2010). Digital forensics for network, Internet, and cloud computing (1st ed.).Burlington, MA: Syngress.

Liu, H., Sung, W., & Wenli-Yao.,. (2013). Information technology and computer application  engineering (1st ed.). Hoboken: Wiley.

Weaver, R., Weaver, D., & Farwood, D. (2013). Guide to network defense and countermeasures (3rd ed., p. 166). Boston: Cengage Learning.

Order an Essay Now & Get These Features For Free:

Turnitin Report

Formatting

Title Page

Citation

Outline

Place an Order