Question

As part of the duties of a digital forensics examiner, creating an investigation plan is a standard practice. Write a paper that describes how you would organise an investigation for a potential fraud case. Also, list the methods that you plan to use to validate collected data from storage devices such as MS Word, MS Excel and emails, with hashes. Specify the hash algorithm you plan to use, such as MD5 or any variant of SHA algorithms.

Answer 1

Answer:

${\bold{\red{\huge{Your\:Answer}}}}$

Explanation:

 In general an investigation is planned by defining the goals, scope, materials required and tasks to perform.

you would organize an investigation for a potential fraud case. in addition, list methods you plan to use to validate the data collected

Specify the hash algorithm you plan to use, such as MD5 or SHA1.

Some precautions to be taken while taking Logical Backup:

During backups, the integrity of the original media should be maintained. Investigator should use a write blocker while backing up. This is also applicable for Forensic Imaging/Cloning. A write blocker is a hardware or a software-based tool that prevents a computer from writing to computer storage media connected to it. Hardware write blockers are physically connected to the computer and the storage media being processed to prevent any writes to that media.

• You can also compute hash value for this copied data to maintain the data integrity. Notice a change in one bit also will change the hash value.

• After Backup or imaging is performed, it is advisable to verify whether copied data is exact duplicate of the original data

Answer 2

Answer

Investigation is generally done cllecting the information about goals , scope , strategy and tasks to perform .

For a potential fraud case we have to collect the following information :-

• Aim
• goal
• proper identity of the person involved
• tasks to perform