BIT362-Digital Forensics
Assignment
MP Ltd is a telecommunications company with offices in Melbourne and Muscat. The top management of the company had reason to suspect that one or more employees were looking to commit espionage. A contracted incident response team went to the site and began monitoring the network and emails. They seized attached email files from one of suspected employees
Due to the sensitivity of the data, MP Ltd senior management decided to initiate a team to conduct an internal investigation.
Assignment Tasks
You will be given a copy of a seized forensic image which contained email files. You should conduct a digital forensics investigation to analyse and identify any hidden evidence of unusual activity.
Analyse this file and report your findings using the outline below. (For marking purposes, it is strongly recommended that you follow this outline.)
1. Explain how you downloaded the file, what precautions you took, and how you ensured its integrity?
2. Describe the actual content of the forensics image file. If there are multiple files, list their file names, types and MD5 hash values.
3. Given that "OM3.txt" has a bad signature and the original file header is (25 50 44 46 2d) What tools will you now use to proceed your investigation and why?
4. Discuss Steganography technique and Describe with screenshots how you going to extract any hidden file?
5. Discuss Bit-Shifting technique and Describe with screenshots how you going to fix corrupted file?
