Case study: Practical forensics investigation of Chester Finance Solutions $($CFS$)$

As part of the Cybercrime division sector of North West England Police, you are required to undertake a

forensics examination of the equipment seized during a raid of a suspect$$s computer $-$ Mr Myles Davison.

Davison has been arrested on suspicion of hacking into the computers of local accounting company called

$$Chester Finance Solutions $($CFS$).$ Your job is to build upon the initial evidence that the team has gathered

by examining the images of the suspects computer and mobile phone device. You are to download the

captured storage images, and memory dumps from the links on the CO$5606$ Moodle Page.

The following tasks are to be completed. The weighting for each task is given:

Search for evidence that steganography has been used in the attack. Identify the tool$($s$)$ used and where

applicable, the files or locations that hold the hidden data. Where possible, extract the data and show how

you accomplished this via screenshots and other relevant explanation where appropriate.