Final Project Notes

Illustration of a report and document on a tablet being examined by a magnifying glassThe final project is assigned during Week $1,$ but it is not due until Week $6.$ The Final Project is a culmination of the work done throughout the class. You are encouraged to review the Final Project requirements early in the semester and to start the examination early. Final Project Notes

Illustration of a report and document on a tablet being examined by a magnifying glassThe final project is assigned during Week $1,$ but it is not due until Week $6.$ The Final Project is a culmination of the work done throughout the class. You are encouraged to review the Final Project requirements early in the semester and to start the examination early.

Examination

Conduct an examination of the evidence and prepare a professional report that documents your work. Use the guidelines provided in the reading assignments throughout the semester to structure your report which should include evidence handling documentation, preservation of evidence, findings about the evidence, hash value of the forensic copy, the file system used, and status of files $($deleted$,$ active, etc.$).$ Explain your examination, and, where appropriate, provide screenshots to illustrate your findings.

The report should include all procedural components of the examination in addition to the findings. The audience for the report is likely to include jurors, the judge, attorneys, and possibly insurance investigators. Your report must be $100\%$ accurate while being simple enough so it does not confuse people who have limited experience with digital evidence or computers.

Analyze the contents of the evidence file thoroughly to gain a comprehensive understanding of the incident.

Carefully review the contents of files and associated metadata.

Utilize specialized forensic tools like TSK $($The Sleuth Kit$)$ to examine the evidence file effectively.

Use Autopsy and X$-$Ways Forensics to export files for additional examination.

Capture screenshots of each item of evidence within the evidence file.

Label each screenshot appropriately to provide a clear and concise representation of the evidence.

Ensure that each scr

Examination

Conduct an examination of the evidence and prepare a professional report that documents your work. Use the guidelines provided in the reading assignments throughout the semester to structure your report which should include evidence handling documentation, preservation of evidence, findings about the evidence, hash value of the forensic copy, the file system used, and status of files $($deleted$,$ active, etc.$).$ Explain your examination, and, where appropriate, provide screenshots to illustrate your findings.

The report should include all procedural components of the examination in addition to the findings. The audience for the report is likely to include jurors, the judge, attorneys, and possibly insurance investigators. Your report must be $100\%$ accurate while being simple enough so it does not confuse people who have limited experience with digital evidence or computers.

Analyze the contents of the evidence file thoroughly to gain a comprehensive understanding of the incident.

Carefully review the contents of files and associated metadata.

Utilize specialized forensic tools like TSK $($The Sleuth Kit$)$ to examine the evidence file effectively.

Use Autopsy and X$-$Ways Forensics to export files for additional examination.

Capture screenshots of each item of evidence within the evidence file.

Label each screenshot appropriately to provide a clear and concise representation of the evidence.

Ensure that each screenshot is clear, readable, and not blurry, maintaining a consistent size with other text.

Report of Forensic Examination

Use the following outline for your report in this order. Use appropriate headings for each section.

Title page

Table of contents with page numbers corresponding to each section of the report

The name and address of the laboratory

Unique identification of the report on each page

The name and address of the official requesting the forensic examination

Explanation of the tools and methods used

A description of the submitted evidence

A description of the requested analysis

The date and time that the evidence was received by the laboratory

The identification of the person preparing the report

The results of the analysis and interpretation

A unique number and name for each item of evidence $($i$.$e$.,$ file$)$

Recommendations and Findings

Appendices

Case File

The following information may be part of the case file referenced as appendices throughout the Report of Examination.

Submission information

Chain of custody information

Any communication relating to the case

Search authorization $($search warrant or consent$)$

Offense reports

Evidence collection records

Examination records $($worksheets$,$ tests, calibrations$)$

These items may be referenced as Appendices in the Report of Forensic Examination.