Cyber Forensics Lab Report 1

Data Acquisition
Scenario: You are a computer forensics examiner assigned to a team of examiners responsible for performing a forensic data acquisition of the physical storage device obtained from a computer seized from the residence of the suspect, Clyde Barrow. Mr. Barrow is accused of committing numerous crimes, including, but not limited to: murder, attempted murder, bank robbery, kidnapping, tax evasion, felony evasion and escape, speeding, and numerous counts of traffic offenses.
Part 1 – Assignment Overview
Your assignment is to prepare the evidence contained in a computer system unit for forensic analysis. It is essential that you follow proper methodology, which includes documentation and the verification of the authenticity of the image(s). Lastly, you must ensure that the integrity of the original evidence is maintained.
Part 2 – Suggestions
1. Identify the evidence (photograph, video, and/or document details pertaining to the evidence media). Be sure to document every task you perform throughout the entire process.
2. Ensure that the evidence is not altered (make sure that nothing can be written to the storage media).
3. Obtain an exact forensic image of the physical storage device(s) (perform data acquisition using forensic software tools).
4. Verify that the contents of each forensic image exactly matches the contents of the original evidence (calculate MD5 and SHA1 hash values for each forensic image and compare it to the MD5 and SHA1 hash values of each evidence item).
5. Secure and maintain chain-of-custody for your evidence.
6. Submit a written report (one per team) that documents your work.