INTRODUCTION
In today’s digital world, most fraud can be tracked electronically. In this task, you will use Basis Technology’s Autopsy application to analyze a storage device for evidence related to a possible violation of company policy. You will analyze the storage device for data files, deleted data files, directories, or drive partitions. You will provide screenshots of your evidence, and then write a final report.
To access the Autopsy application and the files you need to recover, you will use the “Performance Assessment Lab Area” web link. Instructions for how to access the tools are included in the lab area.
SCENARIO
An oil company’s senior management has reason to suspect that John Smith, one of the company’s mechanical engineers, allegedly took information that was clearly identified as proprietary. The company’s legal office has requested digital evidence regarding the potential violation of company policy, which prohibits the sharing of proprietary information without prior approval. The employee was not authorized to access proprietary information. All employees sign nondisclosure agreements (NDAs) and acceptable use policies (AUPs). Senior management and the legal office have approved the request for digital evidence.
You are a member of the investigative team that has been assigned to examine the digital evidence captured from the suspect’s office laptop computer. You will create an incident report to present the findings to senior management.
REQUIREMENTS
Your submission must be your original work. No more than a combined total of 30% of the submission and no more than a 10% match to any one individual source can be directly quoted or closely paraphrased from sources, even if cited correctly. The similarity report that is provided when you submit your task can be used as a guide.
You must use the rubric to direct the creation of your submission because it provides detailed criteria that will be used to evaluate your work. Each requirement below may be evaluated by more than one rubric aspect. The rubric aspect titles may contain hyperlinks to relevant portions of the course.
Tasks may not be submitted as cloud links, such as links to Google Docs, Google Slides, OneDrive, etc., unless specified in the task requirements. All other submissions must be file types that are uploaded and submitted as attachments (e.g., .docx, .pdf, .ppt).
A. Write a report for the team of investigators by doing the following:
1. Describe all steps taken in Autopsy to create the forensic system case file. Provide screenshots of these steps.
2. Describe all steps taken in Autopsy to identify potential evidence including data files, deleted data files, directories, or drive partitions. Provide screenshots of these steps.
3. Summarize the findings you identified during your investigation and the conclusions you made regarding the suspect and the collected evidence. Provide screenshots from Autopsy or reports to support your findings and conclusions.
B. Acknowledge sources, using in-text citations and references, for content that is quoted, paraphrased, or summarized.
C. Demonstrate professional communication in the content and presentation of your submission.
File Restrictions
File name may contain only letters, numbers, spaces, and these symbols: ! – _ . * ‘ ( )
File size limit: 200 MB
File types allowed: doc, docx, rtf, xls, xlsx, ppt, pptx, odt, pdf, csv, txt, qt, mov, mpg, avi, mp3, wav, mp4, wma, flv, asf, mpeg, wmv, m4v, svg, tif, tiff, jpeg, jpg, gif, png, zip, rar, tar, 7z
RUBRIC
A1:STEPS USED TO CREATE FORENSIC CASE FILE
NOT EVIDENT
The submission does not describe the steps taken in Autopsy to create the forensic system case file or does not provide screenshots of these steps.
APPROACHING COMPETENCE
The submission describes the steps taken in Autopsy to create the forensic system case file, but the description contains inaccuracies, or 1 or more steps are missing or not described. Or the provided screenshots do not reflect each step.
COMPETENT
The submission accurately describes all steps taken in Autopsy to create the forensic system case file. The provided screenshots reflect each step.
A2:STEPS USED TO IDENTIFY POTENTIAL EVIDENCE
NOT EVIDENT
The submission does not describe the steps taken in Autopsy to identify potential evidence or does not provide screenshots of these steps.
APPROACHING COMPETENCE
The submission describes the steps taken in Autopsy to identify potential evidence, but the description contains inaccuracies, or 1 or more steps are missing or not described. Or the description is missing either data files, deleted data files, directories, or drive partitions. Or the provided screenshots do not reflect each step.
COMPETENT
The submission accurately describes all steps taken in Autopsy to identify potential evidence, including data files, deleted data files, directories, and drive partitions. The provided screenshots reflect each step.
A3:SUMMARY OF FINDINGS AND CONCLUSIONS
NOT EVIDENT
The submission summarizes neither the findings identified during the investigation, nor the conclusions made regarding the suspect or the collected evidence. Or Autopsy screenshots or reports are not provided.
APPROACHING COMPETENCE
The submission summarizes either the findings identified during the investigation, or the conclusions made regarding the suspect and the collected evidence, but it does not summarize both. Or the summary contains inaccuracies. Autopsy screenshots or reports are provided, but they do not support the summarized findings or conclusions.
COMPETENT
The submission accurately summarizes both the findings identified during the investigation and the conclusions made regarding the suspect and the collected evidence. The provided Autopsy screenshots or reports support the summarized findings and conclusions.
B:SOURCES
NOT EVIDENT
The submission does not include both in-text citations and a reference list for sources that are quoted, paraphrased, or summarized.
APPROACHING COMPETENCE
The submission includes in-text citations for sources that are quoted, paraphrased, or summarized and a reference list; however, the citations or reference list is incomplete or inaccurate.
COMPETENT
The submission includes in-text citations for sources that are properly quoted, paraphrased, or summarized and a reference list that accurately identifies the author, date, title, and source location as available or the candidate does not use sources.
C:PROFESSIONAL COMMUNICATION
NOT EVIDENT
Content is unstructured, is disjointed, or contains pervasive errors in mechanics, usage, or grammar. Vocabulary or tone is unprofessional or distracts from the topic.
APPROACHING COMPETENCE
Content is poorly organized, is difficult to follow, or contains errors in mechanics, usage, or grammar that cause confusion. Terminology is misused or ineffective.
COMPETENT
Content reflects attention to detail, is organized, and focuses on the main ideas as prescribed in the task or chosen by the candidate. Terminology is pertinent, is used correctly, and effectively conveys the intended meaning. Mechanics, usage, and grammar promote accurate interpretation and understanding.
WEB LINKS
https://lrps.wgu.edu/provision/272148024
