A Simple Raw Forensic Image of a Computer Seized from a Person: Principle on Computer Forensic Assignment, RP, Singapore

Investigation and Reporting

You will be provided with a simple raw forensic image of a computer seized from a person suspected of criminal offenses. Your task is to use recommended forensic tools to examine the forensic image, locate and select evidence that you assess to be related to the suspected crime and any other plausible offenses.

You are required to analyze your findings, document the evidence collected, and perform a simple reconstruction of the suspected crime.

You should demonstrate the following in your investigation and report.

• Demonstrate thorough-ness in searching for and locate evidence.
• Identify incriminating evidence and justify its relevance to the investigation.
• Describe the operating system and key characteristics of the forensic image.
• Demonstrate the ability to apply the use of forensic tools to locate and extract evidence.
• Describe in writing the evidence and its relevance without an over-use of screenshots.

The students will need to use the following software:

• VMWARE player
• ProDiscover Basic
• OS forensics

Summary of the Case

Police have arrested Leonard Kim for the suspected murder of Jaclyn Chew. They have also seized Leonard Kim’s computer for investigation. When Leonard was held in custody and questioned, he confessed to the crime and informed the investigating officer that he committed the crime under the direction of a person named Anthony Liew.

As an investigator, examine the computer evidence. Piece together the series of events and reconstruct these events leading to the crime. Examine the operating systems, emails, documents, deleted documents, hidden messages. Document your findings, and write a report to summarise what you have done, leading to your recommendations and plausible reconstruction of the case.

The characters in the case are as follows.

• Leonard Kim (Suspect)
• Anthony Liew (Suspect’s Boss)
• Jaclyn Chew (Victim)

The Scenario of the case is as follows.

Anthony sends email #1 to Leonard with a zipped file with a password containing a text file of instruction, photo, details, Facebook and residential address of victim Jaclyn

instruction.7z (password: blood)

Anthony sends email #2 to Leonard with morse coded name of the place to dispose of the body

PLACE THE BODY AT PUNGGOL PARK–··– 1·-·-·-376304–··– 103·-·-·-897608

Leonard sends email #3 to reply job done; report photograph proof of killing

killed-jc.jpg (in email attachment)

Anthony sends email #4 note to pay via paypal

Paid to Leonard Kim (PayPal).pdf (in email attachment)

The forensic evidence in the form of email trials.

Emails located in Mozilla ThunderBird. (There’s should be total of 6 emails in the conversation out of the other emails.)

Email titles:

Job4You & Instruction (18 Feb)

Please take action on this (28 Feb)

Another note of why this is long (12 Mar)

Killed JC (14 Mar)

Assignment Payment (17 Mar)

Payment Received (18 Mar)

The forensic evidence in the form of documents and deleted documents

Recycle bin containing the deleted image file

killed-jc.jpg (with a hidden message of murder location)

Password cracking of zipfile

instruction.7z (password: blood)

social media facebook account

Decipher morse coded message

Internet browsing history on searches made:

knives,

google map address: 444 hougang avenue 8;

lat-long;

murder weapon; guns; ICA;

search parks: hougang area