Task # 1: Review Packet Capture
Perform the following steps:
Review demo labs and do a web search to find detailed information on NetWitness Investigator.
A free download of the software is available in case you want to experiment with how the program behaves, looks, and feels.
Examine how to access packet trace data using NetWitness Investigator.
Examine how to identify hosts within the Corporation Techs network, conducting FTP file transmissions with the organization’s web server.
Document how to develop a listing of user credentials and transferred files associated with each.
Report how to identify potential hosts and users whose activities warrant further investigation.
Document the process used to identify every indicator that provides cause for further investigation.
Write the preliminary investigation document, detailing the tasks mentioned above. This document should include dates and details of the investigator, to serve as supportive documentation for your investigation later. All documentation should be made using a standard word processor format, compatible with Microsoft Word.
Task # 2: Examine Forensic Image
Now, you must conduct a review of the workstation forensic image(s), identifying communications, applications, and data pertaining to any leak of sensitive information via the website. Due to time constraints, this review should be conducted in the most efficient manner possible, using details from your previous investigation of network traffic, to identify the workstation(s) and user profile(s) of greatest interest for forensic review.
Perform the following steps:
Review demo labs and search the internet to examine how P2 Commander is used to gather forensic data.
Examine files, communications, and applications of interest within the profile(s) identified in your earlier investigation.
Identify items with potential evidentiary value and investigate each.
Report how this software can help you in your proposed research.
Document the process used to identify each item of interest and any details that provide a cause for further action.
Add this documentation detailed in the instructions above to your case file. This document should include dates and details of the investigator. All documentation should be made using a standard word processor format, compatible with Microsoft Word.
Task # 3: Create a Report of Findings
For the final part of this investigation, you must create a report of your investigation and its findings for the owner of Corporation Techs.
Perform the following steps:
Describe the process of acquisition and protection of each item of evidentiary value reviewed (example: workstation host media was forensically captured, and the image used for all subsequent evaluations).
Describe the investigative process, together with indicators for detailed investigative review and assumptions made during the process.
Enlist items of potential evidentiary value and provide a description of each, and its relevance as an item of interest.
Develop a report of your findings, along with a supportable recommendation as to whether there is cause for further action.
Create a professional report detailing the information above, along with evidentiary reporting and supportive documentation, detailing your investigation for the client.
Self-Assessment Checklist
You will know that you have successfully completed this challenge when you can answer the following self-check questions affirmatively:
I have demonstrated an understanding of the competencies covered in this course.
I have documented the process and causes for investigation effectively.
I have successfully identified items of potential evidentiary value.
I have conducted the investigation with minimal exposure and examination of unrelated user’s data.
I have created a professional, well-developed report with proper documentation, grammar, spelling, and punctuation.
Review the rubric to make sure you understand the criteria for earning your grade.
Review the reading assignments as needed to reinforce the knowledge and preparatory understanding you will need to complete this project.
Review the Overall Scenario and each of the individual tasks in the Background Information section above:
Task #1: Review Packet Capture
Task #2: Examine the Forensic Image
Task #3: Create a Report of Findings
Follow the steps outlined in each task to identify what tools you will need and obtain them, then use the tools as outlined in the task’s descriptions.
Using Microsoft Word, prepare the Report of Findings for your manager and the client (following APA style) in which you address each of the specified tasks. To complete this, you will need to:
Review the steps and Self-Assessment Checklist under each task scenario to make sure you have addressed all of the required concerns.
Make it clear in the organizational structure of your report where and how you are addressing each of the tasks and their respective documentation steps. You may want to consult the APA Style website’s information on Section Headings(new tab) for clarity on how to format sections and sub-sections.
Cite any resources utilized in-text and list them in a references page following APA style. For questions on APA style, go to APA Style Guide.(new tab)
Limit your report to a reasonable length of at least five but no more than seven pages, excluding the APA title and reference pages.
