Excelsior IT 406 – Term Project Milestone
Subject: General Questions / General General Questions
Question
M2A2: Term Project Milestone
IT406: Computer Forensics The term project is a course-long project that involves working with forensic software to analyze
a disk image for electronic evidence in order to make a hiring decision about an individual. You
will perform a detailed analysis of the forensic data and write a report describing your work.
Preparation for Term Project
o Download and install FTK Forensic Toolkit version 1.81 [EXE File Size 60.3 Mb] o Download and unzip the precious disk image [ZIP File Size 38.4 Mb]. If you need
to use a password to unzip the file, use the following. Note that the password is
case sensitive so use the password as it is: On3 1mag3 t0 rul3 th3m a11 o https://mycourses.excelsior.edu/webapps/blackboard/execute/displayLearningUnit
?course_id=_61168_1&content_id=_3319904_1&framesetWrapped=true
The password for the file is there as well. o Start FTK and create a new case. Add the Precious.E01 evidence file. Explore the evidence in the Precious evidence file. Look at images, email messages,
deleted files, and word documents, among other items. Term Project
Assume that you have been hired by company STAY-SAFE to make a recommendation
regarding hiring a person ("Job Candidate") for a high-security job.
Precious.E01 is an image of the files from Job Candidate's computer (acquired with his signed
permission).
Review Precious.E01 and explain some of your investigative findings to STAY-SAFE's managers.
In your opinion, should Job Candidate (use his name when you discover it) be considered for a
job that involves handling confidential information?
Your overall objective, after examining all the evidence in the Precious.E01 image, is to make a
recommendation to STAY-SAFE on whether or not to hire Job Candidate. Your recommendation
must be contained in the forensic report you write that describes all aspects of your investigation.
Include screen shots in your report to support your claims.
Project Milestones
There are several milestones for this project spread across this course.
o Module 2: You must show that you have started the project by completing the
following: downloading and installing FTK downloading and unzipping the evidence file creating a new case in FTK and adding the evidence file to it In each of the three cases, you must provide proof of your work in the form of
screen shots and detailed descriptions of the work performed so far. In addition,
provide comments on everything associated with the term project, including
problems you may have encountered, their solutions, and the way your expertise as
a forensic examiner is growing as you use the FTK software.
Submit your work for each case in a Word document, 1–2 pages in length, double
spaced, and in 12-point font.
