Another digital forensic framework, the Abstract Digital Forensics Process Model (ADFPM) proposed by Reith, Carr, and Gunsch (2002), significantly expanded on Politt’s model (among others) to produce a much more detailed approach to the digital forensic process:
Identification – recognizing an incident from indicators and determining its type.
Preparation – preparing tools, techniques, search warrants (if law enforcement), and monitoring authorizations and management support.
Approach strategy – dynamically formulating an approach based on potential impact on bystanders and the specific technology in question. The goal of the strategy should be to maximize the collection of untainted evidence while minimizing impact to the victim.
Preservation – isolate, secure and preserve the state of physical and digital evidence. This includes preventing people from using the digital device or allowing other electromagnetic devices to be used within an affected radius.
Collection – record the physical scene and duplicate digital evidence using standardized and accepted procedures.
Examination – in-depth systematic search of evidence relating to the suspected crime. This focuses on identifying and locating potential evidence, possibly within unconventional locations. Construct detailed documentation for analysis.
Analysis – determine significance, reconstruct fragments of data and draw conclusions based on evidence found. It may take several iterations of examination and analysis to support a crime theory. The distinction of analysis is that it may not require high technical skills to perform and thus more people can work on this case.
Presentation – summarize and provide explanation of conclusions. This should be written in a layperson’s terms using abstracted terminology. All abstracted terminology should reference the specific details.
Returning evidence – ensuring physical and digital property is returned to the proper owner as well as determining how and what criminal evidence must be removed.
For this assignement, review the phases of the ADFPM above and consider them in relationship to the scenario below and provide answer to the deliverable. Below is the scenario
Mr. Iaman Informant was working as a manager of the Technology Development Division for famous international company OOO, which develops state-of-the-art technologies and gadgets.
One day, at a place that Mr. Informant visited on business, he received an offer from ‘Spy Conspirator,’ an employee of a rival company, to leak sensitive information related to OOO’s newest technology. Mr. Informant decided to accept the offer in exchange for large amounts of money, and he began working on a detailed plan to leak the desired data.
Mr. Informant made a deliberate effort to hide his actions and prevent his plan from being uncovered. He discussed it with Mr. Conspirator via e-mail, pretending like they had a legitimate business relationship. He also sent samples of confidential information through his personal cloud storage service. After receiving the samples, Mr. Conspirator asked for direct delivery of storage devices containing the remaining (large volume of) data.
OOO’s information security policies include the following:
Confidential electronic files should only be stored on authorized external storage devices and secured network drives.
Confidential paper documents and electronic files may only be accessed within an allowed time range (from 10:00 AM to 4:00 PM) and with the appropriate permissions.
Unauthorized electronic devices (such as laptops, portable storage, and smart devices) may not be carried onto the company.
All employees are required to pass through the ‘Security Checkpoint’ system upon entering or exiting the building.
Possession of any storage devices (such as HDDs, SSDs, USB memory sticks, and CD/DVDs) is forbidden under the ‘Security Checkpoint’ rules.
In addition, although the company managed separate internal and external networks, and used DRM (Digital Rights Management) / DLP (Data Loss Prevention) solutions in their information security infrastructure, Mr. Informant had sufficient privileges to bypass them. He was also very interested in IT (Information Technology), generally, and had some knowledge of digital forensics.
Despite the risk, Mr. Informant attempted to leave the building with storage devices in his possession, but he and his devices were detected at the security checkpoint, leading to suspicion that he may have been trying to steal OOO data.
The devices in Mr. Informant’s possession (a USB thumb drive and a CD-R) were briefly reviewed at the security checkpoint (protected with portable write blockers), but there was no obvious evidence of any leakage. As such, the devices were subsequently transferred to the digital forensics laboratory for further analysis.
After reviewing the scenario above, please provide the deliverable below. Thanks
Deliverable
Prepare for a meeting with the OOO Chief Security Officer (aka, your instructor) by creating a detailed outline using each of the ADFPM’s phases as a major heading. Discuss how each phase relates to the suspected incident described in this scenario, why each phase is important in this case, what types of potential evidence might be dealt with in each phase, provide multiple examples of specific tasks you plan to accomplish at each step (and their potential or expected outcome), and how each phase transitions into the next. Make sure the outline contains enough detail to leave the CSO with no doubt about the systematic approach you will take to this digital forensic investigation. (*NOTE: If you need to assume additional facts that aren’t provided in the scenario or make up some of the finer details of this incident – such as exactly what systems Mr. Informant has access to at OOO – please feel free to do so for the purposes of this assignment. But, keep it reasonable and applicable to this data leakage scenario.)
There is no need to follow formal APA writing and formatting style for this assignment, as the deliverable may be submitted in an outline format (provided the required content is present). However, it is expected that you will write in complete sentences, when possible, and submit an assignment free of spelling and grammar errors. Also, please include 1-3 references (e.g., a journal article or webpage) to support your work, and please document your sources on a “References” page at the end of the assignment and format each citation in appropriate
Last Completed Projects
| topic title | academic level | Writer | delivered |
|---|