Assignment: Cybercrime And Digital Investigation
Details
With the identification and preservation of the physical and digital evidence completed the incident response team must now enter the data collection phase. During the data collection phase, the investigative team must collect volatile evidence first, and non-volatile second. Describe the volatile and non-volatile evidence types to be collected and the methods to both collect and analyze the two types of evidence.
• Describe the volatile live acquisition process to collect evidence related to system memory and registry changes and analysis methods conducted over this evidence.
• Describe the non-volatile acquisition process of evidence collection over powered down systems and devices, and the related analysis methods used over non-volatile evidence.
• Describe the exact investigative techniques that you would use to analyze the users' information, habits, and history for each program. Explain the reasons for your selected techniques.
Remember to address forensic evidence you might find relating to the ransomware attack. You should be making references to specific directories, files, file types, registry entries and log files which point to sources of the incident forensic evidence.
The 16-18 slide PowerPoint presentation should include the following:
• Title Slide (1)
• Topics of Discussion Slide (1)
• Windows 10 Operating System (3 slides)
• Registry and Memory (2 slides)
• Internet Explorer (3 slides)
• Outlook e-mail (2 slides)
• Photoshop (2 slides)
• Office (3 slides)
• References Slide (1).
Format your assignment according to the following formatting requirements:
1. The answer should be typed, double spaced, using Times New Roman font (size 12), with one-inch margins on all sides.
2. The response also includes a cover page containing the title of the assignment, the student's name, the course title, and the date. The cover page is not included in the required page length.
3. Also include a reference page. The Citations and references should follow APA format. The reference page is not included in the required page length.