PSB318SE: You’re an Analyst at a Singapore Manufacturing Corporation Named WoW Pvt. Ltd: Data Recovery and Advanced Digital Forensic Analysis Assignment, CU, Singapore

Learning Outcomes:

The Scenario-based questions cover the following Learning Outcomes:

2. Apply data recovery techniques to forensic investigation in the network and mobile environments.

4. Apply forensic methodology to digital corporate and crime investigation in an ethical and professional context and employ appropriate technically writing skills in its report presentation.

SCENARIO

You’re an analyst at a Singapore manufacturing corporation named WoW Pvt. Ltd. On Wednesday 2015-08-05, you saw some alerts while working at the corporation’s Security Operations Center Department.

While investigation, your team contacts one of the suspected employee, who is not aware of the suspicious files found on his desktop.

The Network administrator helps to retrieve a pcap of traffic for the timeframe of the alerts and the HTTPS traffic logs for that IP address. Another analyst searches the company’s mail servers and retrieves four malicious emails that might be related.

You now have

1. Network.pcap – a pcap of the traffic,
2. HTTPS traffic logs,
3. a collection of artifacts from that HTTPS traffic, and
4. malicious emails the suspected employee received during that timeframe.

The scope of DF’s investigation covers :

Inclusion:

1. Analyze the Network.pcap (packet capture) files that were captured by the network administrator at WoW Pvt. Ltd.
2. Conduct an interview with the alleged employee and general manager of WoW Pvt. Ltd. Take statements from both parties.
3. Conduct digital investigation into the alleged employee’s mobile device (corporate-issued) and corporate computing device (workstation).
4. Technically evaluate the corporate email server logs in lieu of the footprints of the alleged employee’s computing and mobile devices.
5. Figure out how the computer became infected and document your findings. Your report should include:
   • List down the name of protocols used in the given pcap.
   • List the required protocols to be analyzed for the given case.
   • The IP Address of the computer where you found the alerts??
   • Who used this computer?
   • The infected computer’s hostname.
   • The infected computer’s MAC address.
   • The infected computer’s operating system.
   • The date, time, subject line, and sender of the malicious email that caused the infection.
   • Information on any malware associated with the infection.
   • Domains and IP addresses of any related traffic.
   • A timeline of events leading to the infection.
   • How you did the Malware Analysis

Exclusion:

1. DRADFA Forensics is not investigating any other devices nor interviewing other parties aside from those mentioned.
2. Mr. Lim is the WoW’s general manager (GM). He is the client of DRADFA Forensics with you as the assigned forensic investigator.

Objective:

1. Analyze the digital evidence and recommend if the alleged employee had any role in Malware found on the company’s mail server.
2. Figure out how the computer became infected and document your findings.

Research, critically analyze, and purposely propose the following for your approach to the forensics investigation:

• Planning consideration and procedures to adopt for investigation
• Technical Tools (hardware, software) to use for acquisition and analysis
• Technical recommendations for analysis and considerations
• Procedures & Guidelines for interviews and considerations
• Considerations for documentation (forms, templates) and reporting