Site icon Eminence Papers

Investigation Project Plan

Beth

Investigation Project Plan

Disclaimer

The circumstances used in this investigation project plan are for academic purposes. Should there be any similarities in the case scenario used with real litigation cases, they should be considered highly coincidental with no relation to actual court cases. All product information in the cases described below does not serve advertisement purposes. Information used in this document should, therefore, strictly be considered for learning purposes only.

Do you need an authentic “Investigation Project Plan research paper” copy? Reach out to us.

Table of Contents

Abstract 2

Abbreviations. 3

Principles and Procedures followed. 5

General Principles. 5

Guidelines as per NIJ recommendation. 5

Procedure and Policy Development 5

Assessment 6

Acquisition. 6

Examination. 6

Reporting. 6

Storage. 7

Meetings and Agendas. 7

List of Contact People. 10

Required forms. 11

Checklist of Forensic Equipment and Software. 12

Recovery of deleted partitions. 12

Password recovery and data decryption. 12

RAM analysis. 12

Storage Unit 12

Personal equipment 12

Investigative process. 12

Evidence Inventory. 13

Analysis. 16

Data encryption. 16

Interview forms with questions. 18

Questions for the Prosecution and lead detectives. 18

Questions for the lead Detectives and associated law enforcement colleagues. 19

Questions for Information Technology Administrators. 19

Questions for the suspect and victim’s company security personnel / Witnesses. 19

Questions for coworkers. 20

Questions for the Prosecution. 20

Questions for the digital forensic investigation team.. 21

Investigation Timeline. 22

Week 1. 23

Week 1- 4. 23

Week 2-3. 23

Week 3. 23

Week 4. 24

Investigative Budget 24

Equipment and software cost 24

Labour and Other miscellaneous expenses. 25

Conclusions. 26

References. 27

Appendices. 29

Appendix A – Application for a Search Warrant 29

Appendix C- Search and Seizure form. 30

Appendix D – Chain of Custody. 32

Appendix E– Sample Removable Media Worksheet 33

Appendix F – Hard drive Evidence Worksheet Sample. 34

Abstract

The purpose of the investigation project plan described below is due to an official request granting the authority to offer assistance in conducting a digital forensics investigation of two computers and a thumb drive. Producing a thorough investigation project plan will be challenging before meeting lead detectives and the prosecutor. Therefore, this investigation project plan is designed to identify key people and activities, possible criminal activity to be evaluated, investigation timeline, and people of interest. All human, time, and equipment resources are required to complete the investigation. The digital forensic process will primarily entail collecting information, examining, analyzing, and documenting findings in a report. In this case, the investigation project plan will detail the forms and documents required to obtain legal, criminal, and technical data while preserving the integrity of the information. The examination will comprise the forensic processing of information manually or with the help of digital software and evaluating information of interest without tampering with data integrity. Legal analysis methods proposed will be used to inspect collected data to facilitate the extraction of significant information concerning the suspected criminal activities and the parties involved. A conclusion of the proposed actions, selected procedures and tools, and recommendations for various aspects of the investigation process will be discussed.

Keywords:  investigation project plan, digital forensics

Abbreviations

NIJ – National Institute of Justice

SWGDE – Scientific Working Group on Digital Evidence

WIFI – Wireless Fidelity, for internet connection

SSID – Name of a wireless network

TB – Terabyte

IT – Information Technology

Principles and Procedures Followed

All actions in the subsequent sections shall conform to the following principles and procedures. These guidelines are standard industry practices proposed by SWGDE and NIJ.

General Principles

Guidelines as per NIJ recommendation

Procedure and Policy Development

The following procedures must be met:

Assessment
Acquisition
Examination

This process is intended to obtain and analyze digital information. Obtaining data will be from laptop hard drive media, whereas analysis covers the scope of interpretation and conversion of recovered data into a format that makes sense.

Reporting

All actions and procedures must be appropriately documented with a sound recommendation of the investigation findings.

Storage

Evidence will be stored in a locker room accessible by fingerprint biometric scan entrances. Security footage will also be live in the storage facility. To acquire evidence, one should have proper documentation.

Meetings and Agendas

This section will highlight meetings and their objectives among various groups. Each meeting facilitates building informative decisions toward evidence analysis and the final recommendation upon finishing the investigation. According to Schwartz (2015), as detailed in the table below, various meeting categories have specific groups attending the meeting, the meeting’s objectives, a schedule, frequency of meeting, and an estimated duration per meeting.

Table 1

Meeting Category Group Objective Schedule Frequency of meetings/ week Duration

(hours)

1.     a Lead detectives, the digital forensic investigation team, and the Prosecution Crime background definition.

Creation of a list of contacts and identification of Participants.

 Week 1 1 2
b. Lead detectives, the digital forensic investigation team, and the Prosecution Updates on investigation status.

 

 Week 1-4 At least once or per arising need to meet. 2
2 Lead detectives

and

The Digital forensic investigation team

 Evidence inventory Week 1 At least thrice/ depending on the need for clarification by the investigation team. 4
3 Witnesses Establish a foundation for behavioural evidence data collection.

Gathering facts about the incident, the suspect’s motive, and victimization or harm.

 Week 2-3 per arising need for clarification 3
4 Company’s IT Management for suspect Provision of data essential to analysing data of interest in the investigation.

Timeframe analysis.

Assessment of activity logs

 Week 2-3 At least thrice/ per arising need for clarification 3
5 Company’s security team Assessment of suspect’s physical and behavioural activities.

 

 Week 2-3 At least twice/ per arising need for clarification 2
6 Coworkers Crime scene Assessment.

Suspect’s behavioural and motive data collection.

 

 Week 2-3 At least twice/ per arising need for clarification 2
7. Digital Forensic Investigation Team Identification of team and roles.

Scheduling of activities.

Creation of interview questions.

Budget design and proposal.

 Week 1

 

 

 

 5 4
b Data collection Week 2 5 3
c Data examination and analysis Week 3 5 4
8 Digital Forensic Investigation Team, lead detectives, and the Prosecution Discussion on findings and recommendations.

Reporting and Court Presentation

 Week 4 5 5/as demanded by the Prosecution and law enforcement.

List of Contact People

The following is a list of key contact people who are significant in making the research successful. They include:

Required forms

Application for Search Warrants: According to the United States courts, an “Application for a search warrant” (2010) refers to a legal court order document that requests a search warrant used by local enforcement.

Chain of Custody Form: It documents who handled what physical evidence during the digital forensic investigation.

Consent Form: This form will facilitate the accessibility of digital evidence from suspects, witnesses, or victims. Without the correct language, the evidence presented to the court may not stand (Magnet Forensics – “Consent to Search,” 2020).

Search Warrant: This a document issued by a judge or magistrate to authorize law enforcers to search vehicles, locations, or people for evidence.

Removal Media Worksheet: This document records comprehensive data about removable media from a computer device. In this case, the thumb drive will be of focus.

Hard Drive Evidence Worksheets: This refers to a document that records comprehensive data about hard disk drives.

Proposed Keyword Searches – According to Billingsley (2016), this tool will be able to identify data of interest from a given data set.

Checklist of Forensic Equipment and Software

This section details significant equipment and software required during the digital forensic investigation. Week 1 meetings revealed that the computers are Windows-based laptops. These include:

Recovery of deleted partitions

EaseUS data recovery software

Password recovery and data decryption

EPRB

RAM analysis

WindowsScope

Storage Unit

Fingerprint biometric storage locker

Personal equipment

Power supplies

Forensic laptops

USB and network cables

Blank hard drives – 1 TB storage space

Investigative process

Table 2

Evidence Inventory

Item No Item Owner abbreviation Operating System Assessment Tool
1 Acer Aspire| V5 Laptop P. W Windows 10 Pro WindowScope

EaseUS
2 Lenovo ThinkPad SL510 Laptop P. W Windows 10 Home WindowScope

EaseUS
3 USB Thumb Drive P. W – EaseUS

EPRB

Image 1

Deleted screenshots were recovered by EaseUS software.

EaseUS data recovery Image

Note. EaseUS data recovery Image (EaseUS, 2020)

Table 3

The logical data extraction was done on the two laptops and thumb drives.

Process ID Item Objective Significance to case
1 Unallocated space Facilitate recovery of deleted files Enable recovery of messages and images related to financial fraud.
2 Pertinent information Location of data of interest using file content, file’s location on the drive, file headers, and extensions. Locate files and images related to the impersonation of financial administrators.

Observation of BIOS data and other timeframe information.
3 File system Facilitate revelation of file size, time stamps, file names, attributes, and directory structure. Two different operating file systems were extracted.

Analysis

Forensic examiners validated the accuracy of BIOS time and date before proceeding with timeframe analysis. Information that was extracted detailed:

Data encryption

Image 2

Recovered Account data

Image 2

Elcomsoft’s EPRB recovered account information (Elcomsoft, 2020)

Interview forms with questions

People involved with answering these questions entail the Prosecution, coworkers, company security and management, and lead detectives. Essential questions that will help with this investigation include the following:

Questions for the Prosecution and lead detectives

Questions for the lead Detectives and associated law enforcement colleagues

Questions for Information Technology Administrators

Questions for the suspect and victim’s company security personnel / Witnesses

Questions for coworkers

Questions for the Prosecution

Questions for the digital forensic investigation team

This set of questions will highlight the investigation team’s competence and critical aspects that law enforcement may have left out yet are critical to in identifying incriminating evidence.

Investigation Timeline

Image 3 – investigation timeline process flow

Image 3

Week 1

The Lead detectives, the digital forensic investigation team, and the Prosecution will meet once for two hours to define background information. During the session, participants will be identified, including other detectives making it clear to generate a list of contact people.

The digital forensics investigation team shall identify team members and their roles, schedule activities, create interview questions, design a budget, and establish policies to guide the investigation process. The team will meet at least five times weekly, four hours per meeting.

Week 1- 4

The lead detectives, the digital forensic investigation team, and the Prosecution will meet at least thrice a week for 2 hours to share updates on the status of the investigation.

Week 2-3

The Digital Forensic Investigation Team will collect data and devices suspected to hold evidence. In liaison with various groups such as witnesses, coworkers, security personnel, and IT management, the investigation team will establish a foundation for behavioural evidence data collection, gather facts about the incident, the suspect’s motive and victimization or harm, assess and provide data that is essential to the analysis of data of interest in the investigation, bios timeframe, activity logs, suspect’s physical and behavioural activities, and motive.

Week 3

The Digital Forensic Investigation Team will examine data and its analysis for five sessions, each five hours long.

Week 4

The Digital Forensic Investigation Team, lead detectives, and the Prosecution will finally meet at least five times for five hours per meeting to discuss findings and recommendations and prepare for court presentations.

Investigative Budget

The hourly rate for forensic investigators is derived from salary.com, “hourly rates for digital forensic investigators” (2018). Retail product prices were obtained from Amazon.com, whereas cyber-forensic software and equipment costs were obtained from individual product websites such as WindowScope Products (2020) and Elcomsoft (2020).

Table 4

Equipment and software cost

Item Quantity Rate Sub-Total
Blank hard drives – 1 TB storage space

 

 3 $48 $144
USB cables

 

 2 $10 $20
Forensic laptops

 

 3 400 $1200
Power supplies

 

 2 $135 $270
WindowsScope

 

 1 $7,699 $7,699
EPRB

 

 1 $2000 $2000
EaseUS data recovery software

 

 3 $70 /month $210
Write blocker 1 $399 $399
Total $11,942

Table 5

Labour and Other miscellaneous expenses

Forensic Examiners 2

Minimum Total Expected working hours = 80

 $32/hour $5,120
Miscellaneous Expenses $350 $350
Total     $5,470
Total Investigation budget     $17,412

Conclusions

The investigation project plan adhered to principles recommended by NIJ from the collection of evidence to final processing. The purpose of the investigation plan was to assist in investigating two laptop computers and a thumb drive to locate evidence that implicated the suspect, Paul Walker. After a thorough evidence examination and analysis, it was clear that Paul had embezzled company funds, encrypted the thumb drive containing incriminating evidence, and deleted related data on his two home and office laptops and the thumb drive. Therefore, the digital forensic investigation team recommends presenting these findings to the lead detectives and case prosecutors for court processing.

References

Amazon.com: digital forensic software. (2020). Retrieved 17 July 2020, from https://www.amazon.com/s?k=digital+forensic+software&crid=3A2SFS726BPWP&sprefix=digital+forensic+soft%2Caps%2C448&ref=nb_sb_ss_i_1_21

Billingsley, J. (2016). Beyond Keywords: Is Keyword Search Becoming Obsolete In The New Age Of Forensic Digital Investigation? – Forensic Focus. Retrieved 17 July 2020, from https://www.forensicfocus.com/articles/beyond-keywords-is-keyword-search-becoming-obsolete-in-the-new-age-of-forensic-digital-investigation/

Consent to Search Form – Magnet Forensics. (2020). Retrieved 17 July 2020, from https://www.magnetforensics.com/consent-to-search-form/

Elcomsoft Desktop Forensic Bundle | Elcomsoft Co.Ltd. (2020). Retrieved 17 July 2020, from https://www.elcomsoft.com/edfb.html

Elcomsoft EPRB data recovery. (2020). Retrieved 17 July 2020, from https://www1.elcomsoft.com/ecx.html

The hourly wage for Digital Forensic Investigator | Salary.com. (2020). Retrieved 17 July 2020, from https://www.salary.com/research/salary/posting/digital-forensic-investigator-hourly-wages

Recommended Forensic Practices. Retrieved 17 July 2020, from https://us-cert.cisa.gov/sites/default/files/recommended_practices/Forensics_RP.pdf

Schwarz, R. (2015). How to Design an Agenda for an Effective Meeting. Retrieved 17 July 2020, from https://hbr.org/2015/03/how-to-design-an-agenda-for-an-effective-meeting

What is Digital Forensics? History, Process, Types, Challenges. (2020). Retrieved 17 July 2020, from https://www.guru99.com/digital-forensics.html

WindowsSCOPE Cyber Forensics 3.2 – WindowsSCOPE. (2020). Retrieved 17 July 2020, from http://www.windowsscope.com/product/windowsscope-cyber-forensics-trial/

Appendices

Appendix A – Application for a Search Warrant

Image – Application of Search Warrant (United States courts- Search Warrant, n.d.)

Appendix C- Search and Seizure form.

Appendix D – Chain of Custody

Evidence Chain of Custody form

Case Number:             Offense:

Submitting Officer:

Victim:

Suspect:

Time and date seized:                         Location of confiscation

Item Quantity Evidence Description
     
     

 

Item Time/Date Chain of Custody

Released by

  

 

Received by

  

 

Comments
         
         

Appendix E– Sample Removable Media Worksheet

Appendix F – Hard drive Evidence Worksheet Sample

Similar Post: Telematic devices in health insurance companies

ORDER A PLAGIARISM-FREE PAPER HERE

We’ll write everything from scratch

Question 

Guidelines for Investigation Project Plan

Your report must be organized and written in a way that is easy to follow. Include all requirements that are identified in the Project 1 steps as well as here in the guidelines.

Investigation Project Plan

Each section of the report should be identified. Use the terms figure and table to refer to all images and graphics. Take time to check your sentence structure, expression of ideas, and spelling. Your writing must flow and make sense.

Tables, screenshots, graphs, and artifact images in your report should be individually labelled and numbered using APA format (e.g., Table 1 Expense Budget, Figure 1 Screenshot of Washer ATM Image). Check the UMGC library for the proper APA formatting.

Your instructor may require additional details and different formatting approaches. Rely on your instructor’s guidance and feedback to produce the highest deliverables to meet or exceed performance standards for Project 1 in DFC 620/CST 640.

Consider the following sections as the minimum starting point. Be sure to click each tab for more information.

Purpose In brief, this section should include what you, as the investigator, are trying to achieve through this investigation.

Note: You may want to include an abstract since you will be required to include an abstract in many of the future papers you write in the UMGC graduate program. Your instructors expect it, and your paper submissions will stand out as polished graduate-level work. If you don’t know an “abstract”, review it in the UMGC library or search online. This is the time to learn and grow.

Meetings and Agendas Identify the types of meetings that should be held and the issues to be discussed with each group of meetings that need to be conducted. Be sure to include in the timeline section when the meetings should occur.

Create a meeting agenda to accompany each proposed category of meetings. (You can research how to prepare a proper agenda format). Your instructor may provide feedback on this issue.

Investigative Process Describe step-by-step what you found and where. In an actual investigation, it is essential that you specifically describe each action taken during your investigation examination. Provide screenshots of your work for this course to demonstrate your mastery of the course lab competencies. Refer to your screenshots using sequentially numbered figures by section so figures in section five would go Figure 5-1, Figure 5-2, etc.

Summarize and explain what you have learned and why this information is essential at each step. Express in your own words what you have learned about developing and implementing a digital forensics investigation plan after you have read your reference sources. Use APA in-text citations. Include all cited sources in the reference section at the end of this plan.  You should already know to stay away from Course Hero!

Do not copy and paste information from your sources. Summarize what you have learned. You can include short quotations from a reference source that helps you make your point, but it should be a phrase or two to three sentences. However, you must appropriately credit and cite the reference source. Describing your supporting analysis in your own words and quoting credible sources will help make your Project 1 paper stand out.

Interview Forms with Questions Develop separate sets of investigative questions that you would separately ask of each potential type of witness in the project. (e.g., for a company IT director, for coworkers, for witnesses). The more detailed, the better. You can learn about the types of questions to ask by reading the course references and performing your research concerning the questioning of witnesses during a digital forensic investigation. (See NIST’s Guide to Integrating Forensic Techniques into Incident Response, Special Publication 800-86; the National Institute of Justice’s (NIJ) Forensic Examination of Digital Evidence: A Guide for Law Enforcement; US Secret Service’s Best Practices for Seizing Electronic Evidence, UMGC course references, and other sources. You will also have to conduct your research to understand what to ask. Your instructor may provide some feedback on this issue.

Fully develop a list of contact people who will be essential and valuable throughout the investigation. (e.g., company, legal counsel, case investigator, case prosecutor, company IT manager, department director, employee supervisor, local law enforcement, human resources director, assigned digital forensics examiner, etc. This is a start. More contact categories may apply. Again, you will learn more about whom to contact by conducting proper research as you attempt to meet the Project 1 requirement. Don’t just make things up. Your instructor may provide some feedback on this issue.

Steps and instructions

A digital forensic investigation process can involve many steps and procedures. The objective is to obtain unbiased information in a verifiable manner using accepted forensic practices. In this project, you will perform some of the steps necessary for setting up an investigation. These steps include designing interview questions that establish the needs of the case and provide a focus for your investigative efforts. You will also determine what resources may be needed to conduct the investigation. Once you have this information, you can develop an investigation plan that properly sequences activities and processes, allowing you to develop time estimates and contingency plans should you encounter challenges in the investigation.

This situation involves two computers and a thumb drive. After explicit authorization to proceed has been obtained, one of the first investigative decision points is whether to process the items of evidence individually or together. Processing computers individually makes sense when they are not likely tied to the same case. However, if the computers are linked to the same case, there can be advantages in processing them together.

There are four steps in this project. In Step 1, you will develop interview protocols and identify documentation needs for a forensic investigation. In Step 2, you will identify the tools and software needed for the investigation. In Step 3, you will develop a plan for conducting the investigation, and in Step 4, you will consolidate your efforts in the form of a single document to be submitted to your supervisor (i.e., your instructor). The final assignment in this project is a planning document with a title page, table of contents, and a distinct section for each of the three steps in the project. Consult the relevant Guidelines for Project 1 Investigation Project Plan sections at every step.

In Step 1, get started on the plan by creating an interview form to record questions, keywords, and authorization information and to complete the legal forms needed in this case. However, before you can do that, you need to review your training in criminal investigations.

Step 1: Create and Gather Forms

Your tasks in Step 1 are to create interview forms to record questions, keywords, and authorization information and designate other legal forms needed in this case. You must describe the importance of each form you create in the body of your final Project Plan assignment and include in-text reference citations for all of your content. The forms you complete as part of Step 1 will be included in your Investigation Project Plan, the final assignment for this project.

As part of the investigation into two computers and a thumb drive, it’s essential to do the necessary preliminary work. Criminal investigations have laws governing the chain of custody, search warrants, subpoenas, jurisdiction, and the plain view doctrine. It’s essential to be familiar with these topics. Review forensic laws and regulations related to cybercrime, as well as rules of digital forensics, in preparation for your digital forensic investigation.

The next thing to do is to read the police report and perform a quick inventory of devices that are thought to contain evidence of the crime. You have set up a meeting with the lead detectives and the prosecutor handling the case.

You have received an official request for assistance that gives you the authority to conduct the investigation. You realize it will be impossible to produce a detailed investigation project plan before you meet with the detectives and the prosecutor. First, you must develop questions to establish the key people and activities. These questions should address potential criminal activity, timelines, and people who must be investigated.

It is also essential to determine whether other investigators are pursuing different aspects of the case and to include those investigators on your contact list. In addition, some situations may involve organizations or individuals who must adhere to various industry compliance types. This situation may require you to follow special procedures.

In Step 2, you will consider the resources needed for the investigation.

Step 2: List Required Forensic Equipment, Software, and Labor Expenses

In Step 1, you developed forms and templates to collect the legal, criminal, and technical information that lays the groundwork for your investigation. In this step, you will consider the types of equipment and human resources needed to conduct the investigation and create a budget table that includes expenses for software licenses, computers, storage devices, number of digital forensics examiners, digital forensics examiners’ labour hours, examiner hourly pay rate, including time spent for each phase of the investigation process in gathering evidence analysis, reporting, presentation preparation and court appearance(s).

It is essential to total the overall costs of all equipment and expenses in your budget table. By making these preparations, you are establishing forensic readiness. Required resources can include people; tools and technologies such as RAID storage, deployment kits, or imaging programs; and budget and timeline information.

Develop a checklist. It will be included in the final Investigation Project Plan.

In the next step, you will begin to prepare a plan for managing a digital forensic investigation.

Step 3: Plan Your Investigation

In the prior step, you determined the necessary resources for your investigation. In this step, you will develop a plan for managing the investigation. The requirements for writing case reports reflect the step-by-step rigidity of the criminal investigation process itself. Articulating time, task, money, and personnel requirements is essential.

Project management is a skill set that is not often linked to digital forensics and criminal investigations. That is unfortunate because effective project management can dramatically impact the success and accuracy of an investigation. Identifying the tasks that need to be performed, their sequence, and their duration are essential considerations, especially in the face of “wild cards”, such as delays in obtaining correct search warrants and subpoenas. It is also essential to clearly understand the goals for the investigation, as you will likely be called upon to present conclusions and opinions of your findings.

Your project plan should include a properly sequenced narrative timeline and a separately labelled and sequenced Visual Graphic Timeline chart that reflects the time intervals between each phase of the evidence acquisition and investigation processes (e.g., 30 hours gathering evidence spread across five business days, 60 hours of analysis over ten business days, 90 days for reporting and court preparation, etc.) including detailed time estimates, and contingency plans. Your plan will serve many purposes, including assigning a project budget. As you create your plan, be sure to include in your meeting agenda communications and reporting: who should be involved, how the activities should be carried out, how often, and under what circumstances (i.e., modality, frequency).

Once you have developed your project management plan, move on to the next step, where you will submit your final assignment.

Step 4: Prepare and Submit the Completed Investigation Project Plan

For your final assignment, you will combine the results of the previous three steps into a single planning document—an Investigation Project Plan—with a title page, a table of contents, and a distinct section for each step. The plan should include:

  1. Forms documenting key people, meeting agenda, key activities and reporting, keywords, investigation timeline narrative, visual graphic timeline chart, authorization confirmation (e.g., ownership, jurisdiction), and related investigations. Designation of the legal forms required for criminal investigations should also be included. (Step 1)
  2. Resource checklist for equipment, human resources and labour expenses (Step 2)
  3. Management plan (Step 3)
  4. Search and seizure form(s)
  5. Chain of custody form

The organization and details of your plan are essential. Be sure to refer to the Guidelines for Project 1 Investigation Project Plan to meet the minimum standards needed for this project.

All sources of information must be appropriately referenced. Submit your completed Investigation Project Plan to your supervisor (instructor) for evaluation upon completion.

Check Your Evaluation Criteria

Before you submit your assignment, review the competencies below, which your instructor will use to evaluate your work. A good practice would be to use each competency as a self-check to confirm you have incorporated all of them. To view the complete grading rubric, click My Tools, select Assignments from the drop-down menu, and then click the project title.

Exit mobile version