Digital forensics involves processing data from many different types of devices, ranging from desktops to laptops, tablets to smartphones, servers to cloud storage, and even devices embedded in automobiles, aircraft, and other technologies. In this project you will focus on the architecture and imaging of desktop and laptop computers. You will be working in the VM to image and verify the contents of the following:

1. a USB stick
2. the RAM and swap space of a live computer
3. a networked computer hard drive

There are seven steps in this project. In the first step you review a technical manual containing information about the various locations where we typically find data of forensic value. The next two steps guide you through the process of imaging a USB stick with both Linux and Windows tools. The next step poses several questions that frequently come up in cases similar to this scenario. In the next step, you’re back to collecting forensic evidence; this time you’re imaging the RAM (memory) and swap space of a live, running computer. In the next step, you image a computer’s hard drive over the network. In the final step, you compile all of the previous lab notes and reports into one comprehensive report. The final assignment in this project is a forensic imaging lab report that can be presented in a court of law.

Before you can begin imaging the USB drive provided by your supervisor, you need to review your technical manual in order to prepare a statement of work to give to your company’s legal team. Are you ready to get started?

When you submit your project, your work will be evaluated using the competencies listed below. You can use the list below to self-check your work before submission.

• 1.1: Organize document or presentation clearly in a manner that promotes understanding and meets the requirements of the assignment.
• 1.4: Tailor communications to the audience.
• 1.5: Use sentence structure appropriate to the task, message and audience.
• 1.6: Follow conventions of Standard Written English.
• 2.2: Locate and access sufficient information to investigate the issue or problem.
• 2.3: Evaluate the information in a logical and organized manner to determine its value and relevance to the problem.
• 4.1: Lead and/or participate in a diverse group to accomplish projects and assignments.
• 5.3: Demonstrate the appropriate use of multiple digital forensic tools and techniques for imaging and verification.
• 5.4: Demonstrate an understanding of the different parts of a computer
• 6.1: Perform report creation, affidavit creation, and preparation to testify