SIT282- Computer Crime and Digital Restraintensics T2 2019
Impost Job 2 Case Research and Recommendation Noise
Due: Sunday September 22nd at 11.59pm (object of week 10).
Total Availconducive Referconducive attributconducive attributablees: 20, Weighting 20%
General Insist-uponments
Pleased correction the “Assessment_Task_2_TEMPLATE” perfect supposing in the imposts
folder on the Unit Seat to finished this impost.
• NO EXTENSIONS fullowed externally medical or other certification.
• LATE ASSIGNMENTS accomplish automatically imperil 5% per day up to a consummation of five
days, including weekends and leisures. Assignments submitted 6 or more days tardy accomplish
referconducive attributconducive be conspicuous and are ardent referconducive attributconducive attributablehing.
• The practical instrument correctiond restraint the practicals contains full the tools insist-upond to finished this
impost job.
• Enenduring you charm hideshots of your performance restraint sign and that these are plain in your
report.
• To finished this impost you accomplish insufficiency to bear thriveed the hypothetical symbolical and
completed the practicals restraint weeks 7-9. This impost cloaks symbolical up to the week
ending September 13th.
• Your inferiority must be in a PDF restraintmat.
• Consummation magnitude of your inferiority should be 15 pages save the cloak page but
including hideshots, tconducive of discontinuance, 2 page digital restraintensic noise facile restraint Sandra
(relate to part-among-among 7 on the present page) and relateences. The font magnitude should be no close than
11pt.
• No referconducive attributconducive attributablee accomplish be ardent if you miscarry to exhibition the sign of your performance-out. i.e.
the manner carried quenched to fruit your discerption. The noise should be
written so the steps manufactured are reproducible.
• Enenduring you practise a tailup delineation of your performance.
• Plagiarism is referconducive attributconducive attributconducive attributconducive tolerated. Restraint referableification on Plagiarism and Collusion including
penalties pleased relate to the incorporate: http://www.deakin.edu.au/students/clouddeakin/helpguides/assessment/plagiarism
• The APA Relateencing Style is to be correctiond restraint this assignment where withhold.
https://www.deakin.edu.au/students/studying/study-support/referencing/apa-6
Succor with the impost
If you insist-upon coadjutorship pleased implore your instructors (Burwood students implore your practical
demonstrator; Geelong and Cloud students implore Damien Hutchinson). We accomplish NOT answer
questions that are desireing answers or discerptions. A inquiry MUST be substantiated with
sign that performance has been attempted relating to the inquiry substance imploreed.
The referconducive attributconducive attributableeing rubric is rooted to the inferiority incorporate on the Unit seat. This provides a
detailed composition restraint successfully completing the impost. Be enduring to relate to the relevant
section of the rubric when imploreing a inquiry. The simply other command is to enenduring you do referconducive attributconducive attributable
leave this until the conclusive days antecedently the ascribconducive epoch.
THE CASE:
The imperilled symbolicals team is named suddenly at 3a.m. May 10 to a warehouse
behind Roma St subsidence in Brisbane. Team limb Moti identifies the show as a refuse
manufacturing subsidence, and the herd there bear hurriedly packaged up the loose
powders they were performanceing with, leaving traces on the sole and abutting numerous desk
surfaces. Moti makes a determination referconducive attributconducive attributconducive attributconducive to cfull the restraintensic squad in when he sees the
refreason traces, becacorrection he suspects the refreason is at the summit of the present most dangerous
catalogue and he insufficiencys to charm samples tail to his lab restraint part-amongition antecedently identifying it.
However, Moti is free with the protocol when there is a computer in the area, and
calls his coadjutor Sandra, waking her at 3:17a.m. to tramp him through a capture of
computer facts restraint restraintensic part-amongition. He is conducive to close down the laptop, and removes it – oration bishop
from the show along with sundry CDs establish in the desk.
Later that day, Sandra analyzes the lapsummit and CDs in the police restraintensics lab. The
computer is equipped with Windows and simply a basic Word instrument readiness and
Internet Explorer, a program named “OpenPuff”, and has software restraint exhibitioning DVDs
and vision perfects. No instruments show to bear been stored on the instrument. Three of
the CDs are in-fact DVDs with new-fangled movies. The fourth contains a slight ZIP
file.
Sandra makes three restraintensic copies of full the facts and stores couple of them safely in the
lab. She then delegates the lapsummit and CDs to diverse staff limbs restraint part-amongition,
distributing the third copies to them. As most of the staff are too concerned in a large
on-going research she decides to implore restraint the succor of an subjoined team limb
who is leisureing overseas.
You hold a detain e-mail from Sandra with an passion containing couple NTLM
hash strings retrieved from the criminal’s laptop, the ZIP perfect from single of the CDs
along with a desire to analyse it as straightly as likely restraint any congruous referableification,
and an acknowledgment restraint interrupting your leisure.
The couple NTLM hashes are:
D6A21EA26063C42FC9876E4B0C51BC82:CA72B189F412A384D96B785A08176773
and
8282461A2BDAF626E6067B973FDDC643:5C305D4616C7571D5DDC6EEA5BA5C395
TO DOWNLOAD A COPY OF THE ZIP FILE IN THE EMAIL ATTACHMENT COPY AND
PASTE THIS URL INTO A WEB BROWSER:
http://www.deakin.edu.au/~zoidberg/2019A02.zip
And you are advised that the MD5 hash rate of the executconducive perfect should be
9ec1c8f62429182349f3979c39aed8fb
Analyze this perfect and noise your findings using the quenchedline adown. (Restraint referconducive attributconducive attributableeing
purposes, it is strongly recommended that you thrive this quenchedline.)
DIGITAL FORENSIC PROCEDURE
1. Explain how you downloaded the perfect, what precautions you took, and how you
ensured its probity.
1 referconducive attributconducive attributablee
2. Describe how you decrypt the couple ardent NTLM hash rates by using OphCrack
including hide shots.
2 referconducive attributconducive attributablees
3. Describe the manner that you reason to known the downloaded perfect. Describe whether
there is a relation between this manner and the referableification obtained in Step 2.
2 referconducive attributconducive attributablees
4. Describe the real pleased of the encrypted perfect that you verified in Step 3. If
there are multiple perfects, catalogue their perfect names, types and MD5 hash rates. Describe
the visual discontinuance in each perfect.
2 referconducive attributconducive attributablees
5. What tools accomplish you now correction to profits your research and why?
1 referconducive attributconducive attributablee
6. Describe how your research profitsed at this object, including hide shots.
8 referconducive attributconducive attributablee.
DIGITAL FORENSIC REPORT
7. Write a couple page noise restraint Sandra catalogueing your findings and recommendations.
Make withhold suggestions on how a excite research should profits.
Construct and finished a single-part-among sign restraintm as part-among-among of your noise.
4 referconducive attributconducive attributablees

~~~For this or similar assignment papers~~~