What to submit: Forensic report

Given the scenario and seized data files, it is your role as an investigator to
uncover any evidence to prove or disprove the allegations – of drug
involvement - but also of evidence tampering. The assignment has highlighted
what you are looking for in particular, so the scope of the investigation is
limited to this particular suspected crime.
Your report should follow the structure detailed in Chapter 14 of the textbook,
and you are urged to state the facts clearly and not bury them in pages of
irrelevant content.
You should follow forensics procedures, such as taking a hash of the image
before using it and checking regularly to ensure you have not modified it. You
can select and use any proprietary or open-source tools that you have been
introduced to perform the analysis and extract any evidence present.
Your report should detail the investigation process and the findings (including
copies of relevant evidence). You can assume that the reader has a light
understanding of digital forensics, so any complicated terms/techniques/etc
should be explained.
You must include some screenshots in your reports with the output of the
tools or the process and when necessary to support/show how you reached
your conclusions. Screenshots should not be used to excess – they merely
serve to demonstrate your understanding of the tools/processes and should be
used to support written explanations (not in place of).
The “Assignment Hints and Questions” file describes the areas you should
highlight in your assignment and the marks. You will be marked based on the
evidence you extract, the use of appropriate tools, the detail of the process,
the explanation of its relevance to the case and documentation. Remember,
your report should present the information in an unbiased way. Improper
handling/validation of evidence would result in loss of marks except where
accurately identified and corrected.