Advice on Securing Evidence and Imaging
I can confirm that all work submitted is my own: Yes
This coursework is testing your ability to both write contemporaneous notes and carry out an effective evidence gathering and imaging activity.
Question 1 (100 marks)
You are employed as a Contractual Consultant specialising in Digital Investigation by a local school. There have been recent issues of potential misconduct by staff members posting inappropriate comments on social networking sites, potentially bringing the school into disrepute and/or criminal conduct, although the latter element has yet to be substantiated. This issue has been complicated by the School’s BYOD Policy which has been embraced by the vast majority of staff members, but has led to disputes over the extent to which the school can intrude on the privacy of staff members. The Board of Governors is clear however, in that if a device is used on school premises that it is subject to the Schools Rules and Regulations concerning acceptable use.
The school wishes however for you to draft some clear and relevant guidelines concerning the seizure and examination of a device should the Information Technology Manager suspect contravention of its rules. The school is clear it needs to be acting legally and should it seek to evidentially use any material against a staff member that the guidance should be robust enough to stand scrutiny by an Employment Tribunal.
Submission Date
Cut-off date: You should submit your completed assignment to arrive no later than the cut-off date: 18/3/2016. Write your solutions to this coursework in a single word-processed document with an appropriate appendix in which you should all relevant documentation. Each page should be numbered and headed with the title of the coursework, your name and your matriculation number, for example:
318SE CWK Robyn Doe 2122222
Additional instructions on submission can be found in Appendix 1.
Plagiarism Note:
As with all assessed work, both the research and written submission should be your own work. When submitting this work you are explicitly indicating that you have read the rules on plagiarism as defined in the University regulations and that all work is in fact your own, except where explicitly referenced using the accepted referencing style.
Objectives
This particular coursework covers learning outcomes 1, 2 and 3 as shown below:
- Explain the principles of data recovery and data protection techniques
- Apply data recovery techniques to forensic investigation
- Explain the principles of mobile device forensics and examine mobile devices
You should ensure that the acquisition is in accord with the ACPO Good Practice Guide for Digital Evidence (Published March 2012) Version 5 and the Digital Imaging Procedure 2007 58-07 annotated as such in your notes.
Marking Scheme
Your work will be marked out of 100 with the breakdown as follows:
| Assessable Item Style (How readable and useful is your report?) | Mark
|
| Clear and well-written Report | 25 |
| Less clear Report not a reflection or summary | 20 |
| Report may have omissions or ambiguity | 15 |
| Incomplete Report | 10 |
| No Report | 0 |
| Research (How you evidenced the rationale for your recommendations) | |
| Exemplary Research and considers all the issues that may be presented | 25 |
| Adequate Research, some issues missing, but main ones covered | 20 |
| Some attempt made and some of the main issues covered | 15 |
| Some Research, but most of the main issues missing | 10 |
| No Research presented | 0 |
| Compliance with ACPO Guidance and Legislation (Understanding of guidelines and their application) | |
| Complete understanding correctly annotated | 25 |
| Comprehension demonstrated with adequate contemporaneous notes | 20 |
| Some comprehension demonstrated with adequate contemporaneous notes | 15 |
| Limited comprehension demonstrated with some contemporaneous notes | 10 |
| Poor comprehension and totally inadequate notes. | 0 |
| Sound Advice (Is your guidance likely to satisfy the school’s needs) | |
| All issues surrounding securing evidence and imaging dealt with adequately | 25 |
| The main issues surrounding securing evidence and imaging dealt with | 20 |
| Enough issues dealt with to make a relatively safe recovery | 15 |
| An attempt made to cover the issues, image would not be safe | 10 |
| Any other incorrect attempt or procedure | 0 |
| General Comments
|
Total 100
Appendix 1: Submission Instructions and Extensions
Follow these instructions carefully. Failure to do so will mean sections or all of the coursework marked being zeroed.
- The coursework should be submitted as an online submission. Your submission should be either as a MS Word or PDF document.
- Your submission consists of one part:
- a) It is a word-processed document detailing what your advice is in a format that is accessible succinct and clear about the advice given. You may include whatever illustrations or other graphic means that enhance your document.
- Extensions will only be given if supporting evidence is produced, so only ask for an extension if you really need it and if you have no supporting evidence to support your request it will be rejected. Any such request should be directed to Registry.
