As a lead federal forensic examiner, you have been asked by a federal government senior executive to perform an actual postmortem forensics analysis in order to play back events related to an external network attack. This network also involves the authorized manipulation of national security classified information; therefore the senior executive would like to know both the procedures and the tools to be used to collect the data and evidence of the intrusion. The specific executive request is for you to formulate postmortem analysis procedures to be used against the suspected unauthorized intrusion.
Provide a forensic plan that may be used by the investigator to perform this postmortem forensics analysis. Make sure to include the following:
Assignment Guidelines
- An introduction to the contents of the report
- An overview for why the postmortem analysis must be conducted within the given scenario above to reproduce digital activity, former systems states and activity
- The procedures typically used by investigators to operate postmortem forensics simulators/tools, and the types of digital activity and system states the investigator may detect
