本次作业主要为网络系统取证演示相关的assignment代写
2. Background
Hoare Research UK (HRUK) is a publicly owned company that specialises in research around efficient data processing and makes extensive use of cyber systems in its operation. HRUK is accusing a former employee of stealing and releasing data to the public via mass media for personal gain.
HRUK representatives argue the former employee, a software engineer, exfiltrated data out of the organisation using anti-forensic techniques and deception. HRUK argue the engineer smuggled sensitive data out of the organisation through Microsoft Word documents. The organisation claims the individual smuggled trade secrets out by embedding them as images in Microsoft Word documents. The documents were password protected and encrypted using standard features of Microsoft Word 97, the version used by the company at the time of the incident. For example, images of bespoke algorithms as illustrations were inserted into Microsoft Word documents. These documents were often over 1000 pages long, and had filenames that were relevant to the employee role, such as “API formation and communication strategy”.
The software engineer claims they did not steal data for personal gain. The engineer stated that although they did take documents outside of the organisation to perform work at home, this was standard practice among many employees in the organisation. The engineer stated they accept images of trade secrets were present in documents they took home, but they did not insert them into the documents and are not aware of how the images came to be in any of the documents. The engineer claims that once they realised the significance of the images and how the images revealed the company had damaged the environment, they made the images public via the media as a whistleblower. Lastly, the engineer stated they did not decieve as they did not insert any of the images into the document and encryption was feature of Microsoft Office, a solution provided by the company.
Bill and Ben are junior digital investigators for the company and conducted the original investigation. Bill conducted a live analysis of the engineer’s system in-situ when the leaked images appeared in the media.
Ben stated that he disagreed with Bill’s actions and advised Bill of such, he also said Bill should have kept notes. Bill said he did not have time to keep notes and was trying to determine the password used to lock the Microsoft Word documents as the encryption used could not be compromised. Ben agreed there was no way to compromise the encryption, and states this is still true in the present day.