TFB2143 / TEB3213 Computer Forensics Project : End-to-End Digital Forensic Investigation 2026

🗓 Task 2 – Execution & Acquisition (30%)

Requirements:

• Execute scenario in a VM.
• Generate artifacts via natural OS interaction only.
• Create forensic image using FTK Imager.
• Generate SHA-256 hash.
• Complete Chain of Custody form.

Minimum required artifacts:

• 1 deleted file
• 1 browser artifact
• 1 execution artifact (e.g., prefetch)
• 1 data movement artifact (USB or network)
• 1 cleanup attempt
• 1 red herring

🗓 Task 3 – Analysis & Reporting (40%)

Analyse using:

• Autopsy
• Wireshark (if network involved)

📦Deliverables:

1. Forensic Report (structured format)
   1. Timeline reconstruction
   2. Root cause analysis
   3. Security recommendations
   4. Evidence documentation
   5. SOP explanation
2. 10–12 minute recorded video presentation (Youtube link to be inserted in the first page of the report)

⚠ Important Rules

• No manual artifact planting.
• All actions must be natural OS interactions.
• Missing predicted artifacts → marks deducted.
• Weak/simple incidents → marks deducted.