Posted: November 22nd, 2015

DFI, LLC. – digital forensic investigation company

Final Exam Scenario
You are a digital forensics investigator for DFI, LLC. – digital forensic investigation company. You have just been contracted by American Marketing Systems (AMS) to conduct a clandestine investigation in support of a suspected internal skimming operation involving one or more people in the marketing department or accounts receivable.  AMS has reason to suspect that one or more employees are stealing from the company.

AMS is just aware that there is a problem, but they don’t know what the problem is or how the skimming operation is being conducted. Your job is to determine if a skimming operation exists, and if so, who is involved and how they are conducting the operation.

The general method that DFI and AMS agreed upon is to place you into a “created” position with IT as a systems administrator so that you can conduct the investigation under cover of your system administrator role. Nobody within AMS knows of your role as a forensic investigator except the VP of IT, the company controller, and the CEO.  You will only communicate with these individuals off site so as to not blow your cover.
________________________________________________________________

Your Tasking

1. Describe your plan for conducting your investigation. (30 points). Some of the items you will want to cover include (not all inclusive):
2. What AMS corporate assets you will review
3. The tools that you will need
4. The way that you will conduct your review of each asset
5. History – how far back will you need to go in your review and how will you determine this
6. Verification – how will you verify your findings
7. Project Plan (15 points).
8. The steps and dependencies in your investigation
9. Time estimate for each task
10. Potential risks and challenges to the investigation and how they should be handled.
11. Determine how you will determine who is involved (15 points).
    1. People within AMS.
    2. People external to AMS.
    3. Methods employed to conduce skimming operation.
    4. Other considerations.
    5.         Discuss how you will handle potential evidence. (15 points).
    6. Chain of custody and preservation.
    7. Analysis and reporting.
    8. Other items.