Hello, dear friend, you can consult us at any time if you have any questions, add WeChat: daixieit

Master of Information Security & Digital Forensics STEM Research Methods Topics

STEM Research Methods (ENGE817) is designed to give students an understanding of the requirements for a logical, well-designed research proposal. Students must write a research proposal and in the case of computing students, undertake a small part of that research. For MCSDF students, this will likely require a small, practical part of the research being undertaken with results discussed and conclusions from the research drawn. It is important to always bear in mind that this is aresearch methods course and not a research course. Therefore, the purpose of the course, and the majority of the marks, will come from producing a research design with well-thought-out research questions, steps in the research and a good understanding of the issues and challenges of the research, partially drawn from the practical component.

A common approach is to design a research project with a number of stages that will lead to a robust research project with comprehensive results, but to only undertake the first few stages and leave the following stages to be discussed as future work. In this way, the pilot study undertakes a small part of the project that acts as a ‘proof of concept ’ for the wider research discussed in the project. It is, however, not mandatory to take this approach. It is important to demonstrate a reasonable amount of research has been done. Trivial or very small pilot studies will not be viewed favourably.

The following topics are suggestions only. You may select one of these topics or you may design your own research topic. The choice is yours.

Topic 1: Forensic reconstruction of mesh networks utilizing trilateration.

This topic requires programming in a graphical programming language of your choice. The point of this topic is for students to understand the complexities of network reconstruction from artefacts recorded during network operation and to highlight the challenges that emerge as the software is written and simulations are run. The example below is from software written in Matlab,but any language is acceptable.

Imagine a mesh network forming where every computer (node) in the network can calculate its distance to every other node in the network. This ‘perfect world ’ communication is useful for the pilot study, but in reality, calculating distances from signal strength is not overly accurate.

Several nodes appear on a grid 2500 metres x 2500 metres square. The centre of the grid is coordinate (0,0). The first node is always placed here. The second node is always placed on the y axis, either above or below the first node. Each node from there is randomly placed. To obtain the x andy coordinates, random numbers between - 1250 and +1250 are used. The nodes appear on the grid and the distances  from  every node to  every  other node  are  calculated using Pythagorean theory. The name of each node (you may utilise letters of the alphabet or numbers) is recorded and the distance in metres to the node is recorded. In this way, a table or array of nodes and distances is created.

The nodes are shown on the grid along with lines and distances to every other node. For the sake of clarity of the figure, begin with 5 nodes but it should be scalable. Your software should accept input from a text file so that various features on the grid can be switched on or off. This includes circles which show the distance to the nodes.

 

5 nodes with lines and distances

 

5 nodes with circles, lines and distances

This is the first part of the wireless network plotting, but now the forensic reconstruction must be  done.  This  involves  only  having  the  following  information recorded: node name  and distance from node to every other node. Coordinates of the nodes is not known. To reconstruct the network, only the node and the distances is used. You must demonstrate a thorough understanding of why this is simple on one hand and complex on the other. What will happen if a  communication  distance  of 300  metres  only  is  introduced.  How  will this  affect  the reconstruction and the plotting of the nodes?

Topic 2: Presenting Exif data from Jpeg files in a table

This topic requires Bash scripting. A .dd file with a number of jpeg images with GPS data recorded is used for the file recovery.

The script will:

•   recover the jpeg files from the .dd file

•   save the jpegs to a folder

•   extract the relevant data from the jpegs including GPS data

•   Construct a text file that shows a table of filenames and relevant data.

This can be extended by modifying the script to recover many file types and list the relevant file attributes in a table.

Topic 3: A comparison of RAM versus Hard Drive storage - what additional forensic artifacts maybe recovered from RAM?

This topic requires capturing a RAM image and comparing the data in the RAM image with artefacts recovered from the hard drive. To do this, a fresh installation of an operating system is required. The computer will be utilised for a number of common tasks such as browsing web sites, entering encryption keys to lock files, entering usernames and passwords for web sites and saving files. Much of the data, such as browsing history, will then be deleted.

Encase or Autopsy 4 or other software can then be used to recover the relevant information  from the session. Much will likely not be recoverable such as passwords and any ‘private mode ’ browsing.

A RAM dump will betaken. The relevant information in RAM will be searched for.

What is found in RAM that was not able to be recovered from the hard drive?

Topic 4: SSD drive Wear Levelling and Garbage Collection timings: The predictability of these occurrences.

SSD   drives   present   significant   challenges   for   forensic   investigators   because   of   the implementation of wear levelling and garbage collection. Can the forensic investigator predict when these will occur based on the time that power has been supplied to the SSD drive.

This topic will require students to have access to at least one SSD drive. The drive has a number of files put on it and then some of these files are deleted. Power is continually supplied to the drive. At some stage wear levelling and garbage collection will occur. The drive must therefore be checked at regular intervals to see if either or both of these has occurred. In this way,a guide for forensic investigators can be constructed advising the likelihood of these occurring in a set time frame – for example – one week, one month etc.