COMP 5071 Digital Forensics Essentials Assessment 3 Page 1 of 2 Forensic investigation and reporting: An individual assessment in the form of a forensic report. Scenario: Working as a forensic practitioner, you have been provided with an EnCase evidence image taken from a suspect’s PC. The specific details of the suspect are unknown to you at this time, however you have been made aware that they are suspected of colluding with another individual to plan a variety of serious crimes. The motives of the suspect are unknown at this time. Task: Your first task will be to analyse the evidence image and obtain as many details as possible about the suspect and their actions, particularly in relation to any crimes they may be planning, or have already committed, and any accomplices with whom they may be working. You will conduct the analysis using EnCase, based on the skills you have gained during this course. You will need to make case notes/records for all of the details that you discover during your analysis for ultimate inclusion in a forensic report, which is the major deliverable for this assessment. Ensure that you clearly identify each of the digital artefacts that you discover in your forensic report (e.g. using file paths or other unique IDs) and that you record relevant metadata for each artefact (e.g. date/time created, last accessed, modified). Artefacts without supporting metadata will not be accepted for grading. The forensic report should conform with the guidelines specified in Australian Standard 5388.4—2013 Forensic Analysis Part 4: Reporting, with specific focus on Section 9 – Report Contents. This section will provide high-level guidance on the structure of your forensic report. In addition to the structural guidance provided by AS 5388.4, you must include a Conclusions section which summarises your key findings in relation to the case. The word limit for the forensic report is 2,000 words (+10%). In addition to the forensic report, you will need to produce a document which justifies the analysis and reporting decisions that you have made. This should include a detailed discussion of the techniques that you used within EnCase and the associated artefacts located (referencing the forensic report where appropriate). It should also include a justification for the detailed sections included in the forensic report (beyond those specified by AS 5388.4). The word limit for the companion document is 1,000 words (+10%). Logistics: You will be provided with access to the EnCase evidence image related to this case for the duration of your scheduled practical class (~2 hours) in Week 13. It is imperative that students attend the practical class for which they are enrolled in Week 13. Attendance records will be taken during these classes. During this time, you will need to use the skills that you have gained throughout the course to analyse the evidence image as required to complete the task outline.

1. COMP 5071 Digital Forensics Essentials Assessment 3
Page 1 of 2
Forensic investigation and reporting: An individual assessment
in the form of a forensic report.
Scenario: Working as a forensic practitioner, you have been
provided with an EnCase evidence image
taken from a suspect’s PC. The specific details of the suspect
are unknown to you at this time, however
you have been made aware that they are suspected of colluding
with another individual to plan a variety
of serious crimes. The motives of the suspect are unknown at
this time.
Task: Your first task will be to analyse the evidence image and
obtain as many details as possible about
the suspect and their actions, particularly in relation to any
crimes they may be planning, or have
already committed, and any accomplices with whom they may
be working. You will conduct the analysis
using EnCase, based on the skills you have gained during this
course. You will need to make case
notes/records for all of the details that you discover during your
analysis for ultimate inclusion in a
forensic report, which is the major deliverable for this
assessment.
Ensure that you clearly identify each of the digital artefacts that
you discover in your forensic report
(e.g. using file paths or other unique IDs) and that you record

2. relevant metadata for each artefact (e.g.
date/time created, last accessed, modified). Artefacts without
supporting metadata will not be
accepted for grading.
The forensic report should conform with the guidelines
specified in Australian Standard 5388.4—2013
Forensic Analysis Part 4: Reporting, with specific focus on
Section 9 – Report Contents. This section will
provide high-level guidance on the structure of your forensic
report. In addition to the structural
guidance provided by AS 5388.4, you must include a
Conclusions section which summarises your key
findings in relation to the case. The word limit for the forensic
report is 2,000 words (+10%).
In addition to the forensic report, you will need to produce a
document which justifies the analysis and
reporting decisions that you have made. This should include a
detailed discussion of the techniques that
you used within EnCase and the associated artefacts located
(referencing the forensic report where
appropriate). It should also include a justification for the
detailed sections included in the forensic report
(beyond those specified by AS 5388.4). The word limit for the
companion document is 1,000 words
(+10%).
Logistics: You will be provided with access to the EnCase
evidence image related to this case for the
duration of your scheduled practical class (~2 hours) in Week
13. It is imperative that students attend
the practical class for which they are enrolled in Week 13.
Attendance records will be taken during
these classes.

3. During this time, you will need to use the skills that you have
gained throughout the course to analyse
the evidence image as required to complete the task outlined
above. You will need to strike a balance
between the width of analysis (i.e. variety of artefacts analysed)
and the depth of analysis (i.e. the
extent to which any individual, or type of, artefact is analysed).
You will need to record (on paper or your own personal device)
specific details for all artefacts that
you will use in your report during the class. You also need to
create a “Bookmark”, within your EnCase
case, of each artefact that you intend to use in your report –
these bookmarks may be used by the
marker.
COMP 5071 Digital Forensics Essentials Assessment 3
Page 2 of 2
The analysis of this image will be conducted as a supervised
activity, with similar conditions to an open
book test (you will not be permitted to talk with others in the
class or remotely during the activity). You
will need to save your completed EnCase case file, including
evidence of all your completed analysis, to
CyberNet. You will no longer be able to access your case file
after the conclusion of your practical
class.
To avoid any issues of academic misconduct, you should avoid
discussing this assessment with other
students after you have completed your analysis. Your forensic
report and companion document will

4. both need to be submitted via LearnOnline by the specified due
date.
The Key Assessment Requirements for this assessment are
provided in the Course Outline.
Rubic_Print_FormatCourse CodeClass CodeAssignment
TitleTotal PointsSEC-540SEC-540-O500Integrating Literacy
Article60.0CriteriaPercentageNo Submission
(0.00%)Insufficient (69.00%)Approaching (74.00%)Acceptable
(87.00%)Target (100.00%)CommentsPoints
EarnedCriteria100.0%Interdisciplinary Literacy
Definition25.0%Not addressed.Article inadequately defines
interdisciplinary literacy and fluency as related to contemporary
education.Article minimally defines interdisciplinary literacy
and fluency as related to contemporary education.Article clearly
defines interdisciplinary literacy and fluency as related to
contemporary education.Article skillfully defines
interdisciplinary literacy and fluency as related to contemporary
education.Overview of Key Theories25.0%Not
addressed.Article inaccurately explains the theories related to
reading and writing processes and development.Article vaguely
explains theories and/or does not explain three theories related
to reading and writing processes and development.Article
logically explains three theories related to reading and writing
processes and development.The presentation skilfully and
concisely explains how literacy across content areas supports
understanding of each discipline.Explanation of Historically
Shared Knowledge Base25.0%Not addressed.Article
unconvincingly explains how cross-disciplinary instruction
supports the historically shared knowledge base of literacy in
all content areas.Article marginally explains how cross-
disciplinary instruction supports the historically shared
knowledge base of literacy in all content areas.Article
reasonably explains how cross-disciplinary instruction supports

5. the historically shared knowledge base of literacy in all content
areas.Article comprehensively explains how cross-disciplinary
instruction supports the historically shared knowledge base of
literacy in all content areas.Organization5.0%Not addressed.An
attempt is made to organize the content, but the sequence is
indiscernible. The ideas presented are compartmentalized; may
not relate to each other.The content may not be adequately
organized even though it provides the audience with a sense of
the main idea.The content is logically organized. The ideas
presented relate to each other. The content provides the
audience with a clear sense of the main idea.The content is
wellorganized and logical. There is a sequential progression of
ideas related to each other. The content is presented as a
cohesive unit. Provides the audience with a clear sense of the
main idea.Research5.0%Not addressed.Sources provided do not
support the claims of article or are not credible.Submission
includes only 1-2 sources, sources broadly support claims, or
some sources are not credible.Research is relevant and supports
the information presented. All of the criteria stated in the
assignment are addressed.Research strongly supports the
information presented. Sources are timely, distinctive and
clearly address all of the criteria stated in the
assignment.Documentation of Sources (citations, footnotes,
references, bibliography, etc., as appropriate to assignment and
style)5.0%Not addressed.Documentation of sources is
inconsistent or incorrect, as appropriate to assignment and style,
with numerous formatting errors.Sources are documented, as
appropriate to assignment and style, although several minor
formatting errors are present.Sources are documented, as
appropriate to assignment and style, and format is mostly
correct.Sources are documented completely and correctly, as
appropriate to assignment and style, and format is free of
error.Mechanics of Writing (includes spelling, punctuation,
grammar, language use)10.0%Not addressed.Surface errors are
pervasive enough that they impede communication of meaning.
Inappropriate word choice or sentence construction are

6. used.Submission includes mechanical errors, but they do not
hinder comprehension. Effective sentence structures are used, as
well as some practice and content-related language.Submission
is largely free of mechanical errors, although a few are present.
A variety of effective sentence structures and figures of speech
are used, as well as appropriate practice and content-related
language.Submission is virtually free of mechanical errors.
Word choice reflects well-developed use of practice and
content-related language. Sentence structures are varied and
engaging.Total Weightage100%