Digital Forensics Investigation

Context

A self-reported Lambton College academic investigation of a simulated corporate security breach. The original report has not been inspected for this portfolio.

Investigation scope

The project connected acquisition and analysis with a defensible incident narrative.

• Digital evidence acquisition and forensic examination
• Security log analysis and incident timeline reconstruction
• Root-cause investigation
• Technical reporting and remediation recommendations

Reported deliverable

Approximately 4,000 words documenting methodology, findings and recommendations. No real corporate breach or undisclosed client is implied.

The analytical thread

Acquisition, examination and reconstruction address different questions: what was preserved, what it reveals, and how the events relate. A useful report must connect its conclusions to the evidence and make its limitations understandable.

From an academic case to an ongoing question

The connection to Ganesh’s current research is the quality of the material available to an investigator. The academic case explores examination; the ongoing research asks what happens to evidence before examination begins.