Computer Forensics

Perform a forensic analysis of the embedded device-based evidence and the network-based evidence (NBE) on the accompanying DVDs. Document your approach and findings in a manner suitable for use in a legal case. Produce an investigation report along with any additional documentation such as an investigation protocol, your notes, chain of custody forms, etc., as you feel is appropriate.
Background to the investigation:
Mr. Samuel Pepys has been sent to Washington, DC, by King Charles to become the Naval Attache at the British Embassy. Mr. Pepys is living just outside Washington, DC, in Maryland.
On or about July 5 th Mr. Samuel Pepys created a NSLU2 music server to allow him to stream music. He built the music server by installing a Debian Linux distribution onto a Linksys NSLU2 embedded Network Attached Storage device, by following the instructions given by Mr. Martin Michlmayr on the website: http://www.cyrius.com/debian/nslu2/ .
On July 6 th while trying to set up the NSLU2 music player Mr. Pepys noticed some unusual activity on the NSLU2. After contacting colleagues on July 7 th Mr. Pepys turned off the NSLU2 and made it available for analysis. Images were made of the NSLU2 USB disk partitions. Mr. Pepys’s home network DNS was configured to map the domain name ” music.from-md.com ” to IP address 192.168.1.90.
It has come to light that Another Government Agency (AGA) has captured network-based evidence while performing surveillance on the internal network of a cybercrime organization.
You have been assigned to work on this investigation by Ambassador. The Ambassador needs your opinions on the following questions:
1. Does the evidence on the Red USB Stick confirm that Mr. Pepys built a music server on July 5th?
2. Was the music server used to play music?
3. Has the NSLU2 been compromised?
If the NSLU2 has been compromised:
4. How was it compromised?
5. What was the goal of those who compromised the NSLU2?
6. Is the network-based evidence related to any compromise of the NSLU2 and what activity does it represent?
Your opinions on these questions should be given in the Investigation Report.