WGU D829 Digital Forensics Complete
Incident Report | Unauthorized Activity
Analysis
A. Introduction
1. Purpose:
The purpose of this incident report is to understand the extent to which
unauthorized activity and tampering of critical files have occurred at ABC
Tech after suspicious activity was detected, all while staying within the
boundaries of legal and ethical frameworks.
2. Scope and objectives of the investigation:
The scope of the investigation includes obtaining specific user file paths,
event logs, and browser history. Which can be recovered from specific files or
deleted data that can also be affected by the timeframe of malicious activity.
The objectives of the investigation include recovering evidence to determine
whether it was malevolently destroyed or hidden. Tracing the user activity
throughout browser cookies and behavior for unauthorized actions. Analyzing
event logs for unusual activity. Finally, present the findings in a format for
ABC Tech to potentially present to stakeholders for potential disciplinary
actions.
3. Tools and methodologies used:
The tools used during the investigation included the FTK Imager, a “digital
forensics tool for creating forensic images of hard drives, partitions, and
files” (ZyBooks, n.d.). This aids in the methodology of specialists handling
the original data as little as possible. Creating backups is crucial to ensuring
the data is the least volatile as possible. The chain of custody also applies to
an investigation to make sure the integrity of the data is not compromised
and is admissible in legal proceedings. The second tool that was used is
Autopsy 4.22.0, which is “an open-source digital forensics tool for analyzing
digital forensics files” (ZyBooks, n.d.). Windows PowerShell was also used to
verify that no changes occurred to the image during analysis.
,B. Legal and Regulatory Framework
1. Applicable laws and regulations:
,An internal breach is a high-risk event because it can affect not only the
company but also its consumers and employees. A law that applies to an
internal breach investigation is the California Consumer Privacy Act (CCPA).
This law gives residents of the state of California rights over their personal
data (California Consumer Privacy Act (CCPA), 2025), which means
companies must be diligent about balancing the privacy of their data while
documenting the extent of unauthorized access.
Another law that could be at play in an internal breach investigation would
be the Health Insurance Portability and Accountability Act (HIPAA).
Specifically, the affected company should notify of a breach and the severity
of the compromised data if it includes any protected health information (The
HIPAA Privacy Rule, n.d.).
Like CCPA and HIPAA, the General Data Protection Regulation (GDPR) grants
European citizens a right to their personal data and “data breach
notification… information individuals, organizations, or authorities when a
data breach has occurred, possibly exposing sensitive or personal
information” (ZyBooks, n.d.).
2. Industry standards and best practices:
Discuss applicable forensic standards and best practices guiding the
investigation.
A best practice applicable to guiding the investigation would be to implement
a Chain of Custody, which “refers to the documentation of acquisition,
control, analysis, and disposition of physical and electronic evidence”
(ZyBooks, n.d.).
Building on the previous section on GDPR, as a best practice, investigators
should apply the Principle of Least Privilege (POLP) to prevent unnecessary
data privacy violations.
3. Organizational policies:
A very important organizational policy is the Incident Response Policy (IRP),
which outlines how the company's incident response team should respond in
the event of an incident, such as a breach. It lays out the roles of people
involved in the response and a structured approach to prepare for, detect,
contain, eradicate, and recover from threats while ensuring regulatory
, compliance (What Is an Incident Response Policy and How to Create One,
n.d).
In addition to the GDPR and POLP best practices, a Privacy Policy for the
company's employees would be important to implement to ensure
compliance with laws like GDPR and to prevent employees from accessing
personal data that is not necessary for the investigation.
The Acceptable Use Policy (AUP) authorizes organizations' legal right to
monitor, log, and audit all activities on their systems. It ensures the data
needed for these investigations is acquirable.
4. Evidence handling and hash verification:
A significant requirement for evidence handling involves the chain of
custody, which ensures the integrity of the data. More specifically, it “tracks
the movement of evidence through the evidence’s collection, preservation,
and analysis” (ZyBooks, n.d.).
Verifying an image's integrity through hash verification is crucial to detecting
any malicious activity. To aid in the integrity of digital evidence, both
cryptographic hash functions and checksums are used. A cryptographic hash
function is a function which “maps a variable-length string, or message, to a
fixed-size value, or message digest” (ZyBooks, n.d.). These hashes are used
to verify digital signatures and message authentication codes on evidence.
Hashing is collision-resistant, meaning that a piece of digital evidence can be
modified to produce the same checksum as the original data. Checksums, on
the other hand, are used to detect errors in data transmission and storage.
With all three cryptographic hash functions, checksums, and chain of custody
we can establish evidence integrity by non-repudiation. Ensuring we can
keep a record of all actions on the digital evidence and that no evidence is
accidentally or intentionally changed during the process.
C. Forensic Process – Autopsy Case Creation
1. Launch Autopsy.
Incident Report | Unauthorized Activity
Analysis
A. Introduction
1. Purpose:
The purpose of this incident report is to understand the extent to which
unauthorized activity and tampering of critical files have occurred at ABC
Tech after suspicious activity was detected, all while staying within the
boundaries of legal and ethical frameworks.
2. Scope and objectives of the investigation:
The scope of the investigation includes obtaining specific user file paths,
event logs, and browser history. Which can be recovered from specific files or
deleted data that can also be affected by the timeframe of malicious activity.
The objectives of the investigation include recovering evidence to determine
whether it was malevolently destroyed or hidden. Tracing the user activity
throughout browser cookies and behavior for unauthorized actions. Analyzing
event logs for unusual activity. Finally, present the findings in a format for
ABC Tech to potentially present to stakeholders for potential disciplinary
actions.
3. Tools and methodologies used:
The tools used during the investigation included the FTK Imager, a “digital
forensics tool for creating forensic images of hard drives, partitions, and
files” (ZyBooks, n.d.). This aids in the methodology of specialists handling
the original data as little as possible. Creating backups is crucial to ensuring
the data is the least volatile as possible. The chain of custody also applies to
an investigation to make sure the integrity of the data is not compromised
and is admissible in legal proceedings. The second tool that was used is
Autopsy 4.22.0, which is “an open-source digital forensics tool for analyzing
digital forensics files” (ZyBooks, n.d.). Windows PowerShell was also used to
verify that no changes occurred to the image during analysis.
,B. Legal and Regulatory Framework
1. Applicable laws and regulations:
,An internal breach is a high-risk event because it can affect not only the
company but also its consumers and employees. A law that applies to an
internal breach investigation is the California Consumer Privacy Act (CCPA).
This law gives residents of the state of California rights over their personal
data (California Consumer Privacy Act (CCPA), 2025), which means
companies must be diligent about balancing the privacy of their data while
documenting the extent of unauthorized access.
Another law that could be at play in an internal breach investigation would
be the Health Insurance Portability and Accountability Act (HIPAA).
Specifically, the affected company should notify of a breach and the severity
of the compromised data if it includes any protected health information (The
HIPAA Privacy Rule, n.d.).
Like CCPA and HIPAA, the General Data Protection Regulation (GDPR) grants
European citizens a right to their personal data and “data breach
notification… information individuals, organizations, or authorities when a
data breach has occurred, possibly exposing sensitive or personal
information” (ZyBooks, n.d.).
2. Industry standards and best practices:
Discuss applicable forensic standards and best practices guiding the
investigation.
A best practice applicable to guiding the investigation would be to implement
a Chain of Custody, which “refers to the documentation of acquisition,
control, analysis, and disposition of physical and electronic evidence”
(ZyBooks, n.d.).
Building on the previous section on GDPR, as a best practice, investigators
should apply the Principle of Least Privilege (POLP) to prevent unnecessary
data privacy violations.
3. Organizational policies:
A very important organizational policy is the Incident Response Policy (IRP),
which outlines how the company's incident response team should respond in
the event of an incident, such as a breach. It lays out the roles of people
involved in the response and a structured approach to prepare for, detect,
contain, eradicate, and recover from threats while ensuring regulatory
, compliance (What Is an Incident Response Policy and How to Create One,
n.d).
In addition to the GDPR and POLP best practices, a Privacy Policy for the
company's employees would be important to implement to ensure
compliance with laws like GDPR and to prevent employees from accessing
personal data that is not necessary for the investigation.
The Acceptable Use Policy (AUP) authorizes organizations' legal right to
monitor, log, and audit all activities on their systems. It ensures the data
needed for these investigations is acquirable.
4. Evidence handling and hash verification:
A significant requirement for evidence handling involves the chain of
custody, which ensures the integrity of the data. More specifically, it “tracks
the movement of evidence through the evidence’s collection, preservation,
and analysis” (ZyBooks, n.d.).
Verifying an image's integrity through hash verification is crucial to detecting
any malicious activity. To aid in the integrity of digital evidence, both
cryptographic hash functions and checksums are used. A cryptographic hash
function is a function which “maps a variable-length string, or message, to a
fixed-size value, or message digest” (ZyBooks, n.d.). These hashes are used
to verify digital signatures and message authentication codes on evidence.
Hashing is collision-resistant, meaning that a piece of digital evidence can be
modified to produce the same checksum as the original data. Checksums, on
the other hand, are used to detect errors in data transmission and storage.
With all three cryptographic hash functions, checksums, and chain of custody
we can establish evidence integrity by non-repudiation. Ensuring we can
keep a record of all actions on the digital evidence and that no evidence is
accidentally or intentionally changed during the process.
C. Forensic Process – Autopsy Case Creation
1. Launch Autopsy.
