IST 454: Computer & Cyber Forensics Lab Evidence

Computer & Cyber Forensics Case Study

Project Summary

#

Overview

#

IST 454 focused on computer and cyber forensics. The available evidence from this course supports a portfolio-safe summary around digital evidence handling, forensic image creation, forensic image mounting, hash verification, registry analysis, deleted file recovery, data carving, and research into AI/IoT forensics.

I do not currently have every original lab submission from this course. Because of that, this page is framed as selected lab evidence, not a complete course archive.

The strongest available evidence includes:

• Windows forensic image creation and mounting
• Kali Linux disk image creation and hashing
• MD5 and SHA256 hash comparison
• read-only image handling
• Windows registry hive recovery and analysis
• SAM, SYSTEM, and NTUSER registry review concepts
• RegRipper usage
• deleted image recovery
• deleted document recovery
• WinHex data carving
• file recovery by type
• group analysis of recovered documents and encrypted file indicators
• research on AI-based cybersecurity and forensics datasets
• discussion of IoT forensics, proprietary data formats, privacy, and investigation challenges

This page summarizes the method, evidence categories, and professional relevance without publishing the raw forensic materials.

Why This Project Matters

#

Digital forensics is one of the clearest bridges between cybersecurity operations and evidence-based investigation.

A useful forensic workflow needs to preserve evidence, maintain integrity, recover relevant artifacts, analyze system state, and communicate findings clearly.

This course supports several cybersecurity capabilities:

• evidence preservation
• forensic acquisition
• image mounting
• hash verification
• read-only analysis discipline
• registry analysis
• user activity review
• deleted file recovery
• data carving
• forensic reporting
• AI/IoT forensic research awareness

This matters for security operations because incidents often require more than alert triage. Analysts may need to understand what happened on a system, what files existed, what was deleted, what devices were connected, what user activity occurred, and whether evidence was handled correctly.

Portfolio-Safe Publishing Approach

#

This page excludes:

• raw forensic images
• mounted disk image contents
• full recovered files
• recovered images or documents
• registry hive files
• exact lab passwords
• private screenshots
• full academic submissions
• private student or team identifiers
• complete forensic reports
• sensitive evidence artifacts

Instead, it presents:

• what the lab work involved
• what forensic concepts were demonstrated
• what tools were used
• what skills the work supports
• why the evidence matters professionally

Evidence-Based Scope

#

Forensic Workflow Map

#

Forensic Imaging Evidence

#

The forensic imaging work demonstrated how evidence should be acquired and validated before analysis.

Key concepts included:

• creating forensic images
• preserving original evidence
• validating evidence integrity with hash values
• comparing MD5 and SHA256 values
• understanding why read-only workflows matter
• mounting images safely
• documenting acquisition and verification steps

This is important because forensic work depends on trust. If evidence integrity cannot be explained, the findings are weaker.

Registry Analysis Evidence

#

The registry analysis work focused on Windows artifacts that can help reconstruct system and user activity.

Evidence areas included:

• SAM hive concepts
• SYSTEM hive concepts
• NTUSER.DAT review
• user profile artifacts
• system configuration artifacts
• registry-based activity indicators
• RegRipper output interpretation
• Registry Viewer usage

Registry analysis matters because Windows systems store important context in the registry. That context can help answer questions about users, devices, system configuration, mounted devices, application activity, and possible compromise indicators.

Data Carving and Deleted File Recovery Evidence

#

The data carving and deleted file recovery work focused on identifying files that were no longer visible through normal file browsing.

The work involved:

• using WinHex-style forensic workflows
• locating recoverable file structures
• recovering deleted image files
• recovering deleted document files
• identifying file types from evidence
• reviewing recovered documents
• considering encrypted or protected file indicators
• documenting recovered evidence categories

This matters because attackers and users may delete files. Deleted files can still be recoverable depending on disk state, overwrite activity, and file-system behavior.

AI and IoT Forensics Research

#

IST 454 also included research-oriented forensic topics involving AI and IoT.

The AI-focused work explored cybersecurity and forensics dataset concerns, including:

• how datasets support research and detection work
• the importance of labeling and context
• the risks of biased or incomplete datasets
• the challenge of applying AI to forensic analysis
• why analyst validation still matters

The IoT-focused work explored forensic challenges involving:

• proprietary device formats
• fragmented evidence sources
• cloud-connected devices
• privacy concerns
• limited logging
• device-specific storage behavior
• multi-source evidence collection

This research angle matters because modern investigations increasingly involve nontraditional evidence sources.

Tools and Techniques Referenced

#

Capability-to-Evidence Map

#

What I Learned

#

Before taking IST 454, I thought digital forensics was mostly about using specialized tools to recover evidence.

What changed my perspective was realizing how much of forensic work revolves around discipline rather than technology.

Creating a forensic image, validating hashes, mounting evidence in a read-only workflow, and documenting every step can feel procedural at first. As the labs became more complex, I began to understand why those procedures matter. If the integrity of the evidence is questioned, the quality of the analysis becomes far less important.

One of the most interesting parts of the course was working with registry artifacts and deleted-file recovery. I was surprised by how much information could still be reconstructed from systems even after files were removed or normal user activity appeared to be gone. It reinforced the idea that systems often retain far more historical context than users realize.

The AI and IoT portions of the course also stood out to me. Traditional forensic workflows assume investigators can access and interpret evidence using known formats and tools. Modern environments are increasingly distributed across cloud platforms, connected devices, proprietary ecosystems, and AI-driven systems. That creates new challenges around evidence collection, ownership, privacy, and interpretation.

The biggest lesson I took away from IST 454 is that digital forensics is not simply about finding artifacts. It is about building confidence in conclusions. Evidence only becomes useful when it can be collected correctly, validated, interpreted carefully, and explained clearly enough for others to trust the results.

That mindset continues to influence how I approach investigations, incident response, vulnerability management, and security operations work today.

Professional Relevance

#

This page is relevant to cybersecurity analyst, incident response, forensic support, security operations, and vulnerability management conversations.

It also supports my ServiceNow SecOps direction because incident and vulnerability workflows rely on evidence quality. Whether the work is a vulnerable item, a security incident, or a forensic artifact, the underlying questions are similar:

• What happened?
• What evidence supports it?
• Who owns the next step?
• What should be remediated?
• How do we validate the outcome?
• What should be documented?

The professional value of this project is the discipline: preserve evidence, validate integrity, recover artifacts, analyze context, and communicate findings clearly.

Difference from CYBER 440

#

CYBER 440 focused on a broader incident response story across network, forensic, memory, log, impact, and remediation evidence.

IST 454 is narrower and more forensic-tool focused. It is about evidence acquisition, evidence integrity, image handling, registry artifacts, deleted file recovery, data carving, and forensic research challenges.

Together, the two pages show complementary skills:

Portfolio-Safe Redaction Notes

#

This case study intentionally excludes:

• raw forensic images
• mounted disk image contents
• recovered files
• recovered screenshots
• registry hive files
• exact lab passwords
• private student or team details
• complete academic reports
• full evidence artifacts
• step-by-step recovery instructions

The goal is to show forensic workflow, evidence handling, and investigation discipline without exposing raw evidence files or private academic materials.

Related Portfolio Areas

#

Next Steps

#

This page could later be expanded with:

• a sanitized forensic workflow diagram
• a hash-verification explanation block
• a registry artifact map
• a deleted-file recovery lifecycle diagram
• a side-by-side comparison of forensic acquisition and incident response workflows

For now, this page serves as the main portfolio-safe summary of selected IST 454 computer and cyber forensics lab evidence.