Using Encase 8.11 investigate and analyse image file that contains evidence items supporting a particular case scenario – it is your job to examine this image file for evidential artefacts, and to build a picture of the case scenario. (Different forensic tools  should be used in some parts of the investigation)

Case Scenario

Case Name: SugaRisker Case
Suspect: SugaRisker

After an increase in the amount of sugar related deaths, and a surge in obesity rates, the Government  wrote into statute that Sugar Drinks are made to be illegal. Due to most of the population drinking these kinds of drinks on a regular basis, an uproar rose with many protesting on the streets. The Government was able to deal with this and put the protesters down. The active protest has died down. However, a dark market has begun for the sale of sugar drinks . There has been a particular rise in the Cwmbran area. An individual who goes by the alias of SugaRisker has been suspected of selling sugar drinks. His computer has been seized and needs investigating.

A detailed study, which includes:

1. A summary of what happened, based upon the results of your investigation, between 500 -1000 words

2. The provenance of each evidential artefact you have identified, using the submission form found in Appendix A, (attached below)

This provenance should be generated automatically using the report template feature in EnCase 8.

You must include the fields indicated in the template form in Appendix A of this document. 

You should not include artefacts which are irrelevant to the case

3. A map of how the evidential artefacts link together,

This map should concentrate upon evidence items, not the process by which they were found.  It should clearly show the links between evidence items (eg a password, which opens an encrypted document).
It should make good use of colour and layout to make the map easy to understand. 

4. Your contemporaneous analysis notes in Appendix B(attached below).
these should be sufficiently detailed

i can’t upload the image file on the website because it exceeds the the limit so i will have to send it using a different method