COMP11082 Incident Response Coursework 2 SCQF Level 11 2025/26

COMP11082  CW2

• Answer ALL questions.
• Use the answer booklet to submit your answers. 
• It is your responsibility that the answer sheet you submit is readable and that all answers are marked with the corresponding question number.
• Submit your answer booklets via Turnitin submission point.
• The following file formats are accepted: .docx, .pdf.
• You may use any resources you find helpful. 
• Software tools can be downloaded from here.
• Lab machines or Home machines can be used to carry out the tasks.
• Using AI tools to answer the questions will result in failing the assessment. 
• The coursework is worth a TOTAL OF 50 MARKS.

Description:

You are outsourced by an organisation and entrusted with the investigation as part of the incident response activity of the said organisation.

Perform a thorough analysis of Disk images, Memory Dumps and recorded Network activities presented to you. You can find the evidence sent to you stored at this link.

Present your findings as a report containing the following chapters with a cover page:    

Instructions and hints: 

1. This task is to be presented as a report
2. The report will be graded based on the following:    

Section 1: Memory Analysis (15%)

• Choose one if more than one is available, and specify which evidence you used

Section 2: Disk Image Analysis (15%)

• Choose one if more than one is available, and specify which evidence you used

Section 3: Network Analysis (15%)

• Load the .ova file in VirtualBox software and perform the investigation.
  Styling, Structuring and referencing (5%)

3.  The report should not be more than 10 pages including references and any other appendices.

Marking Rubric for 15-mark questions: