Case Facts:
A female employee, sales representative, has alleged that another employee, Robert, also a sales representative, has harassed her.
This employee showed the Human Resources Department 3 messages that were sent to her.
She had been contacted on her private email, by Robert, who became increasingly aggressive and eventually showed up in a coffee shop while she was with a friend.

Your Job:

As part of the investigation into the allegation, Robert’s cubicle was searched and a USB  flash drive was found, forensically imaged and handled to you.
You have the image file: flowergirl.img.
MD5 of img file = 338ecf17b7fc85bbb2d5ae2bbc729dd5
Your job is to analyze it. As you can see this assignment is about “investigating a case.  You have to think critically and evaluate the merits of different possibilities applying your knowledge what you have learned so far and going to learn in next two weeks. Please note there is no step of by step by direction. As you can see providing a direction will kill the investigation. However, I am happy to supervise this projects. So there is a Discussion Board forum, I enjoy seeing students develop their skills in critical thinking and the expression of their own ideas. Project work naturally leads into argument, whether that’s about the interpretation of data or the validity of a philosophical viewpoint. But remember this is Digital Forensics we need clear evidence not just raw data.

Your Report:
You should answer the following questions: 

What did you find on the flash drive (what files? In what condition?).
What actions did you take to analyze?
In your opinion, did he harass her or not? Explain why and how you arrived to this conclusion! What did he do?
Why was this case called the flower girl?
Address the following questions in your report:

What did you find on the flash drive? A list of all files contained on the drive and their state  and (deleted, not deleted, hidden). List everything including the volume.
Explanation of the findings:  What did you actually do to make the findings into an evidence? What actions did you take to analyze? For example: Finding ten bottles of Coke in one’s table is not enough to conclude that one  had all of them. But if you taste the caffeine level in the blood, that might help to conclude. 
A time line of events. Extremely important – This will lead the investigation. 
A brief explanation of why the case was called “Flower Girl”? A list of names of people involved. You need to be very careful with this part. Just because you find word ” flower girl” somewhere in the image does not prove that it is related to your case.  You need to make it an evidence. 
 Your personal verdict on whether the suspect is guilty or not, and why. (This is the Fun part, just concluding the case. Remember you are stepping into the Administration of justice area and this is not a Forensic Analyst’s job) .
Your analysis should not be more than 10-12 pages including the screen captures. Your analysis should be supported by appropriate screen captures!  NO points will be given without appropriate screen capture of your analysis. 
All screen captures must accompany a date stamp.  Inside the project report,