Digital Forensics COMP3445/COMP6445/COMP6845 26T3

Extension for Report 2 due date

Posted by Arash Shaghaghi 🎓 Wednesday 28 October 2026, 12:18:18 PM.

Dear All,

The due date for Report 2 has been extended to 4th of Nov at 11:59 PM.

Best,
Arash

Welcome to Week 7

Posted by Andrew Wong 🐻 Monday 26 October 2026, 09:13:27 PM.

Your tutors have marked your m57biz Expert Witness reports, marks (and individual feedback) will be released soon.

A document outlining common feedback is available here: Digital Forensics 2026 T3 - Report 1 Feedback.
Please spend some time to review the feedback, and apply any changes to your Caelus Engineering investigation where applicable. Your tutor will go over this document during your tutorial as well, so that you can ask questions.

Note: Marks for Report 1 are primarily allocated to the discovery and analysis of artifacts and evidence, as per the task document. Hence, the presentation of Report 1 is not heavily weighed. Report 2 however expects that any feedback given is applied.

This week's timeline

• Monday - New artifacts for Caelus Engineering (Report 2)
• Tuesday (or Wednesday) - Release of marks for m57biz (Report 1)
• Tuesday - Week 7 wargames released

[IMPORTANT] Caelus Engineering - You've got mail

Posted by Andrew Wong 🐻 Monday 26 October 2026, 09:01:03 PM, last modified Tuesday 27 October 2026, 12:24:22 AM.

To: interns@jimsforensics.com
From: emma@jimsforensics.com
CC: jim@jimsforensics.com
Date: 26th October 2026
Subject: RE: RE: Caelus
Attachment: 📎 Updated Letter of Instruction.pdf

Hi interns!

Some of you have informed us that you've seen some data exfiltration happening.
We've let Penelope Legal know of those findings, and they have managed to provide more files from Caelus Engineering.
They've also provided an Updated Letter of Instruction

New files

• Office gate logs for the 4th September 2020
  • 4Sep2020-securigate-logs-utc.jsonl (note: this appears to be in UTC time)
  • SHA256: 38d1d5a5f55c684ecf5333327e826e28d6f0e06528448e3b4e4ae3ea262c7fd5
• A network packet capture file (~12GB)
  • network_log.pcap.7z
  • SHA256: debe9dfb2f06803e12766364f586175ef270f4dc0309f211426ea0d635251397

Our lead investigator suggested checking and confirming if the network packet capture actually related to the machine that was recovered.

Thanks all!
Emma

Monday Lecture

Posted by Arash Shaghaghi 🎓 Friday 23 October 2026, 12:59:44 PM.

Dear All,

We are hosting Song Fang for Monday's lecture at 6 PM. He is a Senior Security Engineer on Atlassian's Incident Response team. He has also worked at Optus and CommBank. Best of all? He's a UNSW graduate and was a student in this course in T3 of 2019.

In preparation for the lecture, he is asking the students to read this page for a general overview of Incident Response: https://www.atlassian.com/trust/security/security-incident-management

He is asking you to try to analyse the information for the following cases from an incident responder's perspective. Don't focus only on the technical details of vulerabilities /exploits. Consider what needs to be done holistically to triage, respond and remediate the scenario.

- https://www.securityweek.com/atlassian-investigating-security-breach-after-hackers-leak-data/

- https://www.php.net/archive/2026.php#2026-10-21-5 and https://www.php.net/archive/2026.php#2026-10-20-1

I hope many of you will join the lecture in person. This will surely be interesting for everyone.

Arash