Computer Forensics Case Projects Chapter 2
Case Project 2-1 * Receive the equipment from the Seattle Police Department with the chain of custody form * Enter my company information on form and secure the evidence * Request statements from officers on the condition of the computer on time of raid * Request a list of keywords to search * Transport Gateway computer to our secured forensics lab * Prepare a forensics workstation specifically for this case * Make two images of hard drive using two different tools * Examine drives for evidence by running keyword searches and checking URL’s for Internet searches. * Search registry for keywords * Identify specialty applications * Organize and consolidate in file and folders all recovered data from evidence
Case Project 2-2
I need to determine whether an investigation is necessary. First, I will advise Jonathan to interview the other person who has access to the company accounting program, then review the company computer and the accounting program and see any relevant documents, including the company checkbook and ledger, and contact the bank for a current bank statement, any information about the check, if it has cleared and the amount. He needs to locate itemized details of the subcontractor’s job amounting to $10,750 and the facts of the check for the amount $12,750. He needs to find the facts of the $2,000 difference, if available by comparing bank statements, the accounting program, etc. I will advise him to be mindful that any information may eventually be evidence in a criminal case of employee theft/embezzlement. If his suspicions are immediate that a crime, not just an accounting error, has taken place, I would advise him to allow my investigation company to step in at the beginning.
Case Project 2-3
The former employee should be asked if she has every shared her password with anyone or written it down for someone else to find? Has anyone ever used her computer at work or remotely? Has she ever received
Case Project 2-2
I need to determine whether an investigation is necessary. First, I will advise Jonathan to interview the other person who has access to the company accounting program, then review the company computer and the accounting program and see any relevant documents, including the company checkbook and ledger, and contact the bank for a current bank statement, any information about the check, if it has cleared and the amount. He needs to locate itemized details of the subcontractor’s job amounting to $10,750 and the facts of the check for the amount $12,750. He needs to find the facts of the $2,000 difference, if available by comparing bank statements, the accounting program, etc. I will advise him to be mindful that any information may eventually be evidence in a criminal case of employee theft/embezzlement. If his suspicions are immediate that a crime, not just an accounting error, has taken place, I would advise him to allow my investigation company to step in at the beginning.
Case Project 2-3
The former employee should be asked if she has every shared her password with anyone or written it down for someone else to find? Has anyone ever used her computer at work or remotely? Has she ever received