Explain the reasons why computer forensics is performed. (Explain uses of computer forensics giving examples.)
Describe what you feel are the three best uses of computer forensics. Give reasons for your choices.
Identify e-evidence and physical evidence.
With the increasing use of technology, e-evidence has become an integral part of evidence collection. As a Forensics practitioner we read many articles related to cyber fraud and cybercrimes. Use the Internet to find an article that discusses a crime or investigation (e.g., fraud or misconduct) that involved e-evidence (e.g., email, instant messages, electronic records, GPS, cell phone records, postings in MySpace, etc.). List the date, title, and full URL of the article. Ensure that the link works for the article. Do not use proprietary sources or those that require registration.
Respond to the following:
What was the crime or the reason for the investigation?
What types of e-evidence were involved and why?
What were the outcomes?
Were there any attempts to destroy or alter the e-evidence?
Was there any physical evidence?
Was a crime committed? Why or why not?
(5 points) Identify the requirements for acquiring and authenticating evidence.
Different kinds of cases go through different processes. It is important that the investigator manage e-evidence throughout this process. Consider the dos and donts of managing e-evidence and respond to the following:
Explain how to manage e-evidence throughout the life-cycle of a case so that it is admissible in court or that it can be used for legal action. List two reasons why e-evidence might be inadmissible.
Describe acceptable methods for searching and analyzing evidence.
Explain the ethical and legal implications regarding how evidence is gathered and analyzed.
Archived and Temp Data
Discuss how archived/temp data can be obtained when collecting e-evidence.
Discuss at least 3 methods that can be used to hide data and three approaches to recovering that hidden data.
How does the boot process differ between UNIX, Macintosh, and Windows systems?
Discuss some of the content found within an email header that can be useful in an investigation.
Discuss at least 3 challenges associated with performing a forensics investigation on a mobile device.
What are the basic guidelines to identify steganography files?
Discuss the role that volatility plays in a digital forensics investigation. What would be the most volatile data?
What are the Federal Rules of Evidence? Can computer log files be admissible as evidence?
Discuss what a Chain of Custody is and its import to evidence presented in court.
Discuss some challenges to performing computer forensics on cloud-based systems.
