For the purpose of this second Project, you are still the Data Security Analyst for Allied Technology Systems. Consider this project a continuation of the work you performed in Project #1. In this portion of the investigation, you are ONLY collecting the physical evidence, documenting and reporting. You will NOT be handling the digital data during this stage of the investigation. (This step will be discussed in the Final Project.) You should limit your “care and handling” of each piece of evidence to the physical handling of the digital item/container.
With the scenario in mind, you are to write a report to your supervisor, thoroughly providing a response to the following questions (in paragraph format, properly citing outside research, where appropriate) to both Part I and Part II of the project:
Part I: Overview/Case Summary
1. Write a short summary of the incident that has occurred and establish what permissions/authorities you have before you search Mr. Jackson’s former Company work area.
Part II: Physical Evidence Acquisition:
2. Look at the photo of Mr. Jackson’s work area. (See file attachment Work_Area.jpg) Identify three (3) potential items of digital evidence you see in the photo.
• For EACH item of digital evidence you identified, describe the steps that would be taken to collect the items (with emphasis on the care and handling of each item consistent with digital forensic best practices described in the module content/weekly readings) at the scene. You should document these steps in a detailed way that will mitigate questions, concerns, or a basic lack of information that will call your processes into question in court.
• Also for EACH item you identified, explain what potential use the item would be within the investigation (e.g., what type of data that item might hold, and what kind of evidence represents for prosecution.)
3. Look at the photo of Mr. Jackson’s work area. (See file attachment Work_Area.jpg) Identify three (3) potential items of non-digital evidence you see in the photo.
• For EACH item of non-digital evidence you identified, describe the steps that would be taken to collect the items (with emphasis on the care and handling of each item consistent with digital forensic best practices described in the module content/weekly readings) at the scene. You should document these steps in a detailed way that will mitigate questions, concerns, or a basic lack of information that will call your processes into question in court.
