computer forensics by using AccessData FTK imger 3.1.2.0 - or ProDiscover Basic

Task 1 Scenario: Investigating ex-employee accessing confidential information As a computer forensics investigator working for a company, you have been approached by the Legal department to examine a USB drive that belongs to an employee who has been made redundant. The Legal department is concerned that the former employee was not happy when she left and suspected she might have accessed sensitive company data about an account number, 461562, belongs to a senior director and is used to access the company’s banking services over the internet. The drive could contain some other confidential documents with the text ‘book’. Legal department wants you to identify any occurrences of the account number and the word ‘book’ located on the drive. You would use ProDiscover Basic/FTK Imager tool as though to obtain a bit stream image, document these steps as part of the data acquisition, however, the image file is provided for you and named CorporateCase1.dd. You could use ProDiscover Basic or FTK Access to analyse the image and obtain any evidence, and generate the report. Task 2 Search and Report Criminal/Civil Case/s Search the Internet for published cases, criminal or civil, that have digital forensics element/s. You may list three cases or more, put that in a table. However, you are required to select one of them and report it in detail, any information you could gather about it from other links, sources. Your report will comprise the following: A case summary, relevant details, computer forensics element, and outcome of the case; then critique the case from computer forensics perspective. For example: how did they acquire the data, did they follow the right procedure, have they obtained the adequate search warrant, how did they validate the data, what were their findings, how did computer forensics contribute, positive or negative way, into the case’s outcome. For example, computer forensics helped find sufficient evidence to incriminate the ‘Person of interest’. Alternatively, computer forensics examiner did not follow adequate procedure in acquiring the data or failed to maintain the evidence ‘chain of custody’ that rendered the evidence inadmissible.