EGT1 Task 3

The hard drive is extremely hard to “break into” to view the contents. There is no real easy way to access the information and the investigative options then become very limited.

“In 2003, two students from MIT bought 158 used and formatted disk drives from a wide variety of locations. From there they were able to extract over 5,000 credit card numbers, secret corporate financial information, detailed personal and medical information, along with many gigabytes of personal emails and pornography” (Sherweb, 2010, para 2). Computer forensic tools are used to find out and analyzing available, deleted, or hidden information that may be used for evidence in a legal matter. These forensic tools allows the user to uncover potential evidence that someone else does not want to be discovered. This

I also believe you have to become aware of other people's feelings and emotions to be able to communicate empathy, as well as other emotions. Many people don’t try to relate to others because they feel they should put their focus on doing their job. You have to be able to show people that you understand what they are going through. We have to learn how to put away our thoughts and feelings and pay more attention to the feelings of others. The company will not be able to function properly as a team if they do not have an understanding of how to relate to the emotions of others.

I will approach the process of exploring more technologically advanced and interactive toys within the American Girl core brand by pulling a team of people to complete the strategic planning process (Ferrell & Hartline, 2014). A strategic plan is a roadmap to grow your business (Lavinsky, 2013). The roadmap will detail what it will take the implement the new technology and interactive product (Ferrell & Hartline, 2014). The team will explore the new technologies and understand the current status of interactive toys that the Mattel has had success with and the pain points. This will help the team understand what works and what has not worked. Research and analysis will be performed to understand the new technologically that is available

As lead forensic investigator for XYZ, Inc., my first task in planning to process the potential crime/incident scene at HCC Partners in Life, is how to collect computers involved in the incident scene methodically and thoroughly. First and foremost, I would attempt to ascertain the type of case I am investigating. In this instance, I know that there is a possible breach in the medical records system at HCC. I would need to talk to employees involved in the incident and ask questions. For instance, I would need to know if police (and hopefully not their Information Technology (IT) department) taken custody of any computers,

Cash Budget is the evaluation of cash influx and efflux of a business for a particular period of time.

When our unit arrived at this residency, we knew exactly what kind of evidence we were searching for because the local court gave us a warrant which gave us the permission to investigate all computer belonging possessed, conducted, or governed by the suspect. So, as we conducted our more thorough search, we observed and obtained numerous hard drives, laptops, thumb drives, and related data storage systems, as well as associated hardware which contained thousands of images and videos involving child pornographic content. We proceeded to photograph each one of these pieces of evidence exactly where we found them. We took medium range, as well as close-up pictures of this evidence and added them to our detailed sketch of the crime scene. We were extra cautious and even had another crime scene investigator within our department videotape our walk-through to help record and narrate our time-line, as well. Once all of the evidence was photographed, documented and sketched properly according to procedural standards, our unit then began to correctly mark and package it. It is very important that this step is done during any kind of investigation because if it is not completed, the evidence obtained is virtually useless. The computers we located were connected to a network and turned on, so we photographed what was on the screen first and then unplugged the power cord from the back of the tower. If computers are not unplugged the correct way, then the unit risks losing the files that are stored on it which would greatly impact the case (U.S Department of Homeland Security, N/A). Anyway, once we unplugged it, we placed labels upon all of the other cords before we disconnected all of them, so we knew how to plug them back in later. We placed the equipment in packaging marked as “fragile” and made sure to keep all of it away from any kind of damaging elements including martinets and radio transmitters. We continued to

Principal Brady and Allen Jones, it district’s IT employee, would be notified about the computer being shut down and turned back on. If Mr. Wilkens’ asked why the computer was not as he left it, then Principal Brady and Mr. Jones could tell him an update probably occurred which required a computer reboot. Also, a request would be made for Mr. Jones to allow the investigator to capture any emails or files which Mr. Wilkens would have access to on the server onto a clean hard drive. Mr. Jones may be asked to assist with any database or other data capture which is beyond the knowledge level of the

Prior to transporting the electronic devices to our facility, each device will be placed in a numbered, tamper-evident, faraday bag, and clearly labeled with identifying information, and a photograph to document where and how the device was found. Interviews with all individuals who may hold information relevant to the device, and the information found on the device (including device users, device owners and any related IT administrators) will be carried out in person, at the _____________ county police station, in the presence of an officer assigned to the

This certification validates both cloud computing and virtualization skills (Tittel & Kyle, 2016). Our mobile device specialist has a bachelor’s degree in information technology, five years of professional experience, and holds a CompTIA Mobility+ certification. This specialist knows how to carefully extract data from mobile devices. Our computer forensic examiner has a bachelor’s degree in digital forensics, seven years professional experience, and has an AccessData (ACE) certification. The ACE demonstrates this examiner’s proficiency with Forensic Toolkit technology. All of our analysts are trained to secure, document, and transport evidence as well as properly store the digital evidence in order to maintain its integrity and prepare scientific reports on their

This manual is to assist forensic technicians who may be responsible for preserving electronic crime scene and recognizing, collecting, preserving, and storing digital evidence. When dealing with digital evidence, these principles apply: The process of collecting, securing, and transporting digital evidence should not change the evidence in anyway. Only trained forensic technicians specifically for digital evidence should conduct the analysis. Everything done during the search, seizure, transportation and the storage of the digital evidence should be documented, preserved and ready for review.

Acquisition. Due to digital evidence’s fragile state, investigators should be aware that it is easily altered, damaged, or deleted by improper handling of the evidence. Examination best practices are conducted on a copy of the original evidence. The original evidence should be secured in a way that would protect a preserve the evidence in its original unaltered state.

Patrol officers are often called upon to seize a computer for analysis. It is essential that all patrol officers know how to properly seize a computer.

I began with wiping all data i felt would be reasonable in the case investigation, storing this information under a character in which was easy to be accessed. I made sure to have any sort of extra storage such as CD’s, floppy disks, USB drives. In my process I made photo copies of all suspicious data, and video taped them as a found them. I video taped the files I found in order to show proof during court that my findings were not tainted with by purpose. Once I have wiped the hard drive, I then prepared mine and the suspects computer for a disk to image copy. It is very important during the copying process that I shut down systems one by one except the hard drive. I insure the hard drive does not reboot. Through a reboot of the hard drive I can lose important information if it is damaged by a running file that is shut down. Afterwords I shut down the computer and physically remove the hard drive. When I finish removing the drive, I can now restart the computer and change boot settings so that all data will be booted into my floppy disk or CD. Noting the boot process including timing, and date, plus removal of hard drive I can insure to the court that I could have not caused any data damage through a hard drive

Computer forensics is the practice of accessing sensitive data from technology to utilize within private and criminal investigations. Experienced computer forensics workers work with police to verify and validate evidence for court cases. This part of the investigation must always be done with care and in a precise and professional manner as the evidence must be admissible and useful in the court of law. In this scenario I would follow the below procedures for the investigation and compilation of information.