1. Procedure on How to Validate a New Forensics Software Package.
You are developing a policy and procedure on how to properly verify a new forensics software package. You need to present this new procedure to the Captain over the Computer Forensics Lab.
Compose a PowerPoint presentation, using a minimum of 10 slides, to outline your new policy on the proper procedures for verifying a new forensics software package.
2. Write-blockers
You have been called out to a crime scene where digital media needs to be processed on scene. There is one laptop computer, one IPAD and one external hard drive at the scene. You have both a hardware write-blocker and software write-blocker in your forensic kit. Discuss the major advantages and disadvantages of each type of write-blocker and explain which type you will use on the crime scene.
should be 75 to 150 words, but may go longer depending on the topic.
3. Log Files or Investigation Steps
Hello Class! For this discussion you can choose which question you respond to. Feel free to respond to both, however only one is required. Please respond to one of the following questions:
Question A
Joe Doe just walked out of the building. He is suspected of stealing confidential information from the company. His computer is running. Explain what steps you would take to initiate an investigation of Joe. What evidence would you collect and in what order?
Question B
Discuss log files.
Why are logs files important?
Which Windows log files are important?
How would you find Windows log files?
Which Linux log files are important?
How would you find Linux log files?