Lab 4 Creating a Forensic System Case File for Analyzing Forensic Evidence - Ch6 PDF

Preview

Summary

Download Lab 4 Creating a Forensic System Case File for Analyzing Forensic Evidence - Ch6 PDF

Description

Assessment Worksheet Creating a Forensic System Case File for Analyzing Forensic Evidence Course Name and Number:

ITN 276

Student Name: Instructor Name:

Michael Caravello

Lab Due Date:

Overview In this lab, you used P2 Commander to investigate an image of a hard drive to find forensic evidence without impacting the integrity of the data on the image. You created an electronic case file showing the creation of a case, the addition of the evidence file provided to you, and you saved the case for later review. In this way, you experienced all of the steps necessary for a sound forensic investigation that will preserve the source and ensure that the evidence is defensible and presentable in a court of law.

Lab Assessment Questions & Answers 1. What is the main purpose of a forensic analysis?

To analyze data in order to find evidence supporting a case. 2. What is the purpose of Paraben’s P2 Commander?

To completely analyze a hard drive and internet browser history and present for investigator analysis. 3. Describe how the P2 Commander helps protect the chain of custody process.

P2 Commander automatically creates a chain of custody logger showing all access and actions pertaining to the case file.

Copyright © 2014 by Jones & Bartlett Learning, LLC, an Ascend Learning Company. All rights reserved.

www.jblearning.com

Student Lab Manual

4. Explain why it is a good idea to make an image or copy of the targeted image when

conducting a forensic case analysis. A copy is taken to prevent change or irreparable damage to the original drive during analysis. Also allow investigators to make numerous copies of the original without fear of cross contamination during tests. 5. Describe in your own words why it is so important to properly document and create

cases to house all the relevant forensic information pertaining to an investigation. In order to prosecute criminals, the evidence against them needs to be strong. Lack of documentation and gaps in the chain of custody severely weakens the evidence. Experienced lawyers will exploit the weaknesses and seek to either expunge the evidence or to dismiss the case. The end result will most likely be the criminal walking free. Alternatively, if not properly documented, the cases could become switched resulting in the wrongful conviction of a defendant.

Copyright © 2014 by Jones & Bartlett Learning, LLC, an Ascend Learning Company. All rights reserved.

www.jblearning.com

Student Lab Manual...