411

411

W1-2 Computer Crime

Have you heard of computer evidence being used to convict a criminal for a crime that was not directly related to a digital crime? If so, please explain the situation. If not, provide an example of when computer evidence might be used to convict someone of a non-digital crime. Make sure that your example is not similar to the responses of others in the class.

W2-1 Forensics Examination Tool

Discuss a forensics examination software tool. What are its strengths and weaknesses? How much does it cost? How hard would it be to set up in a forensics lab?

W2-2 Examining Target Computers

What would be your first five steps when examining a target computer? How would you determine if it should be shut off or not? Are there times when you should leave it connected to the network? Why or why not?

W3-1Disk Acquisition

How would you go about preparing a forensic copy of a disk? Would your procedure change if it was a RAID device? How about if it was a SSD? How would you do it if you were using a Unix or Linux computer?

W3-2 Disk Software Tools

What are some free forensic disk examination tools? How would you set them up on your home computer? Are there disk images on the Internet that you can download to practice on?

W4-1 File Deletion

When a file is deleted is it really gone? Why or why not? If not how would you go about really deleting a file? Are there tools for this? How could you do it without using a tool?

W4-2 File Systems What are some common file systems in use today? How are they alike? How do they differ? Are different forensic approaches needed for each? Why or why not?

W5-1 Windows Forensics

Discuss an important concept of Windows architecture found in Chapter 8 of the text. Why do you think it is important? How does it impact Windows forensic evaluation?

W5-2 Linux

What do you think the most important Linux command line tools are for Linux forensic evaluations? Why do you think that? How is the tool used?

W6-1 Mac File Systems What file systems would you expect to see on a Mac? What are some of the older ones? What impact do these different file systems have on the forensic examination?

W6-2 Mobile Device Forensics

What are the main operating systems and file systems in mobile computing devices? What are some things the forensic examiner needs to keep in mind regarding mobile device forensic examination?