Computer Forensics

CASE STUDY CHAPTER 4

            You are senior forensics investigator in a corporate firm that handles large financial transactions for a for a variety of customers. The head of Internal auditing has called to request that you perform forensic analysis of an employee's computer. The auditor has found evidence of financial discrepancies but needs you to confirm how financial transactions were done on the compute. The employee is very knowledgeable in both the financial and computer areas and has been with the company for many years

1.      Determine what steps you will follow to begin  the investigation and what questions you might ask the internal auditor.

2.      Considering the expertise of this user, explain how u believe the user may have hidden or masked her actions. Describe what actions you might take to investigate the user's methods.

3.      Assuming you find evidence, describe the steps you would then take to formulate a report and what specific items need to be included in this report.