Short Questions

Validation"

• Analyze the purpose of validating forensic data and determine why this is a necessary component of the investigation and analysis process.

• As a system forensics manager, justify the importance of validation and determine the best method to use.

   

  Graphic File Evidence
  
  

• Evaluate the importance of graphic files to a digital investigation. Provide a scenario where a graphic file would be considered an invaluable piece of evidence.

• Use the Internet research and select at least one case or investigation where a graphic(s) file was used as a critical piece of evidence. Be prepared to discuss, briefly summarize the case or investigation that involved a graphic file(s) as a critical piece of evidence. Determine if the case or investigation would have been hampered without this piece of evidence and provide a rationale with your response

   

   

  Network Forensics"

• Assess the importance of forensics in network-based crimes and incidents. Determine the advantages an investigator gains by having the ability to analyze network-based crimes. Propose how you, as someone in a management position, would emphasize this importance to your organization. 

   

• Use the Internet to research and select at least one article involving a cybercrime case where forensics was utilized. Be prepared to discuss summarize the article you researched and specify how cyber forensics were utilized to analyze the crime. Provide an example with your response.

   

   

• Compare and contrast forensic investigations of email in a client-server environment and webmail environments. Choose which one you believe is the more difficult of these investigations and provide a rationale with your response. Determine if you believe mobile device email has increased the difficulty with email evidence gathering and if you believe this will continue to evolve in the future.

   

   

• Go to the Forensic Focus Website to read the article titled “Email Evidence – Now You See It, Now You Don’t!” located at http://www.forensicfocus.com/email-evidence-now-you-see-it. Be prepared to discuss. Suppose you are a Chief Information Security Officer (CISO) for a large corporation. Choose what you believe is the greatest concern with email investigations. Conclude whether or not you agree with the authors that speed in preservation is the key to an email investigation. Justify your response