• The submission is to have a cover page that includes course number, course title, title of paper, student’s name, and the date of submission per APA writing format;

Running Head: INVESTIGATION PROJECT 1

INVESTIGATION PROJECT 5

Investigation Project 2

Juwane Brown

CCJS 321 Digital Forensics

05/27/2020

Investigation Project

Provincial Worldwide wishes to investigate the work area of one of the former employees, Mr. Belcamp. His employment contract was terminated validly, but the company's management suspected possible concerns when the employee was leaving. The permission to search his work area is provided in the employee code of conduct, which informs workers that they can be searched randomly within the company. This has been provided to mitigate incidents of theft in the company. The work area of the former employee belongs to the company, and, therefore, it is subject to search because it is not a private property of Mr. Belcamp.

Physical Evidence-Digital Evidence

One of the digital evidence in the work area is an external hard drive. The device represented physical evidence and can store digital information such as files, pictures, and videos. It is not connected to a power source and, therefore, not in use. A USB drive is noticeable in the middle of the picture. It is physical evidence that can store data with low memory capacity. Examples of information can include short files, audio clips, and images.

On the left side of the picture is a Dell laptop. This is real evidence that carries a range of information. It can trace the activities of the users for a specified duration. A computer can give meaningful information on the sites that the user visited, and what the user did on these sites (Joint Committee Report, 2016). There is also a desktop computer on the right hand of the picture. Although it is not portable like a laptop, the functionality of the two is similar. The desktop computer is real evidence that can give details on the activities of the users. It can store important data such as videos, audio clips, Microsoft files, and pictures, among other forms of information.

The steps of collecting the external hard drive will entail taking a photograph. The investigator needs to have gloves while handling the device and package it in anti-static packaging. The storage of digital evidence should be in a package that prevents breakage or any form of damage (MacNeil, 2015). The packaging material should then be labeled appropriately.

The procedure for collecting the laptop should start by taking its photograph. It should then be checked if it is running or switched off. The screen should then be observed for possible running programs. The media ports and DVD tray should also be checked for possible portable devices (MacNeil, 2015). If none is identified, the laptop should be packaged in static shock protective bags ready for transportation and further analysis.

Non-Digital Evidence

One of the notable non-digital evidence in the photo is a sticky note. On it is written "Purple 743." This note is real evidence that may be a password for any of the identified digital devices. Slightly below the monitor is a NASA notepad, which is physical evidence. The note contains the scheduled activities of the former employee. The activities are calling Maria and Bob and checking storage. There is a document folder above the monitor. It is real evidence that could contain letters, passwords, and other contact information. Latent figure prints can be collected as real evidence from the work area. This form of evidence can provide evidence that is required to prove that, indeed, the scene was the work area of Mr. Belcamp.

The procedure for collecting and storing the document folder will begin with taking its photograph. The evidence should be packaged in a secure bag and document it on the custody log (Joint Committee Report, 2016). The figure prints can be collected from several areas. They include keyboards, on the desk, and from the mouse.

Security Procedures in Transportation

Digital evidence should be stored in cardboard boxes or anti-static bags. The evidence needs protection from extreme temperature and humidity since these weather conditions can destroy the devices or compromise the data. The evidence should be locked in the storage area, which needs to be secured appropriately. The access to this area needs to be controlled strictly to prevent theft or to tamper with the devices.

Evidence Custody

Brian's description is incomplete. The model of Olympus is given, but it is not captured in the report. All collected items in evidence gathering should be described thoroughly and accurately (MacNeil, 2015). Brian misses the dimensions of the Olympus. The information on the external hard drive is scanty. It should include the measurements and serial number, which is SATA drive 64 MB cache.

References

Joint Committee Report. (2016). JTC Resource bulleting: Managing digital evidence in courts. Retrieved from https://www.ncsc.org/__data/assets/pdf_file/0017/18521/digital-evidence-3-14-2016-final.pdf

MacNeil. T. (2015). Police opinions of digital evidence response handling in the state of Georgia: An examination from the viewpoint of local agencies’ patrol officers. Retrieved from https://nsuworks.nova.edu/cgi/viewcontent.cgi?referer=https://www.google.com/&httpsredir=1&article=1369&context=gscis_etd