Questions

1. a)Looking at the image above, is it possible that the contents of FileThree.png and FileTwo.docx could be identical? Why or why not?

b)Explain how you can prove your answer given above.

2. Looking at the image above:

A. Is it possible that these files could have the same hash value?

B. Explain why or why not?

	3. You need to perform a data acquisition on a 1 TB suspect drive. You have two 512 GB Target/Destination Drives in possession. A. Can you create a .dd image file of the Suspect Drive? Explain B. Can you create a  .eve image file of your Suspect Drive? Explain

4.

A. Explain what you should do when working on an Internet investigation and the suspect’s computer is on?

B. Explain your second option if somehow the above-described method is not working?

5. Jack is working in an Insurance company. He saw that his co-working Mike is continuously emailing with his girlfriend. He believes this is not right and reports this to the Administration. The Administration decides to hire a Private Investigator to investigate Mike's email activities. The investigator notices an icon on the desktop which seems like an illicit video.  Thinking that it is in plain view, the PI decides to investigate the video.

A. Legally, can the Administration hire a PI to investigate Mike's email activities outside Mike's knowledge? Explain.

C. If what Mike is doing is wrong, how would you categorize it? (For example:  Criminal case – burglary)

D.  Legally, can the investigator search the video further? Why or why not?

E. What is the next step what should be taken?