Short Questions

· Determine what you believe is the most important piece of evidence that can be retrieved from a mobile device based on the storage capabilities of these devices and justify your response. Identify at least two specific challenges with acquiring this specific evidence from a mobile device.

· Use the Internet to research and select at least one mobile device forensics tool that aids a forensic specialist in an email investigation, thoroughly describe the mobile device forensics tool you researched, including at a minimum its functions, advantages / disadvantages, and cost. Determine whether or not you would consider selecting this tool for use by the employees on your system forensics staff; and whether it could assist them in their investigations. Justify your response.

· Analyze how the consumerization of Information Technology (IT) is creating challenges for both forensics departments and IT security in general. Describe some of the safeguards, both technical and administrative, that you would put in place in your organization to help mitigate the risks of this phenomenon

· Go to the PCWorld Business Center Website to read the article titled “Pros and Cons of Bringing Your Own Device to Work,” dated December 2011, located at http://www.pcworld.com/businesscenter/article/246760/pros_and_cons_of_bringing_your_own_device_to_work.html. Determine what you believe is the greatest concern with the Bring Your Own Device (BYOD) philosophy and justify your answer. Suppose you are a Chief Information Security Officer (CISO). Explain whether or not you would permit personal devices on the company as part of a BYOD policy and justify your answer.

· Explain in your own words the importance of report writing and why you believe it is critical to the system forensics industry. Discuss the need for forensic reports when testifying as an expert witness.

· Determine what you perceive to be the most difficult task in writing a system forensics report and explain why you believe this is the case. Decide whether or not software-generated reports assist with this specific portion of the report writing process and provide a rationale with your response.

· Compare and contrast the roles of a technical / scientific witness and an expert witness. Determine which you believe to be the most important when it comes to a case and whether or not as a juror you would consider one’s testimony over another’s

· Use the Internet to research and select at least one article discussing a case using a digital forensic expert witness. Summarize the selected case. Examine how the expert witness was used in the case and determine if his / her testimony played a significant role in the case and its decision.