Project 3

1.      How would you package the thumb drive for shipment to the lab? Be specific as to what materials you would use, and why?

2.      What would you ask the lab to look for on the submitted thumb drive, and why?

3.      Are there any locations outside of Mr. Yourprop's immediate workspace where pertinent digital evidence might be found to help with your intellectual property theft case? Explain thoroughly.

Now, please assume a different character for the purpose of this next segment of the assessment… You are a forensic examiner at the above mentioned Makestuff Company lab.  After receiving the package from the InfoSec Specialist in the field, you sign the chain of custody form and get set to begin your examination.

4.      How would you protect this thumb drive prior to creating a forensic image for examination?  Why is this protection important to your overall case? Explain thoroughly.

5.      Discuss at least three forensic examination/analysis tools that could be used by you or Makestuff Company's other digital forensic analysts to process/analyze the thumb drive you received (be specific), ensuring you include the manufacturer of each tool and each tool's capabilities.

Fortunately, the InfoSec Specialist was on his/her game, and ALSO sent you copies of several files, reported to be the source code of “Product X”.

6.      What is hashing, and how could you take advantage of it in this case to attempt to determine if Mr. Yourprop’s thumb drive contains copies of the source code? Explain thoroughly.

You complete your laboratory examination and return the evidence, with your report, back to the InfoSec Specialist at the field office.

Now, back at the field office, the InfoSec Specialist (a.k.a., you) receives the report from the Makestuff Lab, which shows that the complete “Product X” source code was found on Mr. Yourprop’s thumb drive.  In addition, while the evidence was at the lab for examination, you determined it is also likely that Mr. Yourprop...