Cases

Case 1.1

A lawyer in a firm is suspected of embezzling money from a trust account. Who should conduct the investigation? If evidence is found to support a claim what should be done?

First thing is to follow the laws that allow us to search for evidence in the company’s server and computers so that later on they could be valid in a court of law. A computer forensics investigation should be conducted by professional accompanied by a police officer at all times. The trained professional should start his investigation in the company’s computer OS, hardware and peripheral devices. It is up to the forensics professional to determine how one of the employees intruded into the company’s network and what information stolen or altered. The forensics investigator must gather as much information as possible during his investigation without altering any of the original files. Any evidence acquired illegally by not following these laws will be dismissed in a court of law. Once the specialist has obtained all possible evidence from the company’s computers, devices and servers it can and should be presented to a lawyer. Once the evidence is presented to the company’s lawyer the evidence can be presented in a court of law to prosecute the suspect believed to have a committed the cybercrime.

Case 1.2

A private corporation suspects and employee is using password cracking tools to gain access to the other accounts. Accounts include employees in the payroll and human resource departments. What steps should an investigator take, who is involved and what items must be considered?

When we conduct an investigation in a private corporation the lawyers of this private corporation must be present to address the company violation policy. While conducting the investigation in the private corporation we must have the corporations rights to the computers ownership to be able to conduct and continue with our investigation on the corporations computers and servers. Once we have these...