Ccsi410

CCSI 410 Forensic Lab Report

1) Investigator’s Name:

2) Date of Investigation

3) Lab Number and Title: Lab 2: Creating a Clone

4) Summary of Findings:

The summation from the investigation on a bomb threat case is as follows. We were requested to clone the suspect’s hard drive and review it for evidence. We obtained the evidence from a warrant processed that the department. Upon arrival at the scene I observed that the computer was “ON” and the Operating system was setting with “NO” programs running. The warrant was to remove the hard drive from the computer and bring it in to the department for analysis. Once I removed the hard drive from the suspect’s computer I placed it into an antistatic bag and transported it to office. Once at the office I authenticated the evidence was intact and began to clone the drive. Once the drive was cloned and I was sure it was an exact copy, I verified the clone using a bit-stream copy and an MD5 hash with a digital signature. Once process completed and was verified to be authenticate, I begin the analyzing the drive reviewing all file within the drive. I was found that the drive does contain evidence that the suspect did write several emails threating neighbors and businesses with bomb threats. I have recovered emails, letters, and deleted files containing this information.

5) Details of Investigation

<It is extremely important that you document each event that occurred during your investigation. These notes will be part of your evidence that supports your findings in court. For each step, remember to record the day of the week, date and time of investigation along with a brief summary of what has occurred. Here is an example:

The following events occurred on Thursday, November 10, 2005 At Acquisition Site – 36 Smith St, Newport RI

1. 3:05 pm - Located Suspect Computer. The computer is turned off.

2. 3:10 pm – Took pictures of the screen and surrounding area.

3. 3:15 pm –...