Cj317 Unit1 Assignment

Unit 1 Assignment

Kerry Bridges

Kaplan University

CJ317

Unit 1 Assignment

Missing Child:

The forensic procedure for handling electronic evidence has four phases: collection, examination, analysis, and reporting. The collection phase begins with the collection of the laptop. The examination of the laptop would be the next step. During the examination phase, the state of the laptop is recorded along with the type, model, and condition of the Hard Disk Drive (HDD). The Forensic Analyst puts the HDD onto a filter to prevent the computer from writing to the HDD. The Forensic Analyst then makes a perfect image of the HDD onto another HDD. The original HDD is held as evidence while the imaged HDD is placed on a filter and examined on the Forensic Analyst’s computer with forensic software. The Forensic Tool Kit (FTK) is an example of a program that Forensic Analysts use to make images of a HDD as well as retrieving information off of the imaged HDD (AccessData, n.d.). FTK is capable of removing all data on a HDD, even data that is encrypted, password protected, and deleted (AccessData, n.d.). Critical evidence is located on the HDD and is marked for investigators to examine. Instant Messages, E-Mails, Facebook/Twitter posts, videos, pictures, and browser history are some examples of critical evidence that Forensic Analysts would mark (U.S. Department of Justice, 2004). Analysis of the evidence is generally performed by both the investigators and the Forensic Analysts. The reporting phase consists of the Forensic Analyst creating reports which state the evidence collected the methods of examination, the analysis of the evidence, and their findings (U.S. Department of Justice, 2004).

The justification for the process lies with preserving the integrity of the evidence, maintaining a chain of custody, discovering what happened to the girl, and who kidnapped the girl if that is why she is missing. The parents gave consent for the...