CCJS321 Project 2 Essay - 1898 Words

Project 2 – Identifying and Collecting Digital Evidence CCJS 321 Digital Forensics University of Maryland University College July 18, 2015 Project 2 – Identifying and Collecting Digital Evidence 1. What permissions/authorities should you have before you search Mr. Yourprop’s former Company work area, and how would you document that authority? Generally speaking, an employer can search an employee’s desk or work area without expecting any legal repercussions. The desk is property of the employer, therefore the employee should not be entitled to a reasonable expectation of privacy in their work area (Privacy at Work: What Are Your Rights?, 2015). Even though this is generally the case, its best practice, by and large, to have†¦show more content†¦USB Flash Drives are also sometimes used as encryption keys for encryption tools such as BitLocker Drive Encryption (Microsoft, 2015). To collect and transport as evidence, place the USB Flash Drive into a static shock protective bag (U.S. Dept of Homeland Security, U.S. Secret Service, 2007). Document any make, model, or serial number designations on the device. The hard drive on the desk would be a good third source of digital evidence to seize. Assuming this hard drive is used for additional storage (i.e. does not have an Operating System on it), it would contain data similar to that which would’ve been on the USB Flash Drive: documents, images, videos, and maybe even some software files. Documentation should be done on the make, model, serial number and type (e.g. SATA, IDE, SCSI) of hard drive. For transportation, again, place into a static shock protective bag. Remember to keep the hard drive away from anything magnetic as the platters that are inside the hard drive are magnetically charged (U.S. Department of Justice, 2008). 3. Look at the photo of Mr. Yourprop’s work area provided for Project 2 in the Week 5 Overview area. Identify three (3) potential items of non-digital evidence you see in the photo. For EACH item of non-digital evidence you identified, explain what potential use that item would be to your investigation (e.g., what kind of evidence it is, and what type of data that item