DF-010 Introduction to Digital Forensics

A sales manager is suspected of emailing a price list to a competitor.

1. List at least eight places where evidence could exist.
2. Mark each one as volatile or non-volatile.
3. Rank which you would secure first, and say why. There is no single right answer, but mention how short-lived each source is.

A laptop is switched on and shows an open chat window. Keep it to the first fifteen minutes.

1. Write down what you would photograph and record.
2. Write down what you would not touch.
3. Say who you would call before anyone moves the laptop.

Create a text file and record its SHA-256 hash. Change a single character and hash it again. Compare the two values.

Then complete a chain of custody record for a USB drive handed from a manager, to an IT officer, to a lab. Use the chain of custody template (PDF) or your own table. For each handover record: the item (description, make, model, serial number), who handed it over, who received it, date and time, location, where it is stored, and the reason for the transfer.

For each of three scenarios, write who has authority and what you would document.

1. A company investigating an employee's laptop under an IT policy.
2. A parent asking about a child's phone.
3. The police asking a company for server logs.

Using the price-list scenario from Module 1 and the made-up facts below, write a one-page case note and highlight one limitation. You submit it with your final assessment.