Title: Chapter 2 Instructor Notes
Course: IN 2005 Digital Forensics > Section: Module 2: Chapter 2 - Understanding Computer Investigations

Planning for Security

Introduction
1. Collecting evidence that can be offered in court or at a corporate inquiry includes investigating the suspect’s computer and preserving the evidence on a different computer
2. Chain of custody is the route the evidence takes from the time you find it until the case is closed or goes to court.

An Overview of a Computer Crime

1. Information contained on a computer can help solve a case.
2. Refer to the U.S. Department of Justice (DoJ) Web page (www.usdoj.gov) for proper documentation on acquisition of digital evidence.
3. Tools like Digital Intelligences DriveSpy and Image, Norton DiskEdit, Guidance Softwares EnCase, and AccessData’s Forensics Toolkit are important to digital forensics investigator, especially when dealing with intact, deleted, and hidden files.
4. Information on hard disks on computers you collect as evidence might be password protected. You might need to acquire password-cracking software or find an expert who can help you decrypt a file.

An Overview of a Company Policy Violation

1. When employees misuse company resources, i.e., not following company policies, it can cost companies millions of dollars. Misuse includes:
  - Surfing the Internet
  - Sending personal e-mails
  - Using company computers for personal tasks

Taking a Systematic Approach

Procedures for Corporate High-Tech Investigations

Understanding Data-Recovery Workstations and Software

Conducting an Investigation

Completing the Case

Critiquing the Case