You are given a bit for bit copy (called an image) of a disk drive, that was seized with a search warrant, from John Brinkley’s home. It is alleged that he has been making fake drivers licenses. Since this is a copy, you may operate on it directly without making a forensic copy unless you choose to do so.
Write a comprehensive forensics report regarding the logical contents of this disk image related to the search warrent. Look into the logical files and see if you can find evidence to support or refute the prosecution of this individual for making fake driver's licenses. (This was why the original search warrant was issued.) Remember, as part of the report, you should have an appendix that itemizes exactly what you did and when you did it. (i.e. an investigation log showing every single command you issued with each command time tagged.) You should then create a summary of the results and place it at the beginning of your report that lists all files that you believe are a problem along with where you found them on the drive. The body of the report should have at least thumb nails of all the images that you believe are related to the case and where they are located on the drive. If you find documents, they should be in your report.
(Remember, you are an expert not a prosecutor. You thus are to draw NO CONCLUSIONS of guilt. You are NOT the Jury, the prosecutor, or the defense. You are an independent third party expert in cyber security and digital forensics who is analyzing the contents of the disk drive.)
Instead of conclusions, this report should have a summary at the end of what was found that relates to the search warrant. The report will go to the police investigator who will provide it to the prosecutor.
10% bonus: Find what thumb drives have been connected to this computer.
Note: For this training exercise, it is also illegal to be in possession of Kitty Porn (Please note the play on words. This is “Kitty” porn (i.e. cats) NOT “Child porn” which really and truly is against state and federal law. For this exercise, any picture of one or more cats will be considered a violation.) If you should find a single instance of kitty porn, then you must STOP your investigation, fill out a search warrant, and get Judge (Magistrate Judge) Nutter to sign it before you may proceed further with your second investigation that might include kitty porn. If you do this, then you must also write a report regarding this second investigation. Both reports will then be submitted as part of the final project should you find even one violation. A tool called the “Search Warrant Checklist” is included. A copy of a blank pdf warrant will be posted with this assignment on e-campus.
You may do the work on your own machines or in 3102 Prete Bld on our computers. Remember, getting access to Prete depends on my (unfortunately) random schedule. Getting this completed may take time. SO START EARLY !
SEARCH WARRANT CHECKLIST
Case Title: _____________________________
Case Agent: _____________________________
Does the affidavit establish the affiant’s training, skills and experience?
Pay special attention to the training, skills and experience that the affiant will be asking the judge to rely on in finding PC (e.g., unique behaviors of CP hoarders)
Does the affidavit educate the judge, in simple, concise language, about the technical terms and concepts necessary to find PC?
Consider attaching a glossary of terms
Consider putting only a short executive summary in the body of the affidavit, and including a more detailed explanation as an attachment
Does the affidavit educate the judge about the complexities of computer storage and evidence, such that he will understand the variety of places and forms in which evidence may be found?
Does the affidavit establish probable cause to believe that evidence, fruits, or contraband can be found on each computer that will be searched / seized?
If unsure how many or which computers may be involved, establish PC to believe that one or more computers at the search location contain evidence, fruits or contraband or are instrumentalities
Copyright © 2018 | Truelancer.com