1.In a forensic investigation, it is not possible to over document. It is likely that some cases will depend more on certain aspects of the documentation than others; however, you won't know what is really important until the case is done.

Starting at the crime scene, give five examples of what should be documented.

2. While speaking with the lead investigator on a case, you survey the room in which the computer equipment is located. On one side of the room there is a large bookshelf with up-to-date books on computer topics; a nearby table has current computer magazines; a new scanner is attached to the computer; and the computer is a new model with state-of-the-art equipment.

a. With this information, what can you deduce about the user?

b. How will this affect your investigation?

3. You have extracted a word processing document that was deleted hours before the computer was seized. The file is 80KB in length and was created and modified within a week before it was deleted. After extracting this file, you proceed to open it and view the contents. The first thing you notice is a big blank screen. (Open the attachment in this assignment.) It appears as if nothing is typed in this document. You have learned a little about the user. She is an able secretary, with years of experience in word processing. Ask yourself "How could I hide a document in plain view?" The forensic software you were using knew there was a deleted file, registered the date and time attribute, and even detected how big it was. What the software doesn't know is.....how did the user hide the information. Document similar to the one in your case is attached.