Background:

Professionalism is what separates the armchair Sherlock from a real investigator. If you think you can do the job because you always learn who the killer is in the first three minutes of an episode of Law and Order, then I'm afraid you might be in for a surprise. Forensic work is methodical and relies on good paperwork and developing repeatable processes.

All forensic sciences are grounded in what is known as Locard's Exchange Principle. It can be summarized by saying, "Every contact leaves a trace." However, it is not enough to detect a contact. You must be able to capture it in a way that preserves it, report it in a way that your results are repeatable, and communicate that to people that do not understand the forensic tests you've performed. This is all accomplished with reports. In this course, much of your work is graded based not on your ability to find all clues or to solve cases. Instead, you will be graded on your ability to write reports that are professional and useful. We will be covering this in the course, but here are some terms that I would like to clarify.

1. The forensic practitioner seeks truth. Reports do not overstate, understate, opine, or editorialize.
2. Forensic reports must be complete. Any competent forensic practitioner in the world should be able to pick up your report and follow your steps and repeat your results exactly.
3. If your report contains conjecture or unsupported conclusions, or if duplicating the steps in your report does not arrive at identical results, then your forensic test and/or report is not forensically sound. Soundness is also known as forensic integrity. It essentially means that your forensic tests and report are accurate and results in conclusions that exclude any alternative conclusions.
4. The essence of investigation is disambiguation. The forensic process is one that weeds through the noise to find the signal, or to use an American idiom, to search through the haystack to find the needle. In digital forensics, you are presented with a large volume of data, which potentially contains important facts. These items are known as forensic artifacts.
5. Who last used a computer? Potentially relevant to an investigation. Where and when it was purchased? These pieces of information a potentially not relevant to an investigation. What is or is not relevant changes from case to case entirely based on the circumstances. The forensic practitioner is required to not only preserve, acquire, and validate those artifacts, but also to determine if they are forensically relevant.

For this discussion, look at the image below and reply to this discussion with your conclusion: + |s this a case of suicide or murder? Include which forensic artifacts you found. Take care that your artifacts are forensically relevant (support whether or not this is suicide or murder) and that your conclusions are forensically sound (explain what you assert they explain.) TIP | will give you one tip for this discussion: this image is intentionally ambiguous. There are artifacts that can be interpreted to support either conclusion. Don't worry so much about finding the "right" answer. There isn't one