Forensics is usually the more interesting of the topics for these two chapters. Take the following scenario and map out the chain of custody (the book describes the steps) that needs to be followed if you are going to preserve the integrity of the evidence.

Scenario: A co-worker is suspected of surfing the Internet on their work machine and downloading pornographic material and printing some of it on the department printer during the evening hours when most people have gone home. You are responsible to collect data to support the worker's dismissal.

1. Describe the data you need to obtain, the methods you would use to get it, and the chain of custody of the data once collected.

2. Don't just list the steps the book provides for the chain of custody! Explain in detail where/how/who will hold the evidence at which step and why it is important to follow each step.

3. What could happen to the data at each step if the chain of custody is not followed?