• Given the Investigation 3 scenario, what questions would you personally consider most critical to identify in your examination?

This scenario takes place circa 2013.

As part of normal business practice, Walmart security receives Counterfeit Coupon Alerts from the Coupon Information Corporation. Within the past month, Walmart security has received specific information regarding fraudulent coupons being passed at their store. Using this information they received, they conducted an internal investigation using video surveillance footage in an effort to identify the customers who are engaged in this activity.

One of the suspects was an unknown white, male adult, approximately 28 years old, brown hair, 5' 9", 200 pounds, no facial hair, and no visible tattoos. A photograph of this suspect was circulated to the employees in the store.

On December 22, 2013, Craig Tucker was detained by Walmart security as he matched the description, and he had just passed two fraudulent coupons for Monster energy drink and Arizona Iced Tea beverages while paying for other items. Walmart security contacted the Santa Monica Police Department to arrest and prosecute Tucker for theft. Santa Monica PD Officer Smith interviewed Tucker, and he denied knowing the coupons were fraudulent. He claimed to have received the coupons after completing an online survey for students at Santa Monica Community College.

Although Tucker gave consent to the search of his personal computer, a search warrant was obtained to search his computer for evidence as it may be an instrument to committing a crime. You have been given a forensic image of his hard drive. Based on your review of the search warrant, you are authorized to search for any information or communication associated with the creation, downloading, distribution, and possession of fraudulent consumer coupons.