$$ President: Pat McGoo

$$ Information Technology: Terry

$$ Patent Researchers: Jo$,$ Charlie

Note: In the above figure $$DOMEX$$ is the local server managing external network access and email.

One of the employees in M$57$ is stealing proprietary research from the company and passing it on to an outside

entity. This employee has taken some measures to cover their tracks, but probably did not count on the company

machines being imaged in the ongoing investigation of other criminal activity.

You are tasked with determining the following questions:

$$ Who is exfiltrating the data?

$$ How are they doing it$?$ Can you identify the specific items they have stolen? What is required to access

the data?

$$ Who is the outside contact?

$$ Is there anything in your analysis to suggest that this person might be charged with more than one

criminal offense?

At the end of your investigation you should prepare a report in order to find the above questions. You must find

relevant evidences after performing the investigation on the following images:

$$ charlie$-2009-12-11.$E$01$

$$ jo$-2009-12-11-001.$E$01$

$$ charlie$-$work$-$usb$-2009-12-11.$E$01$

$$ jo$-$work$-$usb$-2009-12-11.$E$01$

$$ terry$-$workusb$-2009-12-11.$E$01$

This plan should detail the following:

$1-$ Justify why the use of the digital forensic methodology and approach is warranted including

appropriate procedures for the Company's investigation.

$2-$ Describe the resources required to conduct a digital forensic investigation, including skill sets and the

required software and hardware for the forensics team members.

$3-$ Outline an approach for data$/$evidence identification and acquisition that should occur in order to be

able to identify and review the digital evidence.

$4-$ Outline an approach and steps to be taken during the analysis phase.

$5-$ Develop relevant security policies for the Company.

$6-$ Provide recommendations to the Company for dealing with similar future problems.