Read the enclosed case study (Case Study: Email Infidelity in a Computer Forensics Investigation) below and discuss following points:

Discuss your options for acquiring the image

What questions should you ask and how should you proceed?

Explain three common types of digital crime

Discuss the acquisition method that can be used.

Discuss the options that can be used to recover the file.

Case Study

Email Infidelity in a Computer Forensics Investigation: The boyfriend was very emotional at the thought of being betrayed by his love for many years. Summary:

A devoted boyfriend had a sneaking suspicion that his girlfriend of many years was cheating on him. The couple shared a computer for many of their activities: work, games, and Internet, so when the boyfriend saw what he thought was an e-mail from another man in his girlfriends in-box, he was furious. When he accessed the account, there was no such message, but he was sure that his eyes had not been playing tricks on him. The boyfriend contacted International Counterintelligence Services, Inc., in the hopes that they could get to the bottom of this dilemma. During the free consultation with a trained case analysis, the boyfriend expressed his concerns. The case analysis and the client concluded they would need to call upon the help of the ICS computer forensics technicians. Now, the boyfriend was very emotional at the thought betrayal. He thought that he would have to fight his fears alone, without the full knowledge of the situation. But he luckily had the strength of a reputable investigative company (and our infidelity private investigator) who would help him get though the crisis.

The investigation began with the client bringing in the laptop computer that the couple shared. He was able to leave it for examination in the computer forensics lab. The computer was first examined for any signs of physical bugging devices. Once assured that it had not been tampered with, the hard drive was removed and forensically imaged as an exact replica of the original hard drive. This copied image is where the computer forensic technicians would perform the investigation. This work was all done on the same day in order to have the computer back home, so the clients girlfriend would be none the wiser to the investigation. From here the case manager was in steady contact with the client so he would know the progress of the investigation. The scope of the investigation would concentrate on any e-mail of notable content.

This investigation would prove to be more difficult than first thought, however, because the e-mail system that the couple was using was not a host-based system. This means that it was not a program that was used on the laptop computer, but instead was a Web-based system. Web e-mail, although popular, poses difficulty for forensic technicians recovering deleted messages. Nevertheless, with great effort they found what they had been looking for. The technicians discovered a series of unmarked archived files that were left by the e-mail program on the computers hard drive, even though the files had been deleted or so the girlfriend thought. Adding another twist to the investigation, these e-mails had been created under a dummy account so as to separate them from on the girlfriends main e-mail account.

Conclusion:

Since the files had been compressed they had to be transformed and viewed in a special manner to see the true content. They exposed multiple conversations pointing to betrayal on the part of the girlfriend. The discovered messages were compiled and the case manager immediately contacted the client. The client, although he had a dilemma to face, was very grateful for the hard work that the ICS team had done for him. This was a credit to the well-trained case analyst, case managers, and forensic technicians at ICS.