Scenario

You are an experienced digital forensics specialist for DigiFirm Investigation Company. The local police are investigating a man who they suspect is distributing child pornography. They have seized his laptop computer, which runs the Windows $10$ operating system. The police are shorthanded and have contracted with DigiFirm to assist with the forensic investigation of the laptop. Chris, your team leader, has asked you to assist with the case.

There are several examinations you can complete on a computer running Windows $10.$ Before beginning any digital forensics investigation, it$$s a good idea to plan your approach.

For this assignment:

Write a report that outlines the steps to be performed in examining the laptop for evidence of the crime, in order of importance.

Explain why certain steps must be performed before others.

Briefly describe what can and cannot be retrieved from the Windows operating system.