The International Society of Forensic Computer Examiners  


image image image image image image image image image image

    Sample Practical Exercise Explanation

     

    Your report should indicate:

    • You checked the system clock and found it accurate
    • You write protected the diskette
    • You physically examined the diskette
    • You started and maintained a physical chain of custody - Explain your procedures
    • You ran a hash or checksum on the original media and noted the value
    • You wiped and verified the wipe of the target media
    • You made an exact copy of the original media to the wiped and verified media.
    • You ran a hash or checksum on the original media again and the value matched the original value
    • You ran a hash or checksum on the target media and the value matched the original value
    • The diskette appeared to have been formatted - give your reasons
    • You used a carving utility and "carved" out 3 documents from unallocated space
      • An MS Word Document - "DOC1"
      • An MS Word Document - "DOC2"
      • An Excel Spreadsheet - "DOC3"
    • DOC1
      • You established through the document metadata that the document was originally called "Magna Carta.DOC"
      • The document appeared to contain the Magna Carta
      • You established through the document metadata that the document indicated the Author was "Emma Crook" of the "Really Big Company"
      • You established through the document metadata that the document was last saved on 9/15/04 at 2:22 PM
    • DOC2
      • You established through the document metadata that the document was originally called "Gettysburg Address.DOC"
      • The document appeared to contain the Gettysburg Address
      • You established through the document metadata that the document indicated the Author was "Emma Crook" of the "Really Big Company"
      • You established through the document metadata that the document was last saved on 9/15/04 at 2:25 PM
    • DOC3
      • The document was password protected.
      • You defeated the password "crook" and opened the document
      • The document appeared to contain data that confirmed Mr. Boss's suspicions
      • You established through the document metadata that the document indicated the Author was "Emma Crook" of the "Really Big Company"
      • You established through the document metadata that the document was last saved on 9/15/04 at 2:28 PM
    • Based on Mr. Boss's time line statements and the date and time stamps within the metadata, the apparent formatting of the diskette occurred on 9/15/04 between 2:28 PM and 3:00 PM.
    • Exhibits were provided to Mr. Boss
      •  

 

 

image

image
free cialis submit=free cialis cialis com cialis order java.js buy cheap cialis online cialis exchange link cialis tadalafil american express viagra cialis buy cialis link mycialsnowprohostingcom onlinehtml cialis impotence drug eli lilly co cialis without prescription in detroit area why cialis buy cialis link onlinehtm pharmacyrxfreewebtoolscom cialis in south africa do u take cialis everyday add cialis url cialis and manufacturer cialis muncie indiana how to stop viagra cialis spam black buy casino cialis diet followup gambling jack low online order phentermine poker post viagra cialis comparison levitra cialis online sales mexican cialis boelolokeepkidshealthycom cialis link cialis day next cialis purchase mixing cialis with effexor bulk cialis and viagra sold world wide on line cialis discount save cialis story safest of cialis levitra viagra buy cialis href newopasblogdrivecom cialis en venezuela cialis western open tee times viagra and cialis cheap buy cialis link onlinecolnu cialis europe viagra cialis submit=cialis should i buy cialis online buy cialis amsterdam cialis dose cialis tablet sildenafil cialis generico buy cialis cialisfunsurforg onlinehtml cialis drug impotence cialis testimonials sitemap1 buy cialis no prescription cialis for order cialis side effects order cialis buy cialis dreampharmaceuticals cialis drug cialis peak serum time half life pill cutters for cialis blindness cialis cialis dysfunction erectile cialis pill low cost generic cialis blogid buy casino cialis inurl order phentermine poker viagra cialis compare viagra cialis soft tabs den haag results of comparisons of viagra and cialis buy cialis in uk cialis en espanol cialis prescriptions map buy cheap cialis cialis link onlineinfo cialis cost low cialis online sale mixing viagra and cialis black buy casino cialis diet followup gambling jack order phentermine poker viagra cialis cheapest online prices cialis news information about cialis and livetra black buy casino cialis diet gambling jack online order phentermine poker tag viagra xhtml cialis class action suit cialis open ticket western order cialis online black buy casino cialis diet holdem jack online order phentermine poker tag texas viagra xhtml cialis comment info personal remember cialis order in south africa is cialis over the counter drug black casino cialis diet followup gambling health jack phentermine poker viagra cialis company cialis on line generic soft tab cialis better erections by combining cialis and viagra cialis attorney ohio cialis melt tabs how does cialis work black buy casino cheap cialis diet followup gambling health jack online order phentermine poker viagra cialis black box warnings cialis mexico online how to get best results with cialis archive buy cialis cialis discount generic cialis online purchase how viagra cialis levitra work black buy casino cialis diet followup gambling jack online order phentermine poker viagra cialis cedar park cialis mg index best cialis generic price cialis and no prescription required cialis link pharmacyrawcsorg generic cialis online best place to get totally free viagra or cialis samples cialis and venous leak