Assignment: IT principles in digital investigation

As the lead for a digital forensics team you are now being asked by the forensics manager to give a training session on how to acquire digital evidence. The session must be given to your junior forensics team. In this training session, you will need to demonstrate how to acquire digital evidence without causing alteration through the use of both hardware and software write blocking and the preferred technology for this write blocking. In addition, the training must demonstrate how investigators perform detailed analysis of the evidence collected from formatted media, deleted files, allocated space, swap space, slack space, encrypted space, and unallocated space. These two demonstration areas are the most critical steps for junior investigators if they are to both completely understand the evidence acquisition process and places where suspect data may hide on formatted media.

Provide the following in a 5-7 slide PowerPoint presentation:

• A title slide

• An introduction to the contents of the report

• Detailed demonstration of how to acquire digital evidence without causing alteration through the use of both hardware and software write blocking-and the preferred technology for this write blocking

• Demonstrate how investigators perform detailed analysis of the evidence collected from formatted media, deleted files, allocated space, swap space, slack space, encrypted space, and unallocated space

• A conclusion for the digital evidence acquisition and write blocking process

• A reference slide with sources properly cited in APA style

The presentation should be a minimum of 5-7 PowerPoint slides in length including speaker's notes (250 words minimum), not including the title and reference slides and neatly formatted.