Case Portfolio

Using the photograph depicting Mr. Didit's work space (posted along with this project description or provided by your instructor), you will develop a case portfolio that will include the following: collection of digital evidence; transfer/handling of digital evidence; differentiation of non-digital evidentiary items collected separately; methodology of preservation; summary of analysis results for the intended audience (prosecution); and final testimonial preparation materials.

Consider this project a continuation of the work performed in Project 2, and assume the same overarching scenario.

You now know that digital forensic examiners found five (5) contraband images on Mr. Didit's computer, and the hash values of those images were matched by the National Center for Missing and Exploited Children (NCMEC) to those of known child pornographic images (previously tied to known underage victims).

You are being called to put together a case portfolio to present to the prosecution for the trial of Mr. Didit. This case portfolio should be written as a professional report (you may select an appropriate format) and will include a summary of your trial testimony. Just as a prosecutor will detail for an investigator what information they need to have included in the case file, your instructor has detailed items he/she would like you to include in your case portfolio:

1. A short, professional summary providing the facts of the scenario;

2. The photograph the workspace; (does not count for your minimum page count)

3. A complete list of the potential digital evidence you found in the workspace (i.e., in the picture), along with an explanation of the significance of each piece (e.g., what type of important data might be found on each piece of evidence collected), how the evidence would be preserved or protected (including technological preservation, such as forensic imaging), and how it would be stored or protected pending analysis or the transfer to a law enforcement agency;

4. A complete list of the non-digital evidence you found in the workspace that you could collect (or at least search), including what significant information might be found in that evidence;

5. A completed Evidence Collection Document (posted along with this project description or provided by your instructor) detailing at least three of the items of digital evidence you would collect and establishing chain of custody; (does not count for your minimum page count)

6. A rough (hand-drawn) sketch of the workspace (you made need to fill in some details you can't see outside the scope of the photo), with the locations of at least major items of digital evidence you would collect; (does not count for your minimum page count)

7. A list of locations outside of Mr. Didit's immediate workspace where pertinent digital evidence might be found;

8. A list of at least three forensic examination/analysis tools that could be used by you or ABC Corporation's other digital forensic analysts to process/analyze items of evidence you collected (be specific), ensuring you include the manufacturer of each tool and each tool's capabilities;

9. A summary of what you would tell the court in testimony responding to the following questions (feel free to compose fictitious details, but please ensure it is plausible based on the scenario):