QUESTION 1

(a) Describe the term digital evidence.

(b) When thinking about the many sources of digital evidence, it is often useful to categorise computer systems into three groups.

Briefly portray the three different groups of computer systems as sources of digital evidence.

(c) Several attempts have been made to develop a categorization that would help describe the role of computers in crime.

(i) Illustrate the four categories of computer-related crime as suggested by Donn Parker.

(ii) What was the chief omission in Parker's categories?

(iii) Briefly elucidate the classification approach adopted by David Carter as an improvement upon Parker's categorisation of computer-related crime.

(d) Several of our normal daily activities in life leave a trail of digits.
Consider one typical day in your life as an illustration. Briefly depict six trails of digits left by your activities.

QUESTION 2

(a) One of the key goals in an investigation is to attribute the crime to its perpetrator by uncovering compelling links amid the offender, victim, and crime scene.

(i) In the context of crime scene investigation, explain the Locard's Exchange Principle. Support your answer with appropriate examples.

(ii) Briefly describe the two general categories of confirmation produced by the Locard's Exchange.

(b) The exploratory process, which consists of twelve (12) steps, is structured to encourage a complete, rigorous investigation, ensure proper evidence handling, and lessen the chance of mistakes created by preconceived theories and other potential pitfalls.

Briefly clarify any three of the twelve stages of the investigative mprocess.

(c) Digital substantiation is a rich and often unexplored source of information.

These facts can be used for crime reconstruction.
Portray the three type of analysis that can be performed as part of crime reconstruction.

QUESTION 3

(a) With orientation to criminal activities, clarify the following terms

(i) Modus Operandi ; and

(ii) Motive.

(b) There is a proposed behavioural motivational typology that shows the shift in emphasis from classifying offenders to classifying offence behaviours. The model includes five different types of wrong behaviours which can be used as a deductive tool.
Express the five types of behaviours. Support your answer with suitable case in points.

(c) What the Internet is today was never aimed or imagined by those who broke its first ground. Computers and the Internet have been adapted by criminals in the commission of their crimes.
Explain two current technologies and elucidate how they have been criminally adapted for cybercrimes.

QUESTION 4

(a) With reference to MD5, or any other alike messages digest algorithms,

(i) Give details of the concept of Message Digest.

(ii) Elucidate the importance of message digest in computer forensics analysis.

(b) Portray the two main forms of data recovery while performing the forensic examination of FAT file systems.

(c) In the context (milieu) of digital forensics analysis, give details of the following terms:

(i) File Carving;

(ii) Steganography; and

(iii) Digital Stratigraphy.