QUESTION 1

(a)Briefly explain how the suspect Dobson in Utah has been intercepting his ex-employer email.

(b)According to the U.S. Department of justice, computers play three distinct roles in a criminal case. Momentarily portray the three roles. Give an instance in each case.

(c)Briefly depict the three types of data that a forensic examiner has to work with. Which one of the three is more tricky to obtain and why?

(d)Judge the following case:

It is supposed that two employees, who had their contract terminated from a Brokering and Insurance company, have been attempting to steal the accounts of some of the consumers shortly before leaving the company.
As a forensic examiner, what type of evidence can be gathered from the palm pilots of these ex-employees to be able to help find which customers they have been targeting?

QUESTION 2

(a)Describe "computer security incident". Which kind of security incident needs to be switched immediately? Give an instance of such a type of incident.

(b)File five devices from which electronic evidence can be obtained.

c) Presume that you are a forensic expert and that you have been called upon a crime scene. Presume the crime scene spans across an office room.

(i) Elucidate two ways in which you will document the electronic crime scene before you start seizing evidence.

(ii) What type of packaging would be best to hold the internal hard drive retrieved from a suspect computer?

(iii) Briefly explain the different information required in an exhibit label or tag.

QUESTION 3

(a)give explanation for the "Locard's Exchange Principle" and its implications in the context of computer forensics. Give two instances to support your answer.

(b)Which command line interface tools or commands can be used to find the subsequent below?

(i) Logged-on users

(ii) username used to access the system via a remote login session

(iii) files open on system via remote connection

(iv) basic information about running processes on a system

(v) modules or DLLs a process is using

(c)You are contracted to work as a computer forensics investigator for a regional bank that has four 30 TB server that store customer data. Describe the method that would be the most efficient to acquire digital evidence from the servers. Give good reason for your answer.

QUESTION 4

(a)"Live data capture is even more important in the case of router forensics". Give good reason this statement.

(b)Briefly describe the different memory components of a typical router.

(c)Detail two commands that can be used to gather the following type of volatile evidence from a router:

(i) Configuration and user

(ii) Local logs process and memory

(iii) Network Information

(iii) File system

(d)(i) Portray the NTP vulnerability of some Cisco IOS routers.

(ii) What is the impact of this attack?