Question: Identifying Anomalies. Use the Event Viewer to analyze the logs on your computer. In your logs, find an event that is an anomaly such an error or warning. The anomaly can come from application, security, setup, system, or forwarded40. You Spoiled It. Motorola, Inc., fired its CFO, Paul Liska, in January for a number of reasons related to his performance as stated by Motorola. Liska has filed a suit against Motorola for the conditions of his dismissal. Motorola, accused its former CFO of destroying evidence needed in the case, and asked the Cook County Circuit court to sanction Mr. Liska for "spoiliation" of evidence in the case. When he was fired on January 29, Mr. Liska left the company with his company laptop, and when he returned his laptop on February 17, the laptop had been "wiped." Motorola's forensic investigators had found that a data destruction program was run on the laptop numerous times to destroy any usable data needed by Motorola to show what Mr. Liska had been working on prior to his dismissal. Mr. Liska states that he only deleted personal files.

a. Do you believe that all files related to the case have have been destroyed?

b. Are there any other places that work files re lated to the CFO's accounting activities would be kept?

c. What would have to been done to files collected from a source other than Mr. event logs. Once the anomaly is found,

(a) copy the screen display;

(b) search the Internet and find an explanation of the anomaly as described in the Event Viewers "Detail" box. Turn in both the copy of the screen display and your explanation. For help with this exercise, see video - How to Use the Windows Event Viewer.