You have been tasked with the seizure, acquisition and analysis of a workstation computer (Windows 7, 1 TB Hard Drive, 16GB RAM, connected to a corporate network, in a Windows Domain). The acquired evidence will be transported to a remote, secure facility for analysis. The workstation is currently powered on. A 500 GB external hard drive and 5 DVDs are also visible next to the workstation. A staff member is suspected of being in breach of acceptable use policy and has been misusing company resources to run his home based web design business during work hours (9am - 5pm, Monday to Friday). Logs are available from a proxy server.
Task:
Fully detail, explain and justify the steps you would take before conducting the actual seizure of the computer and attached devices. Consider planning, preparation, obtaining appropriate authorizations and other legal considerations. Provide brief definitions of forensic terminology used in the answer.
Marking Key:
|
Criteria
|
Score
|
|
Planning
|
/2
|
|
Preparation
|
/2
|
|
Authorizations
|
/2
|
|
Legal considerations
|
/2
|
|
Forensic terminology defined
|
/4
|
|
Referencing
|
/1
|
|
Presentation
|
/2
|