PURPOSE: To help you become more familiar with computer investigation.

INSTRUCTIONS:

1. Perform whatever legal and/or peer-reviewed research you need to perform in order to complete this assignment.

2. Write a one-to-two-page paper:

a. What aspects of a computer should be photographed close-up at an

electronic crime scene?

b. An investigator would like to take a forensic “image” of a suspect’s

hard disk drive. What is the primary goal in obtaining data from a

HDD? What tools can the investigator use to achieve this goal?

c. You are examining two computers to determine the IP address from

which several threatening emails were sent. The first computer uses

Microsoft Outlook as an email client and the second uses a web-based

email client. Where would you probably look first for the IP addresses

in each of these computers?