Question

earning Objectives and Outcomes

• Outline the proper steps to be performed in examining a laptop computer for evidence of a crime.

Assignment Requirements

You are an experienced digital forensics specialist for DigiFirm Investigation Company. The local police are investigating a man who they suspect is distributing child pornography. They have seized his laptop computer, which runs the Windows 10 operating system. The police are shorthanded and have contracted with DigiFirm to assist with the forensic investigation of the laptop. Chris, your team leader, has asked you to assist with the case.

There are several examinations you can complete on a computer running Windows 10. Before beginning any digital forensics investigation, it’s a good idea to plan your approach.

For this assignment:

Write a report that outlines the steps to be performed in examining the laptop for evidence of the crime, in order of importance. Be sure to explain why certain steps must be performed before others.

Required Resources

• Course textbook
• Internet

Submission Requirements

• Format: Microsoft Word
• Font: Arial, size 12, double-space
• Citation Style: Follow your school’s preferred style guide
• Length: 1–2 pages

Self-Assessment Checklist

• I researched the process of examining a computer running Windows 10 for evidence.
• I outlined the steps, in order of importance, to be performed to locate evidence on the computer.

• I explained why certain steps must be performed before others.
• I created a professional, well-developed report with proper documentation, grammar, spelling, and punctuation.

Answer 1

In case of examining a laptop computer running Windows 10, following steps are followed:

1. The first first thing to examine in this case is to secue a Digital Evidence of the child pornography present. This will be the most important because this evidence will prove that the suspected person is the true criminal.
2. We are also required to record and document the hardware and software configuration of the system. This documentation should be performed so that if someone tries to alter the state of the laptop computer, the documentation will help detect it. It will also help protect the evidence of the crime.
3. Disassembling the computer case is the third step. The data being searched is present in the data storage devices. These are always present in the case of computer. When we document the configuration, this will protect the order of devices present.
4. Documentation of internal storage devices and it's hardware configuration is the next step. There are different types of storages like HDDs and SSDs.
5. Disconnecting the storage devices will prevent destruction, alteration or damage of the data present. This will be the evidence.
6. The information configuration should be retrived from the suspect's boot loadup. The important information like time and date, change of the multimedia devices like CD-ROM, data storage devices, etc. is always present here.
7. If possible, remove the subject's data storage and check it using the examiners system.

These are the steps that must be followed in order to acquire the evidence by examining the laptop computer.

You can copy this into your Word file and set the proper formating.