Discuss how digital forensic procedures may differ when

1.  Discuss how digital forensic procedures may differ when used in support of law enforcement versus when used for incident response and how computer forensics tools might be integrated into incident response.

2.  Explain the significance of the Daubert and Frye Standards and address the impact on the case of using tools that are not vetted by the community.

3.  In your labs, you “hashed” files that you added as evidence. Explain the use of hashes in authenticating evidence. Address how collisions might negatively impact a case. What solution to reduce the likelihood of a collision would you recommend?

4.  Discuss the importance of timestamping server and network log files that might be used as evidence to a court case. How would digitally signing log files support their use as evidence?

5.  How do attackers use anti-forensic tools to misdirect an investigation?

6.  What is the significance of the 4th Amendment to a forensic investigation? If you are a corporation, what is the best way to ensure that users waive any expectation of privacy when using their computers?

7.  Discuss why a live analysis is preferred over a “dead” analysis and the issue of “volatility”. In an investigation, what information would need to be captured first?

8.  As a forensic investigator, provide two examples, one of a corporate investigation and one of a criminal investigation, in which you would be asked to investigate. Where would the evidence supporting each of the cases in your example be likely to reside?

9.  Discuss how capturing a bit-stream image differs from simply copying the contents of a suspect’s hard drive to an evidence drive. What information would be present in a bit-stream image that would not be present if you just copied the drive?

10.  Identify at least 1 challenge to acquiring network data over computer data.

11.  Describe 4 different ways that a criminal can hide data (think anti-forensics, too). How would you find each of these in your investigation?

12.  You attempt to acquire a PC, but the data on the PC has been encrypted. What steps can you take to recover the password or data?