Fluent Essays

FINAL PROJECT - Investigative Conclusion and Testimony No directly quoted material may be used in this project paper. Resources should be summarized or paraphrased with appropriate in-text and Resource page citations. ***Read the parts of each section of this project carefully as you are being asked to answer questions assuming different roles for different questions. SECTION I In the course of this investigation you, as the Information Security Analyst for Provincial Worldwide, have or will need to interview (or perhaps "interrogate") several people to provide context for the evidence you have collected as well as the rational for your searches. Ms. McPherson and Provincial Worldwide management are asking for everything to be documented and would like you to provide them responses to the following pieces of information: Provide a list of people you believe should be interviewed for this investigation and how they relate to the investigation. What information could they possibly supply? Provide a narrative description of the interview setting and the intended process, before, during, and following the interview (remember that depending on the type of interview, the setting may be different). Explain to the management why these stages are important to a successful interview and investigation. SECTION II For the purpose of the first part of this Section, you are still the Information Security Analyst for the company. Consider this project a continuation of the work you performed in Projects #1 and #2. After seeing you search Mr. Belcamp’s work area and take several pieces of evidence, Ms. Victoria Evans who works in the office across the hall, comes forward with an odd story. Ms. Evans states that she is Mr. Belcamp’s girlfriend, but lately things in their relationship had begun to sour. She produces a thumb drive she says Mr. Belcamp gave her earlier that day. She tells you Mr. Belcamp told her to “keep it safe” and asked her to take it home with her at the end of the day. Ms. Evans tells you she really likes her job at Provincial Worldwide and has no interest in being wrapped up in whatever Mr. Belcamp has done to invite negative attention. 1. The laboratory has asked you to write a short summary of what information you want them to look for on the submitted thumb drive. Identify, for the lab, what digital or non-digital evidence you would like them to look for and explain why that evidence would be important to the case. 2. Because you are the most familiar with the investigation, Ms. McPherson is asking you to brain storm all the locations outside of Mr. Belcamp's immediate work space where pertinent digital evidence might be found to help with your case. Identify all of these locations, including places where police would have to be involved to search. Identify what places are legal for the company to search, and which ones would require police involvement. Support your inclusion of each location with a short description of what type of evidence might be found there. Now, please assume a different character for the purpose of this next segment of the assessment… You are a forensic examiner at the above mentioned Provincial Worldwide lab. Mr. Stephen Bishop, a newly promoted Regional Security Operations Manager, sent an email to Ms. McPherson who has forwarded it to respond. 3. Write a response to the following email that you have received: To: You, Provincial Worldwide, Digital Forensics Examiner From: Ms. Carol McPherson This case has made Provincial Worldwide upper management recognize the importance of forensic readiness. They have asked that you nominate three (3) forensic examination/analysis (software) tools for them to keep in their budget for the following year. They also state that they want to make sure that the tools nominated are ones that would meet criminal justice-level standards and evidentiary requirements under the Daubert Standard. Please construct a table (chart) that identifies the tool name and their manufacturer, and the capabilities of the tools. Since these tools must meet the Daubert standard, please provide an explanation of how the three tools meet the standards of Daubert. (Management specifically wants tools that can examine/analyze the digital data inside the devices and is not interested in your input on additional tools that write protect or image devices at this time.) After receiving the package from the Data Security Analyst in the field, you sign the chain of custody form and get set to begin your examination. 4. After taking the thumb drive out of storage, you, as the digital forensics analyst, sit down to examine the data. (Presume all personal protective equipment discussed in the course readings is already in place.) Prior to looking through the data contained on the device, you have to make a forensic image. Document what step you take prior to making the image and why this step is important to your overall case. Explain your actions and reasoning thoroughly. Fortunately, the Information Security Analyst was on his/her game, and ALSO sent you copies of several files, reported to be the source code of “Product X”. 5. You, as the digital forensics examiner, used hash values to help locate the source code on the thumb drive. Using verbiage that would be appropriate to communicate to a judge and jury that may not understand computer technology at all, detail and explain the following: • What is a hash value, and how did you use it to identify the source code was present? • Explain an additional use of hash values in the context of digital forensics. You complete your laboratory examination and return the evidence, with your report, back to the Information Security Analyst at the field office. Now, reverting back to your role as the Information Security Analyst back at the field office (a.k.a., you), you receive the report from the Lab which shows that the complete “Product X” source code was found on Mr. Belcamp’s thumb drive. In addition, while the evidence was at the lab for examination, you determined it is also likely that Mr. Belcamp emailed copies of the source code to his personal email address. 6. Do you recommend reporting the crime to law enforcement? Why or why not? Are private companies required to report crimes to law enforcement? 7. Explain what additional steps you could take to prove that the source code had been sent to his personal email address. The decision is ultimately made to report the theft to law enforcement and, using primarily the evidence that you developed during your investigation, Mr. Belcamp is brought to trial for the crime. You (now as the forensic examiner from the Lab) are qualified as an expert witness at the trial and called to testify. 8. What is the significance of you being qualified as an expert witness? How is it different from being a simple fact witness? Explain thoroughly. 9. Mr. Belcamp’s attorney in this case calls you to the stand and brings up the fact that you write a personal blog about digital forensics in your off-time, from which it appears you are a staunch supporter of law enforcement. She believes you are biased in support of law enforcement and that you only had your company’s bottom line in mind. The company’s attorney however, prepared you for these types of questions and had you prepare for trial by practicing answering the following questions - respond to Mr. Belcamp’s attorney by typing up a transcript for your response (You may use first-person grammar, I, me, my, etc., in your response for this question). “How do we know you are not biased in this case, choosing to report only what would help law enforcement and your company's bottom-line? How can we know from your work that your analysis should be accepted by the court?” Project Requirements: • Each question should be answered thoroughly looking at all the issues presented, so do your research, be specific, be detailed, and demonstrate your knowledge; submitting your project through the appropriate assignment folder. • This project should be submitted in a single Microsoft Word document (.DOC/.DOCX), with answers separated and/or numbered in respect to the question, so as to make it clear which question is being answered. It may be in a question and answer format, or as described with answers to the associated question numbers; • The paper should be written in third-person grammar, not first person (which means - I, me, myself, etc.); except for question nine (9). • The submission is to have a cover page that includes course number, course title, title of paper, student’s name, and the date of submission per APA writing format; • Format: 12-point font, double-space, one-inch margins; • It is mandatory that you do some research, and utilize outside resources! You must have a reference page at the end of your project that is consistent with APA citation style and format (see https://owl.english.purdue.edu/owl/resource/560/01/ for help). Running head: UNDERSTANDING INVESTIGATIVE PARAMETERS 1 UNDERSTANDING INVESTIGATIVE PARAMETERS 5 Understanding Investigative Parameters Juwane Brown CCJS 321 05/19/2020 Understanding Investigative Parameters Question 1: Forensic readiness Forensic readiness refers to an organization's ability to maximize its ability to make use of digital evidence while keeping the investigation costs at a minimum. A plan for forensic readiness has several benefits. These include; providing a sense of information security to the customers by showing compliance with the set regulations, due diligence, and good corporate governance (Alenezi et al., 2017). It also improves the confidence of investors and stakeholders that the company will not be faced with data breaches because the threats to the security of data in the company are taken seriously. The requirements for establishing forensic readiness include identifying the evidence type and potential sources of evidence, which helps in streamlining the process of planning the evidence to help the investigators in capturing the forensic artifacts that are short-lived like computer RAMs. Another requirement is establishing the ability to gather and secure evidence in a forensic way. Forensic investigations need to get done in an approved and organized manner, which entails collecting evidence without corrupting it. Question 2: Gathering digital evidence The Fourth Amendment of the United States Constitution protects individuals against searches that meet certain criteria like being unreasonable, as well as seizures in their property (Clements, 2019). However, it also provides an exception in instances where there is probable cause. In this case, therefore, the statements that were made by Mr. Belcamp in his exit speech implied that he had the intention to do something against the organization, amounting to probable cause. Therefore, searching for any digital evidence from Mr. Belcamp's locker is justified as it is necessary to ensure that the employee does not act upon his threats to the company, as implied in his statements. A warrant of search is not necessary as a reasonable cause has been established. However, the company needs to first confirm if there are any special laws regarding the search, especially because Mr. Belcamp was no longer their employee. Question 3: obtaining evidence Security cannot be allowed to search Mr. Belcamp's suitcase and retrieve any evidence. The Fourth Amendment protects him because of several reasons. The company had already fired him, and as such, he is a private citizen whose rights get protected against violation (Clements, 2019). Obtaining any evidence from him without a warrant, in this case, would be a violation of his rights. The security personnel will be required by the constitution to treat him like they would treat any other visitor to the company. Question 4: Employee handbook An employee handbook provides details of the policies, values, and expectations for the employee. Also, it protects the employer if any legal nature issues arise in the course of the employment relationship (Guerin & DelPo, 2017). An employee must sign the receipt to show that he agrees with the provisions in the handbook. However, they cannot be forced by the employer to sign it though the move could amount to termination of the employment agreement. The fact that Mr. Belcamp did not sign the receipt page but remained employed matters because it shows that the employer was okay with his failure to sign it meaning that, he was also okay with his failure to agree with the provisions of the handbook. This, therefore, exempts Mr. Belcamp from the provision that anything that gets brought into the company by the employees is subject to search—as such, searching his locker will be a violation of his rights. Question 5: Search parameters and seizure Involving the police at this point will amount to further complications to the investigation and processes of search because a reasonable cause has already established that the search can be done (Cavico & Mujtaba, 2016). When the police get involved, it becomes a legal process, and on their part, they will need to obtain a warrant for search in order to conduct the search on Mr. Belcamp's locker. Involving the police would also mean that the organization will have to hand over control of the investigation process to law enforcement. This means that the company loses investigatory jurisdiction and loses its evidence gathering ability. The warrant will mean a fresh investigation gets commenced, which could amount to the loss of critical evidence. Question 6: documenting the Chain of custody Chain of custody is a term that gets used to describe the process of collecting, retaining, and verifying logs regarding who was holding a particular piece of evidence and the stage at which the individual was holding it. The Chain of custody plays a critical role in establishing the validity of evidence (Badiye et al., 2019). The Chain of custody must be documented as the attorney for the defense could use the lack of documentation to argue that the evidence may have been corrupted as there is no information as to how it was held. References Alenezi, A., Zulkipli, N. H. N., Atlam, H. F., Walters, R. J., & Wills, G. B. (2017, April). The Impact of Cloud Forensic Readiness on Security. In CLOSER (pp. 511-517). Badiye, A., Kapoor, N., & Menezes, R. G. (2019). Chain of Custody (Chain of Evidence). In StatPearls [Internet]. StatPearls Publishing. Cavico, F. J., & Mujtaba, B. G. (2016). The Intentional Tort of Invasion of Privacy in the Private Employment Sector: Legal Analysis and Recommendations for Managers. International Journal of Business and Law Research, 4(3), 37. Clements, J. (2019). Privacy in the 21st Century: DNA and the Fourth Amendment. Guerin, L., & DelPo, A. (2017). Create your own employee handbook: A legal & practical guide for employers. Nolo. WRITING A CASE NOTE I. What is a Case Note? The basic difference between a case note, a comment, and an article is the breadth of the subject matter covered. A case note should analyze a single case. In contrast, a comment addresses an area of the law, focusing on specific issues, cases, and legislation. An article is broader still and, unlike a case note or comment, is a non-student legal essay written either by a noted legal authority or a person with expertise in a certain area. In selecting a case that merits analysis, the Law Review Staff looks for a “noteworthy” case. A case of first impression or a case that represents a significant departure from precedent both qualify as “noteworthy.” Please note, however, that a selected case may merely present a “noteworthy” aspect. For example, a case where the court reached the right conclusion for the wrong reasons also qualifies as “noteworthy.” The following list of possible “noteworthy” aspects should assist you in understanding this fundamental feature of a case note. • An area of significant concern. • The possibility of intriguing results in later cases. • The court ignores logical reasoning or common sense. • The court fails to follow the majority of jurisdictions. • The first case in a newly legislated area. • A likely effect on an extra-legal area such as business, consumers, employment, or education. Note: A case note does not have to address every aspect or issue in the selected case but should address all those that are significant. II. Where do you begin? The Law Review Staff suggests the following plan of attack. First, read the case carefully and attempt to recognize and fully understand the “noteworthiness” of the case. Second, read all relevant authority cited by the court. Third, check the court’s use of authority for accuracy. Fourth, if available, read the briefs of counsel to familiarize yourself with the opposing arguments. Additional guidance and authority may also be found elsewhere – treatises, law reviews, etc. III. How is a case note organized? A quality case note requires good organization and clear analysis. The Law Review Staff believes one lends itself to the other. Generally, a case note is divided into topical sections. The following organization is a flexible guideline. You may wish to refer to other law reviews for alternative organizations. The particular format you use matters less than the format’s contribution to the readability and substance of your note. A. Introduction. Briefly introduce the reader to the area of the law and the organization of the case note. Begin forcefully, a few lines may suffice. Explain the “noteworthiness” of your case. B. Facts. Include only the relevant facts presented in a clear, concise, and interesting manner. The idea is to focus the reader’s attention on those critical facts controlling the issue(s). Remember, courts often distinguish cases on their facts. Also, describe the lower court’s holding, appeals, and any subsequent action. C. Holding. State the court’s holding on each relevant issue. D. Background or Discussion of Prior Law. In this section, provide the reader with the relevant background law relating to the issues regardless of whether discussed in the decisions. Describe the existing law and its development. In closing this section, relate the selected case to the prior law to illustrate how, if at all, the selected case affects prior law. E. Reasoning or Analysis. Describe and critically analyze the court’s reasoning and decision. Remain objective, but do not be afraid to express original ideas. If by some accident the reasoning makes sense, say so and support your conclusion. If not, say so and support your conclusion. Present in its full context the law as you contend it is or ought to be. If appropriate, attempt to predict the impact your case will have on future decision. Furthermore, address any ambiguous statements made by the court and questions the court left unanswered. This section affords you the opportunity to demonstrate legal skill and prowess by dissecting the case and raising important issues involved. F. Conclusion. This section is reserved for your exclusive use as an author. Just as each topical section requires a conclusion, so should the case note itself. Bring your case note full circle, reinforcing the “noteworthiness” of the selected case. IV. Final Comments The Montana Law Review attempts to provide research, information, and original thinking to our readers. We do not attempt to instruct judges, courts, or the legislature. You must support your statements fully by logic, authority, or, where possible, by both. Know the law. If you cite to a case, be certain the case stands for the proposition or rule of law you intend. Do not depend on or cite to the head notes. While you need not agree with the court, remember you need not always disagree. Running Head: INVESTIGATION PROJECT 1 INVESTIGATION PROJECT 5 Investigation Project 2 Juwane Brown CCJS 321 Digital Forensics 05/27/2020 Investigation Project Provincial Worldwide wishes to investigate the work area of one of the former employees, Mr. Belcamp. His employment contract was terminated validly, but the company's management suspected possible concerns when the employee was leaving. The permission to search his work area is provided in the employee code of conduct, which informs workers that they can be searched randomly within the company. This has been provided to mitigate incidents of theft in the company. The work area of the former employee belongs to the company, and, therefore, it is subject to search because it is not a private property of Mr. Belcamp. Physical Evidence-Digital Evidence One of the digital evidence in the work area is an external hard drive. The device represented physical evidence and can store digital information such as files, pictures, and videos. It is not connected to a power source and, therefore, not in use. A USB drive is noticeable in the middle of the picture. It is physical evidence that can store data with low memory capacity. Examples of information can include short files, audio clips, and images. On the left side of the picture is a Dell laptop. This is real evidence that carries a range of information. It can trace the activities of the users for a specified duration. A computer can give meaningful information on the sites that the user visited, and what the user did on these sites (Joint Committee Report, 2016). There is also a desktop computer on the right hand of the picture. Although it is not portable like a laptop, the functionality of the two is similar. The desktop computer is real evidence that can give details on the activities of the users. It can store important data such as videos, audio clips, Microsoft files, and pictures, among other forms of information. The steps of collecting the external hard drive will entail taking a photograph. The investigator needs to have gloves while handling the device and package it in anti-static packaging. The storage of digital evidence should be in a package that prevents breakage or any form of damage (MacNeil, 2015). The packaging material should then be labeled appropriately. The procedure for collecting the laptop should start by taking its photograph. It should then be checked if it is running or switched off. The screen should then be observed for possible running programs. The media ports and DVD tray should also be checked for possible portable devices (MacNeil, 2015). If none is identified, the laptop should be packaged in static shock protective bags ready for transportation and further analysis. Non-Digital Evidence One of the notable non-digital evidence in the photo is a sticky note. On it is written "Purple 743." This note is real evidence that may be a password for any of the identified digital devices. Slightly below the monitor is a NASA notepad, which is physical evidence. The note contains the scheduled activities of the former employee. The activities are calling Maria and Bob and checking storage. There is a document folder above the monitor. It is real evidence that could contain letters, passwords, and other contact information. Latent figure prints can be collected as real evidence from the work area. This form of evidence can provide evidence that is required to prove that, indeed, the scene was the work area of Mr. Belcamp. The procedure for collecting and storing the document folder will begin with taking its photograph. The evidence should be packaged in a secure bag and document it on the custody log (Joint Committee Report, 2016). The figure prints can be collected from several areas. They include keyboards, on the desk, and from the mouse. Security Procedures in Transportation Digital evidence should be stored in cardboard boxes or anti-static bags. The evidence needs protection from extreme temperature and humidity since these weather conditions can destroy the devices or compromise the data. The evidence should be locked in the storage area, which needs to be secured appropriately. The access to this area needs to be controlled strictly to prevent theft or to tamper with the devices. Evidence Custody Brian's description is incomplete. The model of Olympus is given, but it is not captured in the report. All collected items in evidence gathering should be described thoroughly and accurately (MacNeil, 2015). Brian misses the dimensions of the Olympus. The information on the external hard drive is scanty. It should include the measurements and serial number, which is SATA drive 64 MB cache. References Joint Committee Report. (2016). JTC Resource bulleting: Managing digital evidence in courts. Retrieved from https://www.ncsc.org/__data/assets/pdf_file/0017/18521/digital-evidence-3-14-2016-final.pdf MacNeil. T. (2015). Police opinions of digital evidence response handling in the state of Georgia: An examination from the viewpoint of local agencies’ patrol officers. Retrieved from https://nsuworks.nova.edu/cgi/viewcontent.cgi?referer=https://www.google.com/&httpsredir=1&article=1369&context=gscis_etd Running head: UNDERSTANDING INVESTIGATIVE PARAMETERS 1 UNDERSTANDING INVESTIGATIVE PARAMETERS 5 Understanding Investigative Parameters Juwane Brown CCJS 321 05/19/2020 Understanding Investigative Parameters Question 1: Forensic readiness Forensic readiness refers to an organization's ability to maximize its ability to make use of digital evidence while keeping the investigation costs at a minimum. A plan for forensic readiness has several benefits. These include; providing a sense of information security to the customers by showing compliance with the set regulations, due diligence, and good corporate governance (Alenezi et al., 2017). It also improves the confidence of investors and stakeholders that the company will not be faced with data breaches because the threats to the security of data in the company are taken seriously. The requirements for establishing forensic readiness include identifying the evidence type and potential sources of evidence, which helps in streamlining the process of planning the evidence to help the investigators in capturing the forensic artifacts that are short-lived like computer RAMs. Another requirement is establishing the ability to gather and secure evidence in a forensic way. Forensic investigations need to get done in an approved and organized manner, which entails collecting evidence without corrupting it. Question 2: Gathering digital evidence The Fourth Amendment of the United States Constitution protects individuals against searches that meet certain criteria like being unreasonable, as well as seizures in their property (Clements, 2019). However, it also provides an exception in instances where there is probable cause. In this case, therefore, the statements that were made by Mr. Belcamp in his exit speech implied that he had the intention to do something against the organization, amounting to probable cause. Therefore, searching for any digital evidence from Mr. Belcamp's locker is justified as it is necessary to ensure that the employee does not act upon his threats to the company, as implied in his statements. A warrant of search is not necessary as a reasonable cause has been established. However, the company needs to first confirm if there are any special laws regarding the search, especially because Mr. Belcamp was no longer their employee. Question 3: obtaining evidence Security cannot be allowed to search Mr. Belcamp's suitcase and retrieve any evidence. The Fourth Amendment protects him because of several reasons. The company had already fired him, and as such, he is a private citizen whose rights get protected against violation (Clements, 2019). Obtaining any evidence from him without a warrant, in this case, would be a violation of his rights. The security personnel will be required by the constitution to treat him like they would treat any other visitor to the company. Question 4: Employee handbook An employee handbook provides details of the policies, values, and expectations for the employee. Also, it protects the employer if any legal nature issues arise in the course of the employment relationship (Guerin & DelPo, 2017). An employee must sign the receipt to show that he agrees with the provisions in the handbook. However, they cannot be forced by the employer to sign it though the move could amount to termination of the employment agreement. The fact that Mr. Belcamp did not sign the receipt page but remained employed matters because it shows that the employer was okay with his failure to sign it meaning that, he was also okay with his failure to agree with the provisions of the handbook. This, therefore, exempts Mr. Belcamp from the provision that anything that gets brought into the company by the employees is subject to search—as such, searching his locker will be a violation of his rights. Question 5: Search parameters and seizure Involving the police at this point will amount to further complications to the investigation and processes of search because a reasonable cause has already established that the search can be done (Cavico & Mujtaba, 2016). When the police get involved, it becomes a legal process, and on their part, they will need to obtain a warrant for search in order to conduct the search on Mr. Belcamp's locker. Involving the police would also mean that the organization will have to hand over control of the investigation process to law enforcement. This means that the company loses investigatory jurisdiction and loses its evidence gathering ability. The warrant will mean a fresh investigation gets commenced, which could amount to the loss of critical evidence. Question 6: documenting the Chain of custody Chain of custody is a term that gets used to describe the process of collecting, retaining, and verifying logs regarding who was holding a particular piece of evidence and the stage at which the individual was holding it. The Chain of custody plays a critical role in establishing the validity of evidence (Badiye et al., 2019). The Chain of custody must be documented as the attorney for the defense could use the lack of documentation to argue that the evidence may have been corrupted as there is no information as to how it was held. References Alenezi, A., Zulkipli, N. H. N., Atlam, H. F., Walters, R. J., & Wills, G. B. (2017, April). The Impact of Cloud Forensic Readiness on Security. In CLOSER (pp. 511-517). Badiye, A., Kapoor, N., & Menezes, R. G. (2019). Chain of Custody (Chain of Evidence). In StatPearls [Internet]. StatPearls Publishing. Cavico, F. J., & Mujtaba, B. G. (2016). The Intentional Tort of Invasion of Privacy in the Private Employment Sector: Legal Analysis and Recommendations for Managers. International Journal of Business and Law Research, 4(3), 37. Clements, J. (2019). Privacy in the 21st Century: DNA and the Fourth Amendment. Guerin, L., & DelPo, A. (2017). Create your own employee handbook: A legal & practical guide for employers. Nolo.