A. A key employee leaves your clients company to go to work for a competitor. Six weeks later the employee is spotted at a trade show with a new product on display that appears in many respects to be very similar to a new product design your client’s company was developing, but had not yet released.  Suspicion is very high that somehow, the competing company was privy to your company’s design.  The logical connection is the employee. 

How can we determine if the competitor’s new product release is based on your company’s proprietary work product?

B. Company IT personnel call and report that in the process of upgrading one of your employee’s computer’s they found pornography.  They tell you their investigation reveals that the employee is responsible for the pornography as it was downloaded during the employees normal work hours and at his work station.  The employee is questioned about his computer use and he denies ever viewing pornography on his work computer.

Is he telling the truth?

C. A company employee operating a forklift in the company warehouse is killed when the forklift rounds a corner, looses control and topples highly stacked pallets of inventory.  It is reported to investigators that employees have made previous complaints to the warehouse foreman that the forklift had faulty brakes and that inventory was being stacked too high.  The warehouse foreman states that he has never received such complaints.   

Is he telling the truth? 

Part 2 : The class next discusses the proper responses for the preservation of evidence in these types of scenarios.

A. Who should have access to the computer(s) in question?

B. Treating the computer as a potential piece of evidence

C. Internal vs. Neutral 3^rd Party Investigations

D. Choosing a Neutral 3^rd Party Expert

E. Using forensics software to make mirror copies of computer media and why it is important

F. Hash values of mirror copies and why it is important

G. Why a proactive approach is wise

Part 3 : The class next discusses what things are involved in a forensics examination of computer media, which includes basic instruction on:

A. How computers store information

Hard Drive Basics

Tracks and Sectors

Slack Space

Unallocated File Space

What does Reformatting do?

B. How the Internet works

Internet Protocols Explained (What is an IP Address and Why Does it Matter?)

Tracing Internet Activity

C. How some common Internet applications work

The World Wide Web explained and common issues resulting from WWW use

File sharing applications explained and common case types/issues with these applications

Instant messaging applications and common case types/issues with these applications

E-mail (Internal applications contrasted with Internet based e-mail servers)

D. How forensics tools work and what they can reveal

Popular forensics tools compared and explained. What forensics tools do and don’t do

The Examination Process as an Investigative Process : Time lines of activity and how they assist in establishing individual use. Internet use history. E-mail recovery. Meta Data. Recovering files from deleted file space. Data recovery vs. investigating an incident.

Documentation of Findings

Part 4 : The class returns to the three fact scenarios discussed at the beginning of the class.  Applying the new knowledge of the computer forensics process, the class reaches conclusions about what happened in each scenario and what evidence is available to support those conclusions.