Part I Checkpoint: Scope, Stages and First Moves
Where you are: Part I — Foundations of Computer Forensics · Checkpoint · This checkpoint brings together Chapters 1 and 2.1 of Dr. Al-Doori's IT Forensics Essentials: the definition and uses of forensics, the roles of a computer in crime, the four stages and the scope of authority.
Part I Checkpoint: Scope, Stages and First Moves
You have finished Part I. This checkpoint gives you three short, realistic situations. For each one, read the scenario, choose what you would do, and then read the model answer. There is no score to record. The goal is to practice the judgment you will use for the rest of the course. Allow about 12 minutes.
All people and organizations below are fictional.
Scenario 1: The Helpful Technician
A small accounting firm suspects that an employee, Daniel, has been altering invoices. Before calling anyone, the firm's IT technician logs into Daniel's computer "to save time", opens the accounting folder, sorts the files by date, copies the ones that look odd to a USB stick and emails them to the managing partner. He then calls in a forensic examiner.
What is the most important problem the examiner now faces?
Model answer: b. Logging in, opening folders and copying files all change the computer's records, such as access times and log entries. The copies on the USB stick and in the email have no hash and no chain of custody, so their integrity cannot be proven. The examiner can still image the computer now and document what the technician did, but the firm has made the case harder. Option a misses the point: more copies made the same way would not help. Options c and d ignore integrity: that the copies are identical to the originals is exactly what can no longer be proven.
Scenario 2: Name the Role
Police investigate a burglary ring. They examine three devices: a laptop used to research which owners were away, from holiday photos they posted online, and which of their homes had smart alarms; a phone whose GPS history places it outside each burgled house on the right nights; and a home router that a member of the ring had hacked to disable a victim's smart alarm.
Which option correctly matches the devices to their main role, in the order laptop, phone, router?
Model answer: d. The laptop holds the research used to choose and plan the burglaries, so it is a store of evidence (and was a planning tool). The phone's GPS history corroborates presence at each scene. The router was the target of a hacking attack; the device the attacker used to hack it, not the router, was the instrument. Real cases rarely fit one neat category, which is exactly the book's point that the categories overlap. Options a, b and c mislabel at least one device.
Scenario 3: The Discovery Outside Scope
You are a forensic examiner analyzing a company server under a court order that authorizes a search for evidence of a specific data theft between March and May. While examining the image, a keyword search returns hits in a folder of emails from last year that appear to discuss bribing a public official.
What should you do?
Model answer: a. The order covers a specific theft in a specific period. Reading unrelated material from another year (c) goes beyond scope and could make it inadmissible. Deleting results (b) would destroy evidence and break the rule that your work must be repeatable. Copying evidence to a personal drive (d) breaks the chain of custody and probably the law. Record what happened, stop, and let the person in charge seek new authority, as the book advises with its fraud-and-drugs example.
Before You Move On
If any of these felt uncertain, revisit the lesson behind it: Lesson 1.3 for the roles of a computer in crime and why browsing destroys evidence, and Lesson 1.4 for the four stages, the chain of custody and the scope of authority. Next, Part II looks at the technical foundations, starting with how a hash value proves that a copy is exact.
Sources
- Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapters 1–2.1
- IETF — RFC 3227: Guidelines for Evidence Collection and Archiving
- Digital Detective — ACPO Good Practice Guide for Digital Evidence (principles)