3. Items Analyzed:

TAG NUMBER: ITEM DESCRIPTION:

012345 One Generic laptop, Serial # 123456789

4. Details of Findings:

^■ Findings in this paragraph related to the Generic Hard Drive, Model ABCDE, Serial # 3456ABCD, recovered from Tag Number 012345, One Generic laptop, Serial # 123456789.

1. The examined hard drive was found to contain a Microsoft® Windows® 98 operat­ing system.

2. The directory and file listing for the media was saved to the Microsoft® Access Database TAG012345.MDB.

3. The directory C:\JOHN DOE\PERSONAL\FAV PICS\, was found to contain 327 files containing images of what appeared to be children depicted in a sexually explicit manner. The file directory for 327 files disclosed that the files' creation date and times are 5 July 2001 between 11:33 p.m. and 11:45 p.m., and the last access date for 326 files listed is 27 December 2001. In addition, the file directory information for one file disclosed the last access date as 6 January 2002.

4. The directory C:\JOHN DOE\PERSONAL\FAV PICS TO DISK\ contained 34 shortcut files that pointed to files on floppy disks with sexually explicit file names involving children. The file directory information for the 34 shortcut files disclosed the files' creation date and times are 5 July 2001 between 11:23 p.m. and 11:57 p.m., and the last access date for the 34 shortcut files was listed as 5 July 2001.

5. The directory C:\JOHN DOE\LEGAL\ contained five Microsoft®Word documents related to various contract relationships John Doe Roofing had with other entities.

6. The directory C:\JOHN DOE\JOHN DOE ROOFING\ contained files related to operation of John Doe Roofing.

7. No further user-created files were present on the media.

5. Glossary: Shortcut File: A file created that links to another file.

6. Items Provided: In addition to this hard copy report, one compact disk (CD) was sub­mitted with an electronic copy of this report. The report on CD contains hyperlinks to the above-mentioned files and directories.

Ima Examiner

Ima d. Examiner

Computer Forensic Examiner Released by

Glossary

The following terms are included to assist the reader in understanding this guide.

Acquisition: A process by which digital evidence is duplicated, copied, or imaged.

Analysis: To look at the results of an examination for its significance and proba­tive value to the case.

Copy: An accurate reproduction of infor­mation contained on an original physical item, independent of the electronic stor­age device (e.g., logical file copy). Maintains contents, but attributes may change during the reproduction.

Digital evidence: Information stored or transmitted in binary form that may be relied on in court.

Examination: Technical review that makes the evidence visible and suitable for analy­sis; tests performed on the evidence to determine the presence or absence of specific data.

Forensically clean: Digital media that are completely wiped of nonessential and residual data, scanned for viruses, and verified before use.

Image: An accurate digital representation of all data contained on a digital storage device (e.g., hard drive, CD-ROM, flash memory, floppy disk, Zip). Maintains contents and attributes, but may include metadata such as CRCs, hash value, and audit information.

Network: A group of computers connect­ed to one another to share information and resources.

Original evidence: Physical items and the data objects that are associated with those items at the time of seizure.

REMEMBER:

A report is divided into four areas:

Terms of Reference - This section gives background information on the reason for the report. It usually includes the person requesting the report.

Procedure - The procedure provides the exact steps taken and methods used for the report.

Findings - The findings point out discoveries made during the course of the report investigation.

Conclusions - The conclusions provide logical conclusions based on the findings.

Recommendations - The recommendations state actions that the writer of the report feels need to be taken based on the findings and conclusions.

Reports should be concise and factual. Opinions are given in the "conclusions" section. However, these opinions should be based on facts presented in the "findings".

Use simple tenses (usually the present simple) to express facts.

Use the imperative form (Discuss the possibility ..., Give priority ..., etc.) in the "recommendations" section as these apply to the company as a whole.

TEST YOUSELVES: