DIGITAL FORENSICS

There’s been a turn of events. Dan, who was supposed to stand as an
expert witness in a criminal trial, can’t make it. This is only your
second time standing in as a witness, and you better not mess it up this
time!
So, you’ve been retained as an expert witness for the defense. Your
examination of the digital evidence, primarily photos and some Microsoft
Word documents, shows that the defendant did not send files containing
account information to his home computer. You prove this with the
header information in the backup files of the emails on the corporate
server and an examination of the client’s home computer.
The prosecution is attempting to show that, in your first case that
you testified in, you botched an email collection in a civil case. How
are you going prove that you are accurate in this case?
Write your response to the attorney’s question that provides your
qualifications for testimony as a digital forensics investigator and
then describe an overview of your process for capturing and examining
the header information. Use your own words and not a published list.
The language should be easily understood by the people in the courtroom
(they are not forensics experts so avoid technical jargon).

Last Completed Projects