Question

Suppose a large aerospace engineering firm has immediately hired you as a consultant to investigate a potential violation of corporate policy and data theft. You have been informed that an employee may have been using corporate email to send confidential corporate information to one or more personal email accounts, which may or may not belong to him. You have been told that this action has been happening each business day for the last 13 days and the employee is unaware of any suspicion.

Write an eight to ten (8-10) page paper in which you:

Explain, in detail, the initial actions you would take based on the provided information including formal plans to preserve the crime scene(s) and eventual transportation of evidence to a lab.

Analyze the physical and logical places where you would look for potential evidence on the suspect’s computer(s) and / or network servers.

Describe, in detail, how you proceed with the email investigation, including the review of email headers and tracing.

Describe the processes that would be utilized in order to recover data that may have been deleted from the suspect’s computer(s).

Identify the tools you would use to perform your investigation from beginning to end based on the information you have on the incident. Provide a brief overview of each tool, to include:

A description of the tool.

How you would use the tool in the investigation.

How the tool helps the investigation and the evidence you expect it to provide.

Why you believe the evidence the tool provides is critical to the investigation.

Use at least five (5) quality resources in this assignment. Note: Wikipedia and similar Websites do not qualify as quality resources.

Your assignment must follow these formatting requirements:

Be typed, double spaced, using Times New Roman font (size 12), with one-inch margins on all sides; citations and references must follow APA or school-specific format. Check with your professor for any additional instructions.

Answer 1

Explain, in detail, the initial actions you would take based on the provided information including formal plans to preserve the crime scene(s) and eventual transportation of evidence to a lab?

I am hired to investigate a potential violation of corporate and data theft. Now I am here to arrest that person who is doing this thing and he continue sending confidential data of the aerospace to some other person. The various steps which I want to know from the head which are very beneficial for the uplift of the case:

• Firstly I want to learn the case from beginning to the end.
• Secondly I talk each and every person record which is deposited in the office.
• Thirdly I personnel interact with each and every employee.

Nobody knows who is that person and the head of engineering department hired me so nobody knows about me also so I take some steps in order to arrest that person:

• Firstly I call the electrician and put some hidden area especially in that area which is the main department of the organization.
• Secondly I check the details for past 13 days and try to solve some mystery.
• Thirdly I try to check the IP address through which he send the mail and to which people.
• Fourthly I take a proof of finger prints which are left on the keyboard and send it to the forensic lab for further evidence.

Analyze the physical and logical places where you would look for potential evidence on the suspect’s computer(s) and / or network servers

Some places where I think we find some potential evidences are:

• Suppose the criminal left its important thing like handkerchief, some paper is thrown out of his pocket.
• Suppose we find some finger prints
• Find some shoes print on the floor.
• Suppose in the hurry the criminal is forgot to close the files from where he send that confidential data.

As the criminal perform some mistake so that he can catch by the police easily. So in order to catch the criminal the investigator has to start its enquiry from very deep so that no evidence is lost and every small evidence also help the investigator to catch the criminal.

Describe, in detail, how you proceed with the email investigation, including the review of email headers and tracing.

If I get some internet evidence then it becomes easy to trace the location of the criminal.

With the help of the IP address we can try to catch the criminals. This works like this as of the last 13 days we can read all the IP address and try to trace the location to which the criminal send the legal document and we arrest that person and from that we try to catch the criminal.

From that IP address we apply some tracing due to that tracing we get some clue.

Now the technology do much better so we have some of the software of anti-virus which tell us that a person who work on your computer take how much time, use which file, from that files used which type of information.

From this we come to know that how much time he take at which time this crime was done.

Describe the processes that would be utilized in order to recover data that may have been deleted from the suspect’s computer(s).

As the transferred data is deleted from the suspect’s computer we adopt some steps:

• Firstly we check for some backup process. If there should be a backup then we easily come to know.
• Secondly we try to find some clue what different activities are performed from the computer.
• Thirdly we check each employee family background detail we separate those employees whose family background are not so good.
• Fourthly we start do query with those and try to find that criminal.

Identify the tools you would use to perform your investigation from beginning to end based on the information you have on the incident. Provide a brief overview of each tool, to include:

• A description of the tool:

                                        The tool which I had to use in solving my case is:

• Firstly the hidden cameras.
• Secondly the IP address.

• How would you use that tool

                          So the tool which I use to arrest the criminal are:

• Firstly I put some hidden cameras in every room of the employee and also at the main office of the engineering team.
• Secondly the IP address which I use for tracking the person obtains and we put it confidential from every employee.
• How the tool helps the investigation and the evidence you expect it to provide.

Basically these two tools are used from beginning to end to catch the criminal.

Now to take the full advantage of the hidden cameras I said in front of every employee that I find the clue and from that clue I also come to know who the criminal is. I reveal it tomorrow morning. Now at the night the criminal try to finish all the clue and their details are captured in the hidden cameras.

Now the next evidence is the IP address which we taken from the sending e-mails. We get a lot of information from that also that the people who give the confidential information to them take money for this work from. When the investigator asked that what are you doing with this information then in order to reply there answer they said that they sell this information to the underworld don.

• Why you believe the evidence the tool provides is critical to the investigation

As both the tool provide a great help in solving the case. As we all know that the investigator tools are the best way to catch the criminal. If these tools are not available then from the small- small evidence are not sufficient for the solving of the case. It is same as at every step we need water to drink so at step of investigation we need a tool for proper investigation in a proper manner.

Yes the both the evidences help me a lot as the criminal whose pictures are in the hidden cameras and from IP address we also grab the same employee details. So from my point of view these tools are helpful in solving the case and are also proves critical to the investigation.

So in this way we catch the criminal.