Assignment 2

Answer each of the following questions as thoroughly as possible, using resources to support your answers. Be sure to follow the format requirements.

• Locards exchange principle states, A criminal action of an individual cannot occur without leaving a mark. Explain what this principle means for digital evidence.Describe best practices that should be followed to ensure digital forensic practitioners dont leave their own marks on the evidence during collection and acquisition. You must use the provided course materials for at least one of the examples.
• Choose three items of digital evidence from the following list and describe what types of digital marks (artifacts) might be left by a user. (Laptop, Router, External Hard Drive, Thumb Drive, Smartphone, Gaming Console, IoT devices, Home Surveillance Systems, Vehicles)
• How can examiners/investigators use this information to prove or disprove the allegations under investigation?
• What actions should a digital forensic professional take when encountering a running (live) laptop? What beneficial data may be found on the live system that would not be found on a powered off (dead) system?

1. What is a hash value and what does it mean to hash data?

• Describe two ways hash values are used by digital forensic practitioners.

1. Describe Chain of Custody and detail its importance in the Criminal Justice process.

Format Requirements:

• Assignment must be double spaced, 11 or 12 pt font and 1 margins all around.
• All APA 7th edition format requirements must be followed (cover page, in text citations, reference page). Refer to the APA information found in Content -> Course Overview -> Course Resources.
• You must have resources to support your thoughts/opinions/information. These must be cited both in text as well as at the end of the document. Your paper should not contain direct quotes, sourced material must be paraphrased.

Course Outcomes:

• recognize, collect, and preserve digital evidence for forensic analysis
• develop an evidentiary file that properly documents analytical processes and results to prepare for case presentation and testimony.