Answer 6 questions in paragraph format about Computer Forensics.

Project #1 – Understanding Investigative Parameters

• No directly quoted material may be used in this project paper.
• Resources should be summarized or paraphrased with appropriate in-text and Resource page citations.

Scenario Characters:

You: Information Security Analyst, Provincial Worldwide

Ms. Carol McPherson: Information Security Director, Provincial Worldwide (Your supervisor)

Mr. Harold Newman: Human Resources Director, Provincial Worldwide

Mr. John Belcamp: (former) engineer, Product Development Division, Provincial Worldwide

Ms. Evelyn Bass: Product Engineering Manager; Product Development Division, Provincial Worldwide (John Belcamp’s Supervisor)

**Characters will carry through Project 1, 2 and the Final
Project. However, please remain conscious of who you are/what roll you
play in EACH project and in regards to specific questions.

For the purposes of this project, imagine you are a Corporate
Security Analyst, an employee of Provincial Worldwide and assigned to
the company’s Corporate Protection Team.

In this case, you have been notified by Mr. Newman, Human Resources
Director for Provincial Worldwide, that the company has just terminated
Mr. John Belcamp, a former engineer in the company’s New Products
Division, for cause (consistent tardiness and absences from work). Mr.
Newman tells you that during Mr. Belcamp’s exit interview earlier that
day, the terminated employee made several strange statements that seem
to elude to a current program the company is working on.

Mr. Belcamp’s statements made Mr. Newman fear he might be taking
Provincial’s intellectual property with him to his new employer
(undoubtedly a competitor). In particular, Mr. Newman is worried about
the loss of the source code for “Product X,” which the company is
counting on to earn millions in revenue over the next several years. Mr.
Newman provides you a copy of the source code to use in your
investigation. Lastly, Mr. Newman tells you to remember that the Company
wants to retain the option to refer the investigation to law
enforcement in the future, so anything you do should be with thought
about later potential admissibility in court. He tells you that in a
conversation with other Corporate executives that their understanding of
the investigative technological issues and how they have anything to do
with a person’s right as an employee seem a bit lacking; so you will
need to be detailed in any explanation.

The Fourth Amendment to the U.S. Constitution reads, “The right of
the people to be secure in their persons, houses, papers, and effects,
against unreasonable searches and seizures, shall not be violated, and
no warrants shall issue, but upon probable cause, supported by oath or
affirmation, and particularly describing the place to be searched, and
the persons or things to be seized.” While the Fourth Amendment is most
commonly interpreted to only affect/restrict governmental power (e.g.,
law enforcement), the fact that a formal criminal investigation is a
possibility (and the Company has no desire to be named in a civil
lawsuit) means you must consider its effect to your actions.

With the above scenario in mind, thoroughly answer the following
questions (in paragraph format, properly referring to and citing
materials used in this course as well as outside research, where
appropriate, and within a reference page at the end of the project
paper).

1. Prior to any incident happening, it is important for any company
to implement a “forensic readiness” plan. Discuss the benefits of a
forensic readiness plan and name what you believe are the top two (2)
requirements to establish forensic readiness within a private sector
business like Provincial Worldwide. Support your answers. (Please note
that while cyber security and digital forensics have overlaps in
incident response preparation, please limit your answers here to forensic readiness in the digital forensic arena, not cyber security.)

2. Ms. McPherson, out of concern for the theft/sharing of the
“Product X” source code, and after discussing the issue with one of the
Corporate attorneys is requesting that you and Ms. Bass start searching
the areas in which Mr. Belcamp had access within the building. Can you
or Ms. Bass search Mr. Belcamp’s assigned locker in the Company’s
on-site gym for digital evidence, and why? Additionally, can you or Ms.
Bass use a master key to search Mr. Belcamp’s locked desk for digital
evidence, whether still on site, or after Mr. Belcamp has left the
premises? Support your answer.

3. A check with security confirms that John Belcamp passed through
the security checkpoint when coming in to work in his vehicle. A sign
at the checkpoint states that the purpose of the checkpoint is for
security staff to check for weapons or other materials that may be
detrimental to the working environment and employee safety. Screening
is sometimes casual and usually consists of verification of an
employee’s Company ID card. Can security staff at this checkpoint be
directed to open Mr. Belcamp’s briefcase and seize any potential digital
evidence, why or why not? Support your answer.

4. There is a page in the Company’s “Employee Handbook” that states
that anything brought onto the Company’s property, including the
employees themselves, are subject to random search for items belonging
to Provincial Worldwide. There is a space for the employee to
acknowledge receipt of this notice. Mr. Belcamp has a copy of the
handbook but never signed the receipt page. Does that matter; why or why
not? Explain.

5. The police have not been called or involved yet, however, Mr.
Newman asks if involving the police will change your incident response.
Describe how you will respond to her concerning the parameters of search
and seizure, and if it will change by involving the police in the
investigation at this time. Support your answer.

6. You know as an Information Security Analyst that it is important
to document the details of your investigation if the company wants to
insure admissibility of any evidence collected in the future. However,
Mr. Newman or Ms. Bass have never heard of the term “chain of custody.”
How would you explain what chain of custody means, why it is important,
and what could occur if the chain of custody is not documented. Support
your answer.

Project Requirements:

Each question should be answered thoroughly looking at all the issues presented, so do your research, be specific, be detailed, and demonstrate your knowledge; submitting your project through the appropriate assignment folder.

This project should be submitted in a single Microsoft Word document (.DOC/.DOCX), with answers separated and/or numbered in respect to the question, so as to make it clear which question is being answered. It may be in a question and answer format, or as described with answers to the associated question numbers;

The paper should be written in third-person grammar, not first person (which means – I, me, myself, etc.);

The submission is to have a cover page that includes course number, course title, title of paper, student’s name, and the date of submission per APA writing format;

Format: 12-point font, double-space, one-inch margins;

• It is mandatory that you do some research, and utilize outside

resources! You must have a reference page at the end of your project

that is consistent with APA citation style and format