Reference no: EM132919538

Assume that you're a Forensic Investigator given the following case.

On March 2, 2015, the police have received a report about child pornography activities relating to Craig Smith, a 17-year-old boy in Virginia. After obtaining a search warrant of Craig's house, police forensics investigators confiscated his computer, external hard drives, mobile phone, and digital camera. In the beginning, it became evident that a significant amount of the evidence on his computer, digital camera and mobile phone have been erased on January 21, 2015. The investigators could recover some data and retrieve evidence from his computer. Although when investigators tried to use CD/DVD burner to burn a session the burn process was aborted, a table of contents has been created to track the events.

During the data collection phase, it has been recovered that some hackers have hacked into the Craig's system on January 18, 2015. The hackers have attempted to break into the back door of his computer which has been left due to a previous cyber-attack. The investigators have found the IP address relating to some unknown users that expose child pornographic contents.

The investigators have tried to retrieve some graphic files from Craig's digital camera and mobile phone. Large number of graphic files in raw format taken between January and February 2015 have been collected from his digital camera. Though, some data have been erased or recognised as unknown and could not be recovered. Craig's mobile phone have been seized to collect some data about contacts, text messages and photos, but the investigators have found that the phone have been reset on January 19, 2015, and therefore some data have been erased. The police forensic investigators have found some image editing tools, like Photoshop, and steganographic applications on his mobile phone that have been used by Craig frequently.

Given the scenario and seized pieces of evidence by the investigators, it is your role as an investigator to prove or disprove the allegations of any criminal activities, but also of evidence tampering. Answer the following questions in relation to the scenario given. In your answers, you may wish to consider the following points:

** It is critically important that you explain why a specific digital forensic evidence from the scenario falls into a particular category, such as network, email, operating system, etc.

** Sometimes a particular digital forensic evidence from the scenario can fall into multiple categories. If you wish to use a forensic evidence to answer a question, you must adapt your answer to discuss how the forensic evidence is related to the particular digital forensic investigation.

Questions.

1. Identify and discuss any digital evidence relating to the Craig Smith's graphic files as outlined in the scenario. Make a recommendation on how to search for the evidence, and any appropriate tools can be used, including pros and cons of the tools,

2. Discuss the steps that need to be taken to collect the evidence relating to the allegation and any challenges or issues that you might face.