Reference no: EM133389209

Question: You have been brought on-site to help law enforcement in a digital forensics case. They have a desktop computer they want to bring into evidence in a case involving an insider conducting a network attack. They believe that the user had become disgruntled when passed over for a recent promotion and may have launched an attack from their PC. You start a chain of custody record and photograph the scene. You take the computer into your care and place it into a secure bag and take a photo. The bag is tagged with the chain of custody record. You take the computer to your secure facility for a forensics audit. You quickly find that the malware was downloaded through a thumb drive and uploaded to the network. You call law enforcement with the findings and turn it over to the district attorney's office. During the court appearance you are summoned to take the stand. The user is denying that they had installed the malware and are insisting that someone has set them up. You discuss the findings with a judge, but there is no video evidence showing the user was at their computer during that time period. The case ends up being thrown out. what should you aim to accomplish with future forensic investigations?