You are on page 1of 2

Scientific Questions – Ashley Myers

1. What is computer forensic analysis?


Computer Forensic analysis is an investigation dealing with computer devices with
gathering information and evidence concerning to the case to pursuit in court if needed.
2. What is a hard drive?
A hard drive is the main storage device located in a computer system used to store
software and files. A hard drive is hardware, which is a physical device within the
computer system, while software is a file obtained in the system.
3. What happens when a file is deleted?
Once you delete a file, it isn’t necessarily completely deleted. What happens is the
deleted file is used to store another file when the space is needed. The new file will
overwrite with new data and when that happens the deleted file be gone. Until then the
file still can be found on your disk.
4. Are you able to retrieve files after they have been deleted?
Yes.
5. What is a flash drive?
A small external storage device that can be transferred into a computer USB (Universal
Serial Bus) port to store files.
6. Do they operate similar to a hard drive?
Yes, they are both storage devices.
7. Are you able to retrieve deleted files from a flash drive?
Yes.
8. What is the first step in examining computer evidence?
The first step with examining computer evidence is to make a copy of the evidence; the
original evidence should remain preserved.
9. Could you please briefly explain how you analyze a flash drive?
You could analyze a flash drive using specialized software to recover files stored. You
use the copy of the original drive to analyze the image of the drive. The specialized
software helps create the image to use while examining the evidence.
10. Is this a new technique?
No.
11. Is this technique only performed in the SHU Crime lab?
No, this technique is universal.

Case Specific Questions

1. Did you have the opportunity to analyze evidence in the case vs Olivia
Bishop?
Yes.
2. What evidence did you receive?
I have received the flash drive and the files contained on the drive.
3. What did you do with the evidence once you received it for analysis?
(Chain of custody)
Once I received the evidence I copied the flash drive and created an image of the
drive and then secured the original flash drive.

4. Did you analyze the flash drive using the technique that you explained
earlier?
Yes.
5. What were the results of your analysis?
The files recovered contain Word Document files that contained evidence with data
that has been transferred to the competitor. The files were once deleted and then
accessed years after leaving the company. The documents reveal that the sensitive
data from her previous company were used again.

6. Can you say when those files were accessed?


Yes, September 24, 2006.

7. And was that date before the date that Ms. Bishop was terminated from
Conglomerate Industries?
No, that was two years after Ms. Bishop’s termination.

8. Are these the results included in your lab report?


Yes.
9. Thank you, I have no more questions.

You might also like