Delos Santos, Karen M.

Criminology 4-1

QUESTIONED DOCUMENT EXAMINATION

Problem 1
A. Identification of the different characteristics of peso bills of different denominations
B. Differentiate authentic peso bill from counterfeited money (Bill)
C. Identifies from among the exhibit which one is authentic, and which is not ?
D. Compare by describing the following exhibit:

Exhibit 1 A - 20 peso Exhibit 1 B - 20 peso

Exhibit 1 A - 100 peso Exhibit 2 B - 100 peso

Exhibit 3 A - 1$ Exhibit 4 B - 500 peso

Exhibit 4 A - 500 peso Exhibit 5 B - 1000 peso

Exhibit 5 A - 1000 peso Exhibit 5 C - 100 peso

Answers:
Authentic Fake
Exhibit 1 A - the 20 peso bill is original Exhibit 1 B - the 20 pesos bill has no
because when put inside the ultra violet more to be seen in the ultra violet.
we saw the mark, has fiber and have a
serial number
Exhibit 2 A - The 100 pesos bill is original Exhibit 2 B - the 100 pesos bill here is no
because the symbol of animals and the mark that can be seen in the ultra violet.
color is variable and the paper is not thin
or soft.
Exhibit 4 B - the 500 pesos bill is also a
thin paper and has no mark that can be
seen in the ultra violet.
Exhibit 4 A - the 500 peso bill is also Exhibit 5 B - the 1000 peso bill can really
original and have serial number. determined that it has a fake money
because the paper is too soft and has no
man.
Exhibit 5 A - the 1000 peso bill is also
original that can be seen in the ultra
violet because a have serial number and
has fibers.
Exhibit 5 C - the 100 peso bill is also
original

Problem 2:

Examine Exhibit 1 and 2 and describe its general and individual characteristics:

Look into the following:

Conventional spacing between letter to letter - page 1 to 7 has the same number of
spacing 1mm

Conventional spacing between one word to another word - 5mm

Height of the letter - 10mm for Capital letters, 5mm for lowercase letter.

Consistency of the formation of the letters in the writings - Consistent

The direction of wringing (straight or slant) - Straight

Identify if its cursive or hand printed - Hand printed

And describe if all the pages from 1 to 7 are written by one and the same person,
support your answer by your findings. - The handwritten of page 1 to 7 has the same
and consistent, and it has a same size of letters. It has straight direction and also the
hand printed.
Karen M. Delos Santos
Criminology 4-1

CYBERCRIME

Recovering Files Using Autopsy

Step 1: Check for the any encrypted files in the desktop, we use FTK image
for the USB flash drive image at opening the application select new case,
entered the name, save it in desktop, case no, selected data source type
EO1.

Step 2: recover the deleted files and extract it to the flash drive, after
extracting check for the signature of files or any encryption. Then drag the file
to application to show the original file extension of the files.

Step 3: using the autopsy , create a case, select ingest module, basic autopsy
familiarization, select type of data source (evidence) we click the disk image
or VM file, select data source we check all the type so that it can read all form
of files and extension, and exclude some data or files that is encrypted ,
configure ingest module, add data source, and then click finish, we use also
autopsy too look for metadata of the evidence.

Step 4: compare the harsh value of the recovered evidence to the recovered
imaged file if they are the same to know if its altered or any modification has
been made and the digital evidence have the same hash value.