PART I – ESSAY QUESTIONS 1

PART I – ESSAY QUESTIONS

1. Is it necessary for forensic examiners to understand how data is stored by various types of file systems? Explain why or why not. Support your answer with examples.

2. When examining evidence media, is it necessary to use the same operating system used on the original? Explain why or why not. Support your answer with examples.

3. Is the date-time stamp of various file system objects significant in the analysis of evidentiary media? Explain why or why not. Support your answer with examples.

PART II – SCENARIO

You are the digital forensic examiner at a pre-trial session with the judge and opposing counsel. You have been asked to explain the various methods that data is stored and erased in the Windows environment. Your discussion should include concepts such as slack space, unallocated space, the sequence of events that take place when a file is deleted, and any other points that you deem important. Keep in mind that you must prepare your discussion in terms that non-technical people can understand.

Written reports of no more than five pages are to be prepared in a professional manner using the APA style for your cover page and references. Format and neatness matter, as do spelling and grammar. Use one-inch margins, 12-point fonts, and double-spacing. Put page numbers on all pages but the first. Up to 30% may be deducted for work that does not meet professional standards.