312-49 · Question #277
A suspect is accused of violating the acceptable use of computing resources, as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed…
The correct answer is A. Image the disk and try to recover deleted files. The most forensically sound and feasible approach is to create a forensic image of the disk and attempt to recover deleted files. When files are deleted in most operating systems, the data is not immediately overwritten - only the file system entry is removed. Forensic tools…
Question
A suspect is accused of violating the acceptable use of computing resources, as he has visited adult websites and downloaded images. The investigator wants to demonstrate that the suspect did indeed visit these sites. However, the suspect has cleared the search history and emptied the cookie cache. Moreover, he has removed any images he might have downloaded. What can the investigator do to prove the violation? Choose the most feasible option.
Options
- AImage the disk and try to recover deleted files
- BSeek the help of co-workers who are eye-witnesses
- CCheck the Windows registry for connection data (You may or may not recover)
- DApproach the websites for evidence
How the community answered
(53 responses)- A75% (40)
- B8% (4)
- C13% (7)
- D4% (2)
Explanation
The most forensically sound and feasible approach is to create a forensic image of the disk and attempt to recover deleted files. When files are deleted in most operating systems, the data is not immediately overwritten - only the file system entry is removed. Forensic tools (e.g., Autopsy, FTK, Sleuth Kit) can recover deleted browser artifacts, images, and cache files. This method produces court-admissible evidence and preserves the integrity of the original drive. Eye-witnesses are unreliable, the registry may or may not have relevant data, and approaching websites introduces third-party cooperation issues.
Topics
Community Discussion
No community discussion yet for this question.