Project 2 – Identifying and Collecting Digital Evidence
CCJS 321 Digital Forensics
University of Maryland University College
July 18, 2015

Project 2 – Identifying and Collecting Digital Evidence
1. What permissions/authorities should you have before you search Mr. Yourprop’s former Company work area, and how would you document that authority?
Generally speaking, an employer can search an employee’s desk or work area without expecting any legal repercussions. The desk is property of the employer, therefore the employee should not be entitled to a reasonable expectation of privacy in their work area (Privacy at Work: What Are Your Rights?, 2015). Even though this is generally the case, its best practice, by and large, to have …show more content…

The sticky-note at the bottom-left corner of the keyboard is the first piece of non-digital evidence to take. There is a phrase “Purple743” handwritten on it. By itself this piece of documentary evidence may not mean much, but it could be a password of some type or maybe even part of an email address (U.S. Department of Justice, 2008). To store and transport this item, it will be placed into a standard evidence bag and documented on the chain of custody. Next, there is a small notepad at the top-left corner of the keyboard. This documentary evidence has some notes on it about specific people Mr. Yourprop wanted to contact. If the individuals on the notepad could be found and contacted, they may have additional information about him and his intentions of stealing Product X. They might even become part of the criminal investigation. This notepad should be placed into a standard evidence bag and documented the chain of custody as well. Fingerprints are real evidence and could be a key piece of non-digital evidence to forensically establish that this was indeed Mr. Yourprop’s desk and work area (U.S. Department of Justice, 2008). The InfoSec Specialist of course would not be processing fingerprints themselves, though if they were to involve law enforcement this can be done. Law enforcement should check for fingerprints in multiple places: the digital evidence seized, the