Question

7. You are a computer forensics analyst that works for the security department of the large multinational ACME Corporation. The corporation has discovered that some of their company’s closely guarded future product plans have been leaked to a competitor. ACME believes that one or more of the employees in the research department must be responsible. Security have contacted law enforcement and they have agreed to assist security in raiding the research department to look for evidence. What are five things that should be done prior to the raid and why? What would we be searching for and where would we look to find it?

Answer 1

the fiev things that needs to be done before the raid

1. Be prepared about the raid like what you should be doing.

2.have the right tool to catch the suspect.

3.pre-dfeine the rule that need to be followed according to the organization

4.Study the log to have a list of suspect to catch from

5.carefully study the system log to get the details like who used the file or system when.

We should be here looking for the system log that will be having the details of the empployee that have accessed or copied the file recently and based on that we will be able to monitor the employee that might be under the suspect list, this log file will be in the system file or log events.