Question

You are a computer forensics analyst that works for the security department of the large multinational ACME Corporation. The corporation has discovered that some of their company’s closely guarded future product plans have been leaked to a competitor. ACME believes that one or more of the employees in the research department must be responsible. Security have contacted law enforcement and they have agreed to assist security in raiding the research department to look for evidence.

What are five things that should be done prior to the raid and why?

What would we be searching for and where would we look to find it?

Answer 1

Five things that are done prior raid are:

1) Proper legal documents should be made according so there should not be any issues during raid

2)All the information regarding leaked documents should be analysed.

3) Identify the potential targets that coud be responsible for leakage of documents.

4)Access of all facilities should be revoked from research department.

5) Experienced team should be made to investigate and proper planning should also be there.

Personal computer and the place where documents are kept should be searched to find who is responsible for leakage.

Logs should be checked in computer to identify the possible date and time of leakage. Targets should be identified on the basis of logs . Security camera could be checked.All the personal email should also be checked for the research department and phone call records could also help.