For the purposes of this scenario, you are employed as a digital forensics examiner at an
international technology development corporation. A competitor has produced a product
with exactly the same features and capabilities as a product being development by your
corporation over the past several years. It was discovered an employee who resigned
from your corporation was recently hired by the competitor to lead business development
for their new product line. The former employee was determined to have access to
proprietary information relating to the sensitive product development. Corporate policy
requires digital forensic images be maintained by the IT Department for any media
devices of former employees who are terminated or resign from the corporation. The
corporate IT department at your corporation conducted a review of active files contained
on the digital media utilized by the former employee. No suspicious information was
identified.
As an integral component to the investigation of possible intellectual property theft relies
on a review of all digital media related to the former employee and the CEO of your
corporation has requested that a digital forensic examination be conducted. The primary
interest relates to any evidence that the former employee removed sensitive information
from corporate servers using removable media. The digital media to be examined
includes digital forensic images of two removable media devices. In addition to the
existence of any sensitive materials or information, any indications of the file date
information would be extremely valuable to establish the time period when the
intellectual property was transferred from your corporation. The chief legal officer of the
company has authorized the review of the digital media files for forensic examination and
has confirmed the authority for the examination is based on a signed employee consent
agreement. Corporate policy allows you to utilize any software application validated for
digital forensic acquisition or analysis.