WGU D431 TASK 1 - FORENSIC INVESTIGATION WITH COMPLETE SOLUTIONS!!
WGU D431 Evatee 7/8/24 WGU D431 lOMoARcPSD|13111427
2
WGU D431 TASK 1 - FORENSIC INVESTIGATION WITH COMPLETE SOLUTIONS!!
1.Discuss the strategy that your team will use to both maximize the collection of evidence and minimize the impact on the organization.
The first step in this process would be assembling the investigative team. We would then meet as a team to create a clear and succinct set of expectations for the investigative process. We would also meet with other organization heads within the company, such as IT managers, human resources, Senior Management, and the legal team. During this meeting, we would establish a clear understanding of what issues the company is facing and what allegations have been levied against Mr. Smith. It is important to understand the scope of our investigation and that it would be limited to the actions of Mr.
Smith, where he purportedly stole proprietary company information. These actions would be in clear violation of the company nondisclosure agreement as well as the acceptable use policy. In order to maximize the collection of evidence, we must discover what Mr. Smith has accessed and where he has been on the company network. By limiting our search to only those places where he has been, it will allow us to conduct a precise investigation and maximize the collection of evidence.
Of course, one of the most critical parts of an investigation is managing the investigation so that it minimizes the impact on the everyday business functions. By limiting our investigation to only those places where Mr. Smith has been, we would not need to interfere with other business segments allowing them to do business as usual. This would greatly minimize the impact to the organization.
2.Describe the tools and techniques your team will use in evidence gathering, preparation, and analysis.
After we have determined the structure and scope of our investigation, we will proceed to the collection of evidence. First we will review security footage, server and workstation logs to determine what Mr. Smith accessed and where it was accessed from. We will then secure those areas by photographing each workstation, the surrounding area, and what is displayed on the screens. We will then document everything we can see, such as what devices are plugged into the workstations. At this time, we will start the chain of custody for the evidence,
WGU D431 Evatee 7/8/24 WGU D431 lOMoARcPSD|13111427
2
WGU D431 TASK 1 - FORENSIC INVESTIGATION WITH COMPLETE SOLUTIONS!!
1.Discuss the strategy that your team will use to both maximize the collection of evidence and minimize the impact on the organization.
The first step in this process would be assembling the investigative team. We would then meet as a team to create a clear and succinct set of expectations for the investigative process. We would also meet with other organization heads within the company, such as IT managers, human resources, Senior Management, and the legal team. During this meeting, we would establish a clear understanding of what issues the company is facing and what allegations have been levied against Mr. Smith. It is important to understand the scope of our investigation and that it would be limited to the actions of Mr.
Smith, where he purportedly stole proprietary company information. These actions would be in clear violation of the company nondisclosure agreement as well as the acceptable use policy. In order to maximize the collection of evidence, we must discover what Mr. Smith has accessed and where he has been on the company network. By limiting our search to only those places where he has been, it will allow us to conduct a precise investigation and maximize the collection of evidence.
Of course, one of the most critical parts of an investigation is managing the investigation so that it minimizes the impact on the everyday business functions. By limiting our investigation to only those places where Mr. Smith has been, we would not need to interfere with other business segments allowing them to do business as usual. This would greatly minimize the impact to the organization.
2.Describe the tools and techniques your team will use in evidence gathering, preparation, and analysis.
After we have determined the structure and scope of our investigation, we will proceed to the collection of evidence. First we will review security footage, server and workstation logs to determine what Mr. Smith accessed and where it was accessed from. We will then secure those areas by photographing each workstation, the surrounding area, and what is displayed on the screens. We will then document everything we can see, such as what devices are plugged into the workstations. At this time, we will start the chain of custody for the evidence,
