ACC 693 Module 3 Milestone One Example

Digital Evidence Identification and Preservation Plan

[Student Name]

Southern New Hampshire University

ACC 693: Investigating with Computers

Milestone One

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Digital Evidence Identification and Preservation Plan

Introduction

Payables analytics have identified a flashing subcontractor, paid about $1.1 million through seventy-four invoices, whose phone number matches the emergency contact of a senior project manager who approved every invoice. Before anyone speaks to him, the company must find and preserve the digital evidence that will confirm or dispel that lead. This plan, prepared for the company's general counsel, who is directing the investigation, identifies the sources, sets the order of preservation, assigns tasks, states the legal basis for each source, describes chain of custody and addresses the risks.

Evidence Inventory

Digital evidence sources

The inventory follows the approach recommended by Kent et al. (2006), which begins by listing possible data sources, then prioritizes them by likely value, volatility and the effort needed to acquire them.

Preservation Sequence

The order is driven by one concern: preserving everything possible before the project manager suspects an inquiry. Harris (2006) describes anti-forensic techniques, from deleting files to running wiping tools, and the plan assumes he could use them if alerted.

Five-day preservation schedule

The laptop is last because collecting it is the one step he may notice. The timing of day five was chosen from his calendar, which shows a pre-construction meeting at a hospital job site sixty miles away, so the laptop will be in the office and he will be out for at least four hours. If his plans change, the imaging will move to the next scheduled site visit rather than proceed while he is present. The forensic firm will image it in a conference room using a hardware write blocker, return it within two hours and document the procedure, as Module Five will describe.

Sources Outside the Company's Control

Two sources cannot be collected by the company on its own. The subcontractor's bank records require a subpoena in a civil action or a request by law enforcement after a referral. The project manager's personal phone, which he used to text field crews and, the company suspects, his relative, belongs to him. The company's mobile device policy allows it to manage a work container on personal phones but not to read personal messages. The plan therefore preserves what the company does control, the work container's data through the device management system, and defers the personal phone to a request for consent at his interview or to legal process. The company's carrier records for the stipend it pays toward his phone bill do not include message content and are not needed.

Two further sources were considered and left out. His home internet records and personal bank statements would be relevant only if law enforcement became involved, and seeking them now would require legal process the company does not yet have grounds to start. The relative who organized the LLC is not a company employee, so nothing of hers is within reach except public filings. Recording these decisions protects the investigation from a later claim that it overreached, and it reminds the team that the evidence they do not collect now may still be obtained later through a referral. Module Four's discussion examines these limits further.

Chain of Custody

Each exported file and image will receive a SHA-256 hash value at the moment of collection, recorded on a custody form with the date, time, collector, source and method. Copies used for analysis will be verified against the original hash. Originals will be stored on encrypted drives in the general counsel's locked evidence cabinet, with every access logged. Casey (2011) emphasizes that digital evidence is easily altered without visible signs, so documentation, rather than appearance, is what shows it is unchanged.

Risks and Mitigations

The gravest danger is that the project manager learns of the investigation from a colleague in IT or finance and destroys evidence. Only four people will know of the plan, each having signed a confidentiality acknowledgment. A second risk is automatic deletion: the company's email retention deletes items in the deleted folder after thirty days, which the legal hold suspends. A third risk is that the relative closes the LLC's bank account; this cannot be prevented by the company but can be documented through the payment files already exported. Finally, there is a risk of overcollection, gathering personal information without need, which the plan reduces by collecting only the work container on his phone and only the fourteen projects' folders. Collecting less, but collecting it properly, makes the eventual findings easier to defend.

Conclusion

The plan identifies nine evidence sources, preserves the seven the company controls over five quiet days before any visible step, and reserves the two it does not control for legal process or consent. Hash values and custody forms make every item defensible. Milestone Two will analyze what the preserved email and documents show.

References

Casey, E. (2011). Digital evidence and computer crime: Forensic science, computers, and the Internet (3rd ed.). Academic Press.

Harris, R. (2006). Arriving at an anti-forensics consensus: Examining how to define and control the anti-forensics problem. Digital Investigation, 3, 44-49. https://doi.org/10.1016/j.diin.2006.06.005

Kent, K., Chevalier, S., Grance, T., & Dang, H. (2006). Guide to integrating forensic techniques into incident response (NIST Special Publication 800-86). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-86