Reference no: EM133957969
Assignment:
Option: Analyzing an E-mail Archive for an Electronic Discovery Investigation
Scenario
D&B is conducting a very large electronic discovery (eDiscovery) investigation for a major client. This case is so large that dozens of investigators and analysts are working on specific portions of the evidence in parallel to save time and improve efficiency. Since this is the first time you will be working on this type of investigation for D&B, your manager gives you a "test" (a sample e-mail archive) so she can assess whether you need additional training before you begin working with the rest of the team on the eDiscovery case. Your manager tells you that this archive was extracted from a hard drive image marked "suspect," but at present nothing more is known about the user. She expects you to examine the archive and document all findings that might be of interest to a forensic investigator. She explains that she will use your report to evaluate your investigation skills, logic and reasoning abilities, and reporting methods.
Tasks
Review the information about e-mail forensics and the Paraben P2 Commander/E3 E-mail Examiner feature in the chapter titled "E-mail Forensics" in the course textbook.
Using the P2 Commander/E3 E-mail Examiner, create a case file, select Add Evidence, and import the e-mail archive (filename: Outlook.pst). P2 Commander/E3 will automatically begin sorting and indexing if you choose that option.
Search for information about the user; your goal is to learn as much as possible about who the user is and what he or she has been doing.
You may find evidence in the inbox or other mailboxes. You can use the software features to help you keep track of the evidence you identify, for instance, by bookmarking sections of interest and exporting attachments.
Write a report in which you:
- Document your investigation methods.
- Document your findings. Explain what you found that may be of interest to a forensic investigator, and provide your rationale for including each selection.