The laptop that was switched on
A manager thinks a worker stole a customer list. She opens the worker's laptop and looks at the files.
Later the police say the evidence is spoiled. Opening the files changed the dates on them.
Careless hands can ruin proof. Today you learn how to handle it.
By the end of this lesson
Note
I can name the five forensic steps and say what each one protects.
Key words
| Word | What it means | Example |
|---|---|---|
| Computer forensics | finding and studying digital proof in a way a court can trust | |
| Evidence | data that shows what happened | |
| Tamper | to change something so it can no longer be trusted | |
| Contaminate | to spoil evidence by mixing other things in | |
| Retention period | how long the law says you must keep something | |
| Fingerprint | a short code worked out from data, also called a hash | a1b2c3 |
| Law enforcement | the police and other bodies that act on crimes |
The cells students fill in are left blank in this preview.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Forensics gathers proof others can trust
Computer forensics is a careful way to look at devices and computer systems. The aim is to collect evidence that is fair and true.
The evidence goes to an appropriate body, such as the police. They decide what happens next.
The key idea: the proof must still be the same when it reaches them.
The five steps
| Step | What you do | Example |
|---|---|---|
| Identification | Find what evidence exists, where it is and how it is stored | A laptop, a phone and a server log |
| Preservation | Stop it being changed. Isolate it, secure it and keep it in time order | Lock the laptop away |
| Analysis | Rebuild fragments of data and draw conclusions | Recover a deleted file |
| Documentation | Record everything visible and every step of the work | A dated notebook |
| Presentation | Give all findings to the right body | A report to the police |
The cells students fill in are left blank in this preview.
Check
Have a go
Check
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.