You are part of a forensics security team that has been tasked with investigating a
potential crime committed by an employee or a group of employees in a multinational
company. An unauthorised USB memory stick was found in the possession of one of the
employees under investigation.
To start off the forensic process, a bit-by-bit image has been created of the USB and this
has been passed to you for a full forensic analysis.
Your forensic analysis must be presented in a formal report that may form the basis of a
criminal proceeding against the employees under investigation. A report template is
Your forensic analysis report should show all details that may provide evidence in the
case. The details could be names, addresses, contact details, text and other files, all of
which should be fully documented and organised for ease of reference. Your methods
and tools used must be fully documented to as the defence experts will fully scrutinise
these for any flaws.