Question 1 (24 marks – 500 words)

You should be able to complete this question at the conclusion of week 7. You should write no more than 500 words for this answer.

You are a commercial digital forensic investigator and have been instructed by a client (the owner of a small business) to investigate a suspected intellectual property theft by one of the employees. You attend the client’s office with the intention of performing an onsite acquisition of a single computer. On arrival, you have an initial conversation with the client who subsequently walks you to the place where the computer is located.

· a.Provide the section, Act, and year for the legislation you need to follow before you proceed. What should you establish to ensure you abide to the legislation you identify?

[4 marks]

· b.Describe the steps you would document BEFORE entering the BIOS.

[8 marks]

You have labelled the computer ‘IMK/1’. Your colleague is on another job and has the only radio clock in your team. As a fallback, you decide to use your mobile phone to access the website https://time.is, which is synchronised with an atomic clock.

You enter the BIOS firmware screen and record the date and time as shown in Figure 1