1. If you have a search warrent for a computer site for a banking
crime and you find a child porn image on a subject's disk, should you keep
searching hoping to find more child porn images?
2. If you have a search warrant to find child porn and the search
leads you to a commercial system that contains critical patient medical
records can you shut the site down for several weeks to conduct your
search?
3. If the disk files for which you are looking have been deleted by
the suspect is your search over?
4. Is there any way of being sure that the programs you use to search
a disk are pure, i.e. not damaged by a virus?
5. If you get to a site where the subject's computer is located should
you start looking through the subject's files on his or her computer?
6. If you see that the subject has a Palm Pilot cradle in his office
and you are looking for his address book and calendar what should you do?
7. If you collect a volatile portable device that loses its memory if
the power fails what should you be sure to do?
8. If you go to a site to do an investigation and the subject's spouse
is there, can the spouse give you permission to gain access to the
computer system without a warrant?
9. What special precautions do you have to take when you are copying a
suspect's disk drive?
10. What is the purpose of notes that you make when doing your
forensics work?
11. What types of technical knowledge do you have to have to gather
data from a computer system?
12. Suppose the suspect's information is encrypted as stored, what
might you do to figure it out?
