Investigative Conclusion and Testimony

Section I
Provide a list of people you believe should be interviewed for this investigation and how they relate to the investigation. What information could they possibly supply?
For this investigation, there will be need to interrogate a number of persons. In so doing, I would be concerned with two key aspects that relate to the investigation: work-related aspects and aspects not related to the workplace. With regard to work-related aspects, I would be seeking to interview those who have closely worked with Mr. John Belcamp, i.e. his workmates and other organizational employees. These would be inclusive of his superiors (Ms. Carol McPherson, Mr. Harold Newman, Mr. John Belcamp, and Ms. Evelyn Bass), his subordinates, those at the same job level, and staff performing various key organizational roles (such as security personnel). This would essentially be a fact-finding undertaking aimed at determining whether there is indeed any possibility of violation of organizational policy or threat to organizational interests. When it comes to aspects not related to the workplace, of relevance would be the character and comportment of Mr. Belcamp. Towards this end, persons of interest would be a few of Mr. Belcamp’s friends and neighbors.
Provide a narrative description of the interview setting and the intended process, before, during, and following the interview
The interview would comprise of four basic stages. These are: planning of the investigation, interview conduction, evidence gathering, and evidence evaluation. In as far as planning is concerned, the items of great relevance would be issue outline, interviewee list, questions to be asked, and documentation format. On the other hand, when it comes to the conduction of interviews, it is important to note that I would first ensure that all the parties involved are aware of the relevance of the investigation and know their rights in as far as their participation is concerned. With every interview, effort will be made to maintain objectivity and impartiality. Evidence gathering, though part and parcel of interview process, could be deemed a stand-alone process due to the distinctive activities involved. This is more so the case when it comes to the documentation processes. Lastly, we have evidence evaluation which is essentially the assessment of the information collected thus far with an aim of determining whether there is indeed any possibility of violation of organizational policy or threat to organizational interests. Once all the information has been evaluated, and issues relating to the credibility of those interviewed resolved, a formal recommendation will be made. It is important to note that to a large extent, the interview setting would be determined by the aspect, i.e. work-related aspects and aspects not related to the workplace. For work-related aspects, the interview would be taken at the work premises to avoid unnecessary disruptions to workflows. On the other hand, for aspects not related to the workplace, the setting would largely be dependent upon the schedule and location of the interviewee.
Explain to the management why these stages are important to a successful interview and investigation
The stages highlighted above are of great relevance to a successful interview and investigation as the investigation has the potential to become a lawsuit. For this reason, there is need to ensure that the entire process is well-structured and documentation rules observed so as to ease the retrieval of key information if need be. In basic terms, the results of the investigation could provide the basis for legal action with the options available for the organization being inclusive of: personal devices subpoena, permanent injunction, or just a restraining order.
Section II
Question 1: Identify, for the lab, what digital or non-digital evidence you would like them to look for and explain why that evidence would be important to the case
In this case, the primary goal would be to determine whether there was any attempt by Mr. Belcamp to steal intellectual property of the organization – and in this particular case, the source code for ‘Product X.’ Thumb drive activity would, thus, be of great relevance on this front. It is important to note that according to Reddy (2019), owing to their portability and storage capacity, thumb drives are tools commonly used by employees to steal data. In the short summary to be submitted to the laboratory, I would request for specific information relating to; the files that were opened recently, stored file, deleted files, and files that were copied to other mediums. With regard to recently opened files, a red flag would be raised if there is evidence to suggest that most or some of the files that Mr. Belcamp opened recently were not related to tasks being performed at the time. Stored files would also be of great interest because as Ms. Evans points out, Mr. Belcamp had instructed her to keep the thumb drive safe. This indicates that it could contain material related to Project X. Deleted files and those copied to other mediums would also be of interest given that Mr. Belcamp could have tried to cover his tracks by either deleting stored data or transferring it to other storage devices.
Question 2: Locations outside of Mr. Belcamp's immediate work space where pertinent digital evidence might be found
Outside of Mr. Belcamp workplace, there are numerous other places or locations where we could find important digital evidence related to the ongoing case. In this case, possible locations would be inclusive of Mr. Belcamp’s smartphone, personal email account, and personal computer. Of interest would also be printed documents or any other storage media found at his place of residence or in his vehicle. It is important to note that the workplace is considered to belong (at least technically) to the employer – effectively meaning that as Casey (2009) observes, employees are not expected to have an expectation of privacy in as far as their office and related areas (i.e. locker and desk) is concerned. However, it is a different issue altogether when it comes to the employee’s personal car, personal items, and home. This is more so the case given that searches in these personal domains (outside of the workplace) would be considered a violation of Mr. Belcamp’s reasonable expectation of privacy. The police would, therefore, have to be involved.
Question 3: Response to Email
Tool
Capabilities
CAINE
(Digital Forensics Project)
This is a Linux distribution kit that would come in handy in undertaking diverse digital investigation functions including: the collection, analysis, and examination of data. In addition to network devices, it could also aid in the assessment (forensic) of mobile devices.
EnCase
(by Guidance Software)
This is an important tool in as far as data gathering is concerned. Key features of this forensic analysis/examination tool include EnCase Forensic 8 and EnCase eDiscovery that permit collection that is not only reliable, but also non-disruptive.
Registry Recon
(by Arsenal Recon)
This is a potent forensic tool that could actively be utilized in the extraction, recovery, as well as registry data parsing.
The tools nominated above satisfy the Daubert standard. Towards this end, in addition to being founded on methodologies that are generally accepted, the listed tools have also been peer-reviewed. They have also undergone tests for reliability as well as accuracy. Specifically, the Daubert permits the admission of novel tests in courtrooms (Maras, 2014).
Question 4: Prior to looking through the data contained on the device, you have to make a forensic image. Document what step you take prior to making the image and why this step is important to your overall case
An image of the thumb drive that could be deemed forensically sound ought to be captured prior to the commencement of forensic analysis or investigation. In seeking to create an image of the USB drive, there is need to evaluate the relevance as well as admissibility of the imager. It should be noted that a court of law is not likely to admit any evidence without valid bit-by-bit images of the thumb drive.
Question 5: What is a hash value, and how did you use it to identify the source code was present?
A hash value, in basic terms, could be conceptualized as the outcome of a hash algorithm (a mathematical algorithm) undertaken on the contents of the source device. Data is in this case converted into characters that are representative of the said data. It is important to note that forensic copies essentially correspond to the original, bit-for-bit. To identify the source code was present, I utilized what is referred to as a hush function. During the reading as well as copying of the original media, an entry of each bit was made in a hashing algorithm which gave fourth the hash value. This served as an impression or digital mark that is distinctive in as far as the dataset is concerned.
Explain an additional use of hash values in the context of digital forensics
In addition to checking digital material for integrity, hash values could come in handy in file identification as well as classification. According to Newman (2007), in relative terms, file hash values happen to be rather small. For this reason, the author observes that they are efficient in file identification and classification as the comparison of file hash values is faster and tedious than any other process that involves the comparison of the actual file contents.
Question 6: Do you recommend reporting the crime to law enforcement? Why or why not? Are private companies required to report crimes to law enforcement?
I recommend reporting the crime to law enforcement. It is clear from the analysis that legal action could be sustained. In this case, my assertion is largely founded on three key factors: the strange statements that Mr. Belcamp made during the exit interview, the fact that Mr. Belcamp’s thumb drive was found to have the complete source code for Project X, and the likelihood of Mr. Belcamp having emailed copies of the source code in question to his personal email. It that regard, therefore, it is likely that Mr. Belcamp would be sharing the intellectual property with a third party – a move that could deny the company revenues going forward and even threaten its ability to compete effectively in the marketplace.
To a large extent, there is no express requirement that requires private companies to report to law enforcement officers criminal conduct by members of staff. Having said that, it should be noted that some crimes are not treated in a similar format. In some cases, it would be mandatory for the employer to report crime, i.e. in instances where sexual assault takes place at the workplace and is documented/recorded. In practical scenarios, there are a wide range of reasons that discourage employers from reporting criminal conduct. These include, but they are not limited to, negative publicity should details of illegal conduct leak to the press, fear of losing a talented or valuable employee, fear of causing disruption to the workflow, potential for privacy invasion liability, etc. None of these factors apply in the present case. This is more so the case given that the process has been conducted within the relevant legal parameters. According to the U.S. Department of Justice (2018), so as to ensure that wrongful activity is deterred and sufficient punishment meted out in instances involving theft of intellectual property, companies ought to pursue criminal sanctions as opposed to civil remedies. In the present scenario, it appears as though there are sufficient grounds to sustain a criminal copyright infringement and/or a theft of trade secrets charge. Thus, in the final analysis, this particular event ought to be referred to law enforcement immediately.
Question 7: Explain what additional steps you could take to prove that the source code had been sent to his personal email address.
In this case, I would focus on forensically analyzing the relevant computer (s) and finding out the specific dates that the thumb drive was connected. It should be noted that there is some key information that is captured whenever a thumb drive is connected to a computer. The said information has got to do with primary details about the thumb drive (such as drive vendor) and file activity. Of interest in providing additional indications that the source code had been sent to Mr. Belcamp’s computer would be file activity. This is more so the case when it comes to not only the name of the file, but also its serial number and path.
Question 8: What is the significance of you being qualified as an expert witness? How is it different from being a simple fact witness? Explain thoroughly.
There is some specialized knowledge that cannot be sufficiently elucidated by lay people in courtroom settings. With this in mind, the relevance of roping in an expert witness cannot be overstated. My qualification as an expert witness is on the basis of my training, expertise, and experience on matters relating to the issue at hand. It, therefore, follows that as an expert witness, I will be expected to provide the necessary information needed to enable the court make sense of the technical aspects of the case. For this reason, I ought to ensure that the testimony I present has sound basis in the profession’s methods and principles. I would also be called upon to give an expert report which is in essence a report of my opinion of the various facts as presented. This report is of great relevance in as far as court procedures are concerned and it has to adhere to various court rules. To a large extent, the said report details the analysis of the expert witness and the conclusions arrived at as a consequence of the said analysis. To ensure that the expert witness is sufficiently cross-examined, the other parties must be furnished with details of the report. Adam (2016) points out that the duty of the expert witness to the court supersedes all other duties (i.e. duty to the employer). For this reason, as an expert witness, I ought to be not only impartial, but also independent. The basis for expert opinion is Rule 702 of the federal evidence rules (Adam, 2016). There are some key differences that exist between expert witnesses and fact witnesses. Unlike an expert witness, a fact witness must ensure that the testimony they offer is largely limited to evidence that is part and parcel of their involvement or observation. Thus, a fact witness is called upon as a consequence of their involvement in undertakings that morphed into the issues before the court. Unlike expert witnesses, fact witnesses are, therefore, not expressly required to have special expert insights, experience, or training in relation to various aspects of the litigation.
Question 9: Transcript in response to: “How do we know you are not biased in this case, choosing to report only what would help law enforcement and your company's bottom-line? How can we know from your work that your analysis should be accepted by the court?”
I support the work of law enforcement because I am a firm believer in the rule of law. I am also a firm believer in the fact that that every accusation and conviction must be founded on clear evidence and not mere heresy. In the present scenario, forensic investigations have clearly indicated that the complete source code for Product X was found in the thumb drive belonging to Mr. Belcamp. I will also clearly indicate that there are other reasons to believe that copies of the source code were emailed to the personal email of Mr. Belcamp by the accused himself. Computer forensics is a scientific process in which case verified methods and approaches are used in an attempt to gather, preserve, or retrieve important data in formats acceptable in a court of law. There is no room for bias. In our case, we have conducted investigations using tools that are peer-reviewed and have undergone verification tests. We have also documented all the procedures that were used in the making of our findings. As an expert witness, mine is only to present truthful, independent, and unbiased expert opinion based on my expertise on the subject matter. It is, thus, up to the criminal justice proceedings to assess the evidence presented, conduct an assessment of presentations, and make a determination of guilt or innocence.
References
Adam, C. (2016). Forensic Evidence in Court: Evaluation and Scientific Opinion. Hoboken, NJ: John Wiley & Sons.
Casey, E. (Ed.). (2009). Handbook of Digital Forensics and Investigation. Burlington, MA: Academic Press.
Maras, M. (2014). Computer Forensics: Cybercriminals, Laws, and Evidence (2nd ed.). Burlington, MA: Jones & Bartlett Publishers.
Newman, R.C. (2007). Computer Forensics: Evidence Collection and Management. New York, NY: CRC Press.
Reddy, N. (2019). Practical Cyber Forensics: An Incident-Based Approach to Forensic Investigations. New York, NY: Springer.
U.S. Department of Justice (2018). Reporting Intellectual Property Crime: A Guide for Victims of Copyright Infringement, Trademark Counterfeiting, and Trade Secret Theft. Retrieved from https://www.justice.gov/criminal-ccips/file/891011/download