# Canadian Criminal Law/Appendix/Model Examinations/Computer Forensic Analyst
## Background

    <be sure to check with judge on how much familiarity he or she has with basics of computers, may need to go into details about what a file and a directory are>
* Name / employer / duration of employment / current position
* employment on date of offence / on duty on day of offence

## Qualification

* education and training in computers and computer analysis / name of program / time of education
* Any special training with respect to computer forensics / What is Computer Forensics?
* Go details of training:
** name of course / where is it available / who developed it / standardized program
** starting at first program, list all educational programs completed, including duration (hours/days)
** whether training involved hands on work / circumstances of this hands on work / ability to confirm results / any supervision
** Go through the analysis process involved
** success in the course / any certification / by what organization / time and duration of certification / requirements to be certified / requirements to maintain certification
** Any other relevant training
** gave training / presentations on the topic
** Admit Resume
* Experience
** number of prior cases you have performed analysis upon / # of times you have been asked to give an opinion / # of times you have testified in court / # of times qualified (when and where)
** documenting all prior evaluations / method of documenting / reviewed before court
    Seek to have computer analyst qualified as an expert in _____

## Review Tools, Methodology and Terms

* state of computer when you first receive it
* Software tools used (FTK, EnCase, etc) / purpose of tools / preservation of data
* types of files examinable on the hard drive
** accessible documents, images, videos
** inaccessible documents, images, videos (full or partial)
* what is necessary to recover inaccessible or deleted file
** different ways files are deleted / what is preserved
* there are several programs and services to recover data (est. that it could be reckless to assume deleted files are gone for good)
* manner to make files unrecoverable / software programs that exist

## Incident
### Examination of a Computer

* gained access to a computer / where / from whom
* type of computer / serial number / peripheral equipment / likely age of computer
* state of machine when beginning / accessing the hard drive using EnCase or similar / reason for using EnCase or similar
* identify operating system being used
Contents of the Computer
* found any files that were relevant to the case
* types of files (pictures, videos, documents)
* contents of the documents
** did you review the contents of the files / do the file names reflect the contents
* metadata and characteristics of the files:
** hash values and names of files / number of files found / total size of all the files / length of videos
** location of files found / directories / unallocated space
** dates of created, modified, and accessed / comment on accuracy of times and dates / other ways of determining date they were downloaded, opened or deleted
Signs of User's Identity
* examined files for signs of who uses the account:
** checked OS registry / registered owner’s name
** user accounts enabled on OS / whether one user can put files in another user’s directories
** images of persons or family members
** internet browsing history (including log-in information)
** documents with names on it
** connection with web log-in accounts with a certain name
Signs of User's Familiarity with Computers
* consider whether settings of P2P software were modified
* other software installed on machine, software that is generally directed at advanced user
* signs of customized operating system, desktop, etc. / how much different did set up look from the default installation out of the box
Other Potentially Relevant Information
* details on the software packages installed on the machine
* details regarding OS installation (time and date, by whom)
* synchronization of computer's clock
* other software installed (file deleting software, chat programs, viruses, spyware, or other file sharing programs)