Question 3 (20 points) Approximately 20 mins
Scenario 3
The head of sales of a company has been accused of meeting with the CEO of a competitor company. The accuser has provided a photograph of the two of them meeting in a public place (the central square in Berlin, Germany) at a specific date and time. The head of sales has claimed that the photo is a fake and you are brought in to do a forensic examination of the image. The accuser also claimed that emails were exchanged and documents with sensitive information shared with the CEO.
Question 3.1 (10 points)
What could you do to check whether the image is fake or not? Specifically, you need to verify if the image has been altered in any way and that the place, date, and time of the meeting matches that of the image.
Question 3.2 (10 points)
You have a memory capture file of the head of sales’ laptop and a network log of all traffic for the past 3 months. What things could you look for in this file to see if indeed he had been negotiating some sort of deal with the competitor company?
