How can you begin assessing a case?

What will be an ideal response?

ANSWER: You can begin assessing this case as follows:
• Situation—Employee abuse of resources.
• Nature of the case—Side business conducted on the company computer.
• Specifics of the case—The employee is reportedly conducting a side business on his company computer that involves registering domain names for clients and setting up their Web sites at local ISPs. Co-workers have complained that he’s been spending too much time on his own business and not performing his assigned work duties. Company policy states that all company-owned digital assets are subject to inspection by company management at any time.
Employees have no expectation of privacy when operating company computer systems.
• Type of evidence—Small-capacity USB drive connected to a company computer.
• Known disk format—NTFS.
• Location of evidence—One USB drive recovered from the employee’s assigned computer.