You are assigned to assist with the search and seizure of several computers. The magistrate ordered that the computers cannot be seized unless they are found to contain any one of ten previously identified images. You currently have the ten images in JPG format. Using the EnCase methodology, how would you best handle this situation?

Question

You are assigned to assist with the search and seizure of several computers.  The magistrate ordered that the computers cannot be seized unless they are found to contain any one of ten previously identified images.  You currently have the ten images in JPG format. Using the EnCase methodology, how would you best handle this situation?

Quizplus · Accepted Answer

Conducting a hash analysis using a hash library with the hash values of the identified images is the most efficient and accurate method to determine if the specific images are present on the hard drives.

You Are Assigned to Assist with the Search and Seizure