As a forensic investigator, you know how important it is to understand an organization’s working environment
before you launch an investigation.
Mr. Santini has provided you with some information on the history of ZeroBit, its place in the marketplace, and
its potential competitors. You have learned that ZeroBit is an organization that generates intellectual property of
interest to organized crime syndicates and nation states, as well as technology companies.
Mr. Santini is concerned that product plans may have leaked out through unauthorized channels. When
millions of dollars are at stake, people can get hurt or killed, so investigators need to take steps to ensure their
In this situation, there is a suspect currently employed at ZeroBit, along with people who have recently left the
company and cannot be located. You need to assess and document factors that will increase the difficulty of
the investigation and put you, and others, at risk while conducting your digital forensics investigation. Among
those factors are people, property and environment, and evidence handling.
Your training has taught you that the most important function of a thorough safety and investigation plan is to
evaluate and secure the scene.
Mr. Santini has requested a safety and investigation plan that addresses each of the following components:
An initial description (in the form of a checklist) of the steps an investigator would follow to ensure safety is
addressed in the investigation.
The safety of the investigator and other people involved in the investigation (e.g., there may be people who are
hostile to your investigation). You also need to minimize the potential for becoming entangled in legal issues
and include third parties with an interest in the investigation or who may be helpful in obtaining required
consent for searches, familiar with how the target computers may have been used, and can assist with
understanding the network environment.
The safety of the property and environments involved in the investigation.
Evidence-handling procedures; preserving chain of custody is critical if law enforcement becomes involved.
The plan should also include the steps you would take if a potential safety compromise occurs in any area.
Develop a safety and investigation plan that addresses the concerns listed above. A safety and investigation
plan would typically be four to six pages, excluding figure images and references. Use APA format and submit
the plan to Mr. Santini (your instructor) for review and feedback. Incorporate any suggested changes after
feedback. You will include the safety and investigation plan in the final assignment (Step 4). Now, you are
ready to begin the investigation.