This case study focuses on a digital forensics investigation involving alleged access to illegal clown-related content in Western Australia. A junior investigator's mishandling of the initial forensic acquisition and subsequent wiping of the original hard drive led to the need for a senior examiner to analyze a logical forensic image using the Autopsy tool. The suspect denies accessing the content and claims the computer may have been compromised by malware. The analysis involves identifying relevant files, determining the intent behind accessing and potentially deleting them, quantifying the files on the system, and examining installed software to uncover evidence related to the alleged offense. The investigation identifies various artifacts, including device attachments, EXIF metadata, encrypted files, recent documents, web bookmarks, cookies, downloads, and history, each analyzed for access, usage, and deletion patterns. The report details the types and quantities of files found, such as those associated with attached devices, metadata, and installed programs, providing a comprehensive overview of the digital evidence.
![[object Object]](/_next/static/media/star-bottom.7253800d.svg)
