What approach should John take in examining the two computers? What are some specific things that he should include in his examination?
Julia Katchum is in charge of the Eastern Regional Counterterrorism Computer Forensics Unit. Her recent investigations led her to believe that an imminent threat of a terrorist act in the Chicago area exists. She did not know much about the attack except that at least four terrorists were involved, and one of them had just made a phone call from inside the main offices of Stevenson and Barnes International Accounting Firm. Her immediate task was to proceed directly to Stevens and Barnes with an eight-person tactical team including a counterterrorism field officer to apprehend the suspect.
John noted the following facts:
• The suspect’s office computer had opened an instant messenger program. He could see a piece of a message written in Arabic.
• The battery in the home notebook computer was warm, even though it was turned off and not plugged in when it was seized.