1) Introduction This report is being written by Department of Homeland Security forensic examiner James Beck, regarding the investigation of Anwar Tsarni. Anwar is a Chechen native, and a known associate of Dzhokhar and Tamerlan Tsarnaev, and has traveled to an area known for its terrorist training camp. After surveillance it is believed that he may be involved in planning a terrorist attack. He is currently working as a graduate teaching assistant at George Mason University, located at 10900 University Blvd Manassas, VA 20110. A search warrant was executed at his office where many materials were seized. Among those things that were taken was a flash drive. This flash drive fell under the electronic recording materials listed in the search warrant. This report covers the processes and findings of the previously mentioned flash drive. The first step is to make sure that the image file was not tampered with in any way. This is done by calculating the hash value of the image, both before and after the image is …show more content…
The file path is GMUIT257NO NAME-FAT16Venezuelans line streets for Chavez procession – CNN.com.html. An HTML document is just a different version of an htm document and they are very similar. The file has a creation date of 3/6/2013 at 6:10:20 PM and modified date of 3/6/2013 at 6:10:22 PM. This would suggest that the file was actually created on the computer that it was found on. This file will be sent in for analysis. Next up is a file that is titled ‘6Dg4oLkBbYq.html’. This is an html document with the file path of ‘GMUIT357NO NAME-FAT16How Chechnya Became a Breeding Ground for Terror Middle East Quarterly_files 6Dg4oLkBbYq.html’.The creation date is 3/292015 at 8:39:44 and a modified date of 3/27/2015 at 12:28:10 PM. This means that the file was copied from another hard-drive. The file will be sent along for analysis by an expert. c) Images In this section I shall discuss