CIS-2808 · Homicide Case Evidence Analysis (100 points, 4 parts)
How to use this guide: This is a review resource, not an answer key. It tells you which
concepts, tools, and procedures each part of the lab tests, and gives you practice questions to check your
own understanding. You'll still need to work through NETLAB #11 yourself to produce your screenshots and results.
Before You Start the Lab
Case Part 1 25 points
A photo on the suspect's phone may place them near the homicide location. You need to confirm where and when it was taken.
What this part is testing
Creating a forensically sound copy of an image file before analysis
Verifying integrity of that copy using a hash comparison
Extracting embedded metadata from a JPEG — specifically GPS coordinates and date/time stamps
Concepts to review
Forensic imagingA bit-for-bit duplicate that preserves the original evidence untouched.
Hashing for verificationComparing hash values of original vs. copy to prove they are identical.
EXIF metadataData embedded in a photo file describing when, where, and how it was captured.
GPS tags in EXIFLatitude/Longitude and a separate GPS Date/Time stamp, distinct from the file's Create Date.
Self-check questions
Why would an investigator hash both the original and the copy, rather than just the copy?
What's the difference between the image's "Create Date" and its "GPS Date/Time"? Could they ever disagree, and what would that mean for the case?
Which forensic tool(s) covered in class can display embedded EXIF fields, and what's the general workflow for pulling that info out?
Case Part 2 25 points
A second photo shows a river/stream. Investigators want to know why the suspect photographed this location — which means finding out where it actually is.
What this part is testing
Repeating the forensic copy + hash verification workflow from Part 1
Extracting GPS coordinates from a second image
Converting raw GPS coordinates into a real-world map location using an outside (non-NETLAB) tool
Concepts to review
Coordinate formatsGPS metadata is often stored in degrees/minutes/seconds — you may need to convert it to decimal degrees.
Lab environment boundariesWhy this step deliberately requires a browser outside the NETLAB sandbox.
Geolocation toolsFree coordinate-to-map lookup services and how to read their output.
Self-check questions
If your extracted latitude/longitude are in DMS (degrees/minutes/seconds), how do you convert them to decimal degrees before plugging them into a map tool?
Why might an investigator need to look up a location using a tool outside the closed lab environment, rather than inside NETLAB?
What would it mean for the case if the photo's coordinates matched a location relevant to the homicide?
Case Part 3 25 points
The suspect appears to have deleted images from their laptop. You need to recover evidence that Windows keeps around even after deletion.
What this part is testing
Creating a forensic copy of a Thumbs.db file and hash-verifying it
Understanding what Thumbs.db stores and why it can survive deletion of the source images
Extracting embedded images from the Thumbs.db copy (a basic file carving task)
Concepts to review
Thumbs.dbA Windows thumbnail cache database that stores small preview images of files viewed in a folder.
Data remanenceWhy deleting a photo doesn't necessarily delete every trace of it on the system.
File carvingPulling embedded files (like JPEGs) out of a container/database file rather than the normal filesystem.
Self-check questions
Why is Thumbs.db forensically valuable even after a suspect deletes the original photos?
What tool(s) from class can open or parse a Thumbs.db file, and what do they let you do with its contents?
What steps would you take to make sure the extraction was performed on the copy, not the original evidence file?
Case Part 4 25 points
Now that an image has been recovered from Part 3, you need to document its properties as evidence.
What this part is testing
Viewing and documenting a recovered file's date/time and size properties in Windows File Explorer
Hashing the extracted file to establish its evidentiary integrity going forward
Concepts to review
File Explorer propertiesWhere to find created/modified/accessed dates and file size for a given file.
Chain of custodyWhy every newly-extracted piece of evidence gets its own hash, even if it came from something already hashed.
Self-check questions
Why would you hash a file that was carved out of Thumbs.db, even though you already hashed the Thumbs.db file itself?
What Windows File Explorer view or dialog shows you the date/time and size properties of a single file?
Could the recovered image's file dates tell you something different from its embedded EXIF dates (if it had any)? Why might they differ?
Grading Reminders
Each task step is graded on whether your screenshot is present, correct, and matches what was actually asked
Partial or incorrect screenshots earn partial credit — missing screenshots or answers earn none
Make sure every screen capture is clear and cropped to show only the relevant information
Double-check you're using the correct workstation (DEFT vs. WinOS) and browser (NETLAB vs. non-NETLAB) for each task