//NOTE: This is an entirely fictituous forensics example case. There is no intention on the part of the author to represent any real person.
Assume: All pictures of feline creatures are illegal, known hash, pornography.
You have been retained to examine evidence obtained in a case involving a high school teacher named Robert Hauptman. On November 21, 2005, another teacher noticed a strange file on a classroom machine. She reported the file to the school IT officials and they investigated. They determined the picture was an illegal piece of kitty porn which had the following hash:
MD5: 6fd8 d7db 531a 3330 80e2 6a6b 2fc9 b7fd
The file could not be associated with anyone in particular since the machine was public. IT then began monitoring streams inbounds to the building and noticed a lot of download activity by Robert Hauptman after school hours. Mr. Hauptman had signed an agreement with HR which gave IT the right to monitor his activities. IT then set up several monitors and became concerned about Mr. Hauptman.
On January 4th, 2006, IT imaged Mr. Hauptman's hard drive after hours and proceeded to look for files but could find nothing. They did notice that Mr. Hauptman had installed a tool which regularly wiped web caches and temp files from the drive. Unsure how to proceed, they contacted district security about the matter and were advised that Mr. Hauptman would be "watched" but that no further action was advisable without evidence.
A security officer was keeping an eye on Mr. Hauptman on Jan 6th, 2006 and observed him going into his work area and using the computer. Mr. Hauptman saw the security officer watching him and asked what the officer was doing. The officer said "Just keeping an eye on things." Hauptman then rapidly returned to the workroom and seemed to be doing something quickly. The security ran into the room and saw a screen which looked like files on the screen but Hauptman was hitting the delete key. The officer pulled the plug on the computer and asked Hauptman to leave.
Hauptman immediately left and tried to take a Thumb Drive from the machine and said it was his "homework". The officer confiscated the drive and took it to the supervisor.
The supervisor put it in a baggy and contacted the police. You were contacted to examine the drive and attempt to determine if any material which could indict Hauptman might be found. Police have apparently established that the drive belongs to Mr. Hauptman.