AC468 Unit 2 Evidence Acquisition Record Example

Course	AC468 Digital Forensics and Investigative Techniques
Unit	Unit 2
Paper type	Acquisition record
Length	About 550 words, 5 pages double-spaced
Format	APA 7 student paper
School	Purdue University Global
Program	BS in Accounting
Updated	October 2026

Free sample paper for AC468 Unit 2

One Laptop, One Flash Drive, One Mailbox: A Unit 2 Acquisition Record With Hashes That Prove the Copies Match

[Student Name]

Purdue University Global

AC468: Digital Forensics and Investigative Techniques

Unit 2 Acquisition Record

[Instructor Name]

[Date]

Belmonte Fine Foods, its staff and every device detail are composite; hash values are shortened illustrations; the guide, standard and book cited are real.

What this part is doingNaming the three items and the record's fixed format in the lead shows how the document is organized.

Item 1: Accounts Payable Lead's Laptop

Received: powered off, from the IT manager, with a custody form signed by him on April 3 at 16:20 local time, stating he collected it from the employee's desk that afternoon and stored it in a locked cabinet. The laptop was photographed on all sides; make, model and serial number, and the internal drive's model and serial number, were recorded.

Condition: BitLocker full-disk encryption enabled. The recovery key was obtained from the company's key escrow and recorded in the case file for use during analysis, not during acquisition.

Acquisition: the NVMe drive was removed and connected through a hardware write blocker that passes read commands and blocks writes. It was imaged in its encrypted state to E01 format with case metadata embedded. SHA-256 and MD5 values were computed during acquisition and again from the completed image, and both pairs match: SHA-256 beginning 9c41e0b7, MD5 beginning 2f7a1d93.

Clock: the laptop's firmware clock, checked before the drive was removed and compared with a reference time source, ran 2 minutes 14 seconds slow. Every timestamp from this device will be read with that offset noted.

Item 2: 32 GB Flash Drive

Received: from the same custody form, found in the employee's desk drawer. Photographed and labeled. Imaged through a USB write blocker to E01 format. Acquisition and verification SHA-256 values match, beginning 51be8c02. File system: FAT32.

Item 3: Cloud Mailbox

The employee's mailbox was exported as a logical collection from the company's eDiscovery console by the IT manager under the examiner's direction, on April 6 at 14:10 UTC, covering January 1 to April 6. The export file was hashed on download, SHA-256 beginning e7d03f45, and the console's own export report was saved with it.

The encrypted drive was imaged before it was unlocked, because unlocking the original in place would write to it, while imaging the encrypted volume through a write blocker preserves it exactly and leaves decryption to the copy.

What this part is doingThe highlighted sentence explains the choice graders look for first when an acquisition involves encryption.

Why Each Step Is Recorded

A hash proves the image equals the drive at the moment of imaging; the custody form and photographs document the drive's state before that moment. The record therefore carries both. The guide on integrating forensics into incident response recommends acquiring data in a way that preserves its integrity and documenting every action taken (Kent et al., 2006), and laboratory standards for testing and calibration call for recorded tool versions and verification of results (International Organization for Standardization, 2017). The examiner's tools and versions, the write blockers' serial numbers and the verification output are attached as appendices. An acquisition record should let a second examiner repeat the work and obtain the same values (Casey, 2011).

Limitation

The laptop was in the IT manager's custody from April 3 to April 6 before imaging. His form states it stayed powered off in a locked cabinet. That statement cannot be verified from the image itself and is recorded as his account.

What this part is doingEnding on the custody limitation shows the record states what it cannot prove, which protects it later.

References

Casey, E. (2011). Digital evidence and computer crime: Forensic science, computers, and the Internet (3rd ed.). Academic Press.

International Organization for Standardization. (2017). General requirements for the competence of testing and calibration laboratories (ISO/IEC Standard No. 17025:2017). ISO.

Kent, K., Chevalier, S., Grance, T., & Dang, H. (2006). Guide to integrating forensic techniques into incident response (NIST Special Publication 800-86). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-86

The Purdue Global AC468 Unit 2 instructions

Unit 2 of AC468 asks you to document the acquisition of digital evidence so another examiner could repeat it. Record each item in the order acquired and use the same sequence of fields for every item, so readers can compare them. For each one, state how it was received and from whom, describe it with serial numbers and photographs, note its condition, including encryption, and give the acquisition method, tool and version, and write protection used. Record hash values computed during acquisition and again from the finished image, and say whether they match. Check and record the device clock against a reference source. For cloud data, describe the export and what it cannot capture. End with any limitation or deviation from procedure. Cite a recognized forensic guide and a laboratory standard in APA 7.

How the AC 468 Unit 2 example is put together

The sample's first section covers the accounts payable lead's laptop, received powered off with a custody form signed April 3. Its condition note records BitLocker and where the recovery key came from, and the acquisition note explains why the drive was removed and imaged through a hardware write blocker to E01 format with matching SHA-256 and MD5 values. The clock check finds a 2 minute 14 second lag. The flash drive section repeats the pattern through a USB write blocker. The mailbox section records a logical export from the eDiscovery console, hashed on download. The highlighted sentence explains imaging the encrypted volume before unlocking it. A short section ties the hashes and custody form together with the NIST guide and ISO/IEC 17025, and the limitation section closes the record.

Where the points sit in the AC468 Unit 2 rubric

Acquisition records in AC468 earn points for completeness and for consistency between items. Graders check that every item carries receipt, description, condition, method, tool version, write protection and paired hash values, and that the values are shown to match. Handling of encryption is examined closely: the rubric rewards a student who preserves the encrypted original and explains why. A recorded clock offset earns credit because later timelines depend on it. Cloud exports should state what a logical collection misses. The strongest records state their own limits, such as custody that cannot be verified from the image. Vague entries like "imaged the drive" without tool, format or verification lose most of the available marks, and APA 7 citations for the guidance followed are expected.

AC468 Unit 2 help: mistakes that cost points

Some Unit 2 records list hash values without saying when each was computed, so a reader cannot tell that acquisition and verification match. Others describe booting the laptop to image it, which writes to the disk the investigation relies on. Encryption is often ignored or handled by unlocking the original in place. Clock checks are skipped, leaving later timelines without a known offset. Cloud exports are treated as complete when deleted items may be missing. Custody before acquisition is presented as fact when it is only someone's statement. If your section provided a practice image or a different set of devices, our writers can build the record around your items, tools and lab procedure.

Get an AC468 Unit 2 example written to your instructions

Device details, the tools a section names and any required custody or imaging form shape a Unit 2 record more than anything else; send them with the lab scenario and the rubric. Each item is documented from receipt to verification, with hashes paired and deviations stated. First custom record at no charge, returned inside 24-48h. The paper above is an original model document written by our desk, not a submitted student paper and not an official Purdue University Global document.

More AC468 papers and BS in Accounting samples

AC468 Unit 2 questions, answered

What does a write blocker actually do?

It sits between the evidence drive and the examiner's computer and allows read commands through while blocking any command that would change the drive. Without one, simply connecting a drive to a Windows machine can write to it. The record names the blocker used and states that it was tested before use, which most rubrics expect.

Why image an encrypted drive without unlocking it first?

Because unlocking the original in place means interacting with it in ways that are harder to document and could alter it. Imaging the encrypted drive preserves it exactly, and the recovery key is applied to the image during examination. The record states where the key came from and who retrieved it, since that step is part of custody.

Can the record follow my section's lab exercise?

Yes. Include the lab scenario, the details of any practice image, the tools your section uses and the rubric. The record documents each item in the order your facts give, pairs acquisition and verification hashes, and states every deviation from procedure, with places left for values that only your own lab run will produce.

Where can I find a free AC468 Unit 2 sample paper?

This page holds a full AC468 Unit 2 acquisition record for a laptop, a flash drive and a cloud mailbox at Belmonte Fine Foods with write protection, matching hash values, a clock check and APA 7 references.

Why record the laptop's clock before removing the drive?

Because every timestamp later read from that device inherits its error. The sample's laptop ran 2 minutes 14 seconds slow against a reference source, and recording that at acquisition lets the Unit 7 timeline apply or rule out the offset rather than guess.