The Topic of the Paper: The Problem and Solution for Improving Customer Services for a Restaurant Purpose/scope - The final paper/project is intended to engage students in a real-world issue pertaining to your respective internship. The paper topic will be determined and agreed to by the intern supervisor and student. The topic should be beneficial to the company and educational to the student. Once the topic is determined, the student is expected to define the research problem (problem statement), collect the necessary data, and report on the findings. The length of the paper is not specified; however, quality is preferred over quantity. It is expected that papers should be at least 10+ pages long. Finally, it is required that the paper/project and findings will be presented to the internship supervisor by the student The final paper/project format should be double-spaced using 12-point Times New Roman font with 1” margins.Content, writing logic/flow, spelling and grammar will be graded as part of your final grade. The final paper MUST include the bolded section headings as directed and be organized in the following manner: 1. Final Paper Format – Your paper must follow the following format. a. Cover Page – Title of the paper, course name and number, semester year, student name and identification number and instructor’s name b. Table of Contents – Prepare a detailed table of contents, which includes the following section below c. Executive Summary – The executive summary should be a summary of the report in 1-2 pages with the following captions: i. Parameters of the report – purpose/objective of the study, type of company, etc. ii. Description of the problem – describe the problem and how your project will be beneficial to the company. iii. Methodology – describe how you went about solving the problem. What type of survey did you do? How did you collect data?, etc. iv. Summary of findings and conclusions – summary of the facts you found surrounding the problem or situation being researched and your conclusions based upon those facts. v. Recommendations – summarize the specific recommendations you are making to the company to solve the problem or respond to the research project. d. Section I – Introduction/Background – Provide the reader with a description/ background of the topic that is being researched. Give a contextual backdrop to why this is an important issue to be addressed (e.g., What are competitors doing? What is the marketplace currently doing or headed? What happens if this isn’t addressed?). e. Section II – Statement of the Problem/Research Project – A brief discussion of the specific topic that will be investigated and addressed and why it is important. (e.g., What is the problem? Why is this problem worth my attention? How important, influential, or popular is this problem? Would research findings lead to some useful change in best practice?) f. Section III – Methodology – A discussion of how you went about approaching.

1. The Topic of the Paper: The Problem and
Solution
for Improving Customer Services for a Restaurant
Purpose/scope - The final paper/project is intended to engage
students in a real-world issue pertaining to your respective
internship. The paper topic will be determined and agreed to by
the intern supervisor and student. The topic should be beneficial
to the company and educational to the student. Once the topic is
determined, the student is expected to define the research
problem (problem statement), collect the necessary data, and
report on the findings. The length of the paper is not specified;
however, quality is preferred over quantity. It is expected that
papers should be at least 10+ pages long. Finally, it is required
that the paper/project and findings will be presented to the
internship supervisor by the student
The final paper/project format should be double-spaced using
12-point Times New Roman font with 1” margins.Content,
writing logic/flow, spelling and grammar will be graded as part
of your final grade. The final paper MUST include the bolded
section headings as directed and be organized in the following

2. manner:
1. Final Paper Format – Your paper must follow the following
format.
a. Cover Page – Title of the paper, course name and number,
semester year, student name and identification number and
instructor’s name
b. Table of Contents – Prepare a detailed table of contents,
which includes the following section below
c. Executive Summary – The executive summary should be a
summary of the report in 1-2 pages with the following captions:
i. Parameters of the report – purpose/objective of the study,
type of company, etc.
ii. Description of the problem – describe the problem and how
your project will be beneficial to the company.
iii. Methodology – describe how you went about solving the
problem. What type of survey did you do? How did you collect
data?, etc.
iv. Summary of findings and conclusions – summary of the facts
you found surrounding the problem or situation being
researched and your conclusions based upon those facts.
v. Recommendations – summarize the specific recommendations

3. you are making to the company to solve the problem or respond
to the research project.
d. Section I – Introduction/Background – Provide the reader
with a description/ background of the topic that is being
researched. Give a contextual backdrop to why this is an
important issue to be addressed (e.g., What are competitors
doing? What is the marketplace currently doing or headed?
What happens if this isn’t addressed?).
e. Section II – Statement of the Problem/Research Project – A
brief discussion of the specific topic that will be investigated
and addressed and why it is important. (e.g., What is the
problem? Why is this problem worth my attention? How
important, influential, or popular is this problem? Would
research findings lead to some useful change in best practice?)
f. Section III – Methodology – A discussion of how you went
about approaching and solving the problem or research project.
In other words, how did you collect the data you needed to
analyze for the project? This section, for example, should
included details on what type of survey you did including where
you found the survey and/or how you collected data, etc.
g. Section IV – Findings – A presentation of the factual (truth
and facts – not opinion) information you found regarding the

4. problem to be solved or the research project. What were the
strategic alternatives that might have been used to solve the
problem or research project? What alternative(s) did you decide
to use and why?
h. Section V– Conclusions - Given your findings of fact, what
are your conclusions as to what the underlying problems are, or
conclusions as to the research project?
i. Section VI – Recommendations - Given your findings and
conclusions, what are your specific recommendations to solve
the problems or achieve the objective of the research study?
j. References – 2-3 references minimum but more are expected.
Please provide a reference section when you cite any source in
your paper. Remember plagiarism is not acceptable and is
grounds for failure. All citation and references should follow
the APA format. Please see
(http://owl.english.purdue.edu/owl/resource/560/01) or
(www.apastyle.org) for exact specifications.
2. Final Paper Grading Criteria – The final paper will be graded
subjectively with the following items of critical importance:
a. Quality and depth of analysis of the problem or subject of the
research.
b. Quality and depth of the findings and conclusions.
c. Quality and depth of recommendations.
d. Organization and presentation of the report, including

5. grammar, spelling, content, use of sub-captions, exhibits,
numbering systems, and graphics.
e. Feedback (comments and grade A, B, etc.) by your supervisor
will also be used to determine your grade. Students are required
to present their findings to their supervisor during the semester.
Turnitin.com Requirement
· All final papers must be uploaded and submitted through
Turnitin.com link on iLearn for plagiarism and grammar checks.
· Directions and feedback: http://at.sfsu.edu/support/how-
submit-turnitin-assignment
· The paper must be uploaded and submitted to Turnitin.com no
later than the final packet due date outlined on the course
schedule. You can review the Turnitin feedback and make
changes to your paper.
· Turnitin Helpful links:
· To view you Turnitin Originality Report clink on the
directions link: http://at.sfsu.edu/support/how-view-your-
turnitin-originality-report
· Student Training – About Originality PDF -
http://turnitin.com/en_us/training/student-training/about-
originalitycheck
· Viewing originality reports:
http://turnitin.com/en_us/training/student-training/viewing-

6. originality-reports
Running Head: THE SCIENTIFIC METHOD APPLIED TO
DIGITAL FORENSICS 1
THE SCIENTIFIC METHOD APPLIED TO DIGITAL
FORENSICS 7
The Scientific Method Applied To Digital Forensics
by student name

7. Professor D. Barrett
University
Course
Todays date
Abstract
Computer forensics is the process of digital investigation
combining technology, the science of discovery and the
methodical application of legal procedures. Judges and jurors
often do not understand the inner workings of computers and

8. rely on digital forensics experts to seek evidence and provide
reliable, irrefutable testimony based on their findings. The
scientific method is the process of diligent, disciplined
discovery where a hypothesis is formed without bias, and
analysis and testing is performed with the goal of effectively
proving or disproving a sound hypothesis. When investigative
teams do not follow standard investigative procedures it can
lead to inappropriate and inaccurate evidentiary presentations
that are extremely difficult for non-technical participants to
refute. The practitioners of digital forensics can make strides to
measure and improve the accuracy of their findings using the
scientific method. This paper includes a summary of the
scientific method as applied to the emerging and growing field
of digital forensics and presents details of a specific case where
both the prosecution and defense would have benefitted greatly
from the use of this proven method of discovery and analysis.
Findings can only be deemed reasonably conclusive when the
scientific process is correctly applied to an investigation,
findings are repeatable and verifiable, and where both the
evidence collected and the tools used are subject to the utmost
scrutiny.
The Scientific Method Applied To Digital Forensics
The forensic analyst and investigator must use a unique

9. combination of technical, investigative, and scientific skills
when approaching a forensic case. Most adults remember the
Scientific Method from their middle school science class as a
set of six steps beginning with stating a problem, gathering
information, forming a hypothesis, testing the hypothesis,
analyzing the data and drawing conclusions that either support
or do not support the hypothesis. Peisert, Bishop, & Marzullo
(2008) note that the term computer forensics has evolved to
mean “scientific tests of techniques used with the detection of
crime” yet note that many academic computer scientists also use
the term to refer to the “process of logging, collecting, auditing
or analyzing data in a post hoc investigation”. The necessity to
maintain chain of custody requires methodical and detailed
procedures, as does the formulation of a legitimate and unbiased
hypothesis and conclusion using the scientific method. Since
many judges and jurors assume that computer forensic evidence
is as “reliable and conclusive” as it is depicted on television,
the legal system is unaware of the volatile nature of computer
forensics investigations and the significance of a scientific
approach to evidence gathering and analysis (Peisert et al.,
2008).
The Scientific Process as Applied to Computer Forensics
Peisert et al. (2008) discuss in detail the need for the use of the
scientific method in forensic investigations, not only for the
process of discovery and analysis of evidence, but for

10. measuring the accuracy of the forensic tools used in an
investigation. Casey (2010) agrees, and cautions that evidence
must be compared to known samples so that investigators better
understand the scope and context of the evidence that is
discovered or presented and to better understand the output of
forensic tools. Casey (2010) further elaborates that the
scientific method is a powerful tool for forensic investigators
who must be neutral fact finders rather than advocates for one
side of a case or the other.
The process of creating a hypothesis and completing
experiments to prove or disprove them allows an investigator to
gain a concrete understanding of the digital evidence or mere
traces of evidence under analysis. Casey (2010) also notes that
while there is no ethical requirement to do so and may be
impractical, a thorough investigative practice would consider
investigation of alternate scenarios presented by defense.
Forensic examination tools can contain bugs, or behave
differently with various types of data and forensic images.
Casey (2010) recommends that investigators examine evidence
at both the physical and logical layers since both methods can
provide unique perspectives, and the physical layer may not
yield deleted, corrupted or hidden data. Suspects with limited
technical experience can rename image files with different
extensions not used for images, and those with more technical
knowledge can use advanced steganography techniques to

11. embed data within other data in an attempt to defy detection.
The 2004 case of State of Connecticut v. Julie Amero in
Norwich, Connecticut is one where the scientific method was
clearly missing from both the defense and prosecution.
Eckelberry, Dardick, Folkerts, Shipp, Sites, Stewart, & Stuart
(2007) completed a comprehensive post-trial analysis of the
evidence as provided to the defense and discovered very
different evidentiary results using a structured scientific
approach to their investigation. Amero was a substitute
elementary teacher accused of displaying pornographic images
that appeared on pop-up’s to her students from what ultimately
was proven to be a spyware-infected school computer. The
credibility of the legal system was compromised and the
prosecution made a numerous incorrect assumptions based on
results provided from inadequate forensic tools and poor
investigative techniques (Eckelberry et al., 2007).
The computer that Amero was using in her classroom was a
Windows 98 machine running Internet Explorer 6.0.2800 and a
trial version of Cheyenne AntiVirus that had not received an
update in several years. The content filtering at the school had
expired several months prior to the incident. The prosecution
presented non-factual statements that may easily have been
misconstrued by a non-technical jury and that likely caused a
guilty verdict. The false testimony made by the school IT
specialist indicated that the virus protection was updated

12. weekly when in fact they were not since computer logs and the
signatures clearly showed that virus updates were no longer
supported by the vendor. The updates may have been performed
but against files that had no new updates for many months. The
IT Manager who testified also incorrectly claimed that adware
was not able to generate pornography and especially not
“endless loop pornography”. This information was received as
a fact by the non-technical jury and incredibly not refuted by
the defense. The detective for the prosecution also stated that
his testimony was based completely on the product
ComputerCop which the vendor admits is incapable of
determining if a website was visited purposefully or
unintentionally. The forensic detective astoundingly admitted
that he did not examine the computer for the presence of adware
(Eckelberry et al., 2007, p. 7-10).
The case against Amero was largely based on testimony stating
that she deliberately visited the offensive pornographic websites
and that the sites visited subsequently showed the links in red.
The post-trial investigative team quickly verified that the ‘sites
visited’ color setting in Internet Explorer on the suspect
machine was set to “96,100,32” which is a greenish-gray color.
One of the web pages that the defendant allegedly visited had an
HTML override to highlight one of the links presented in red
and was not colored based on a deliberate visit to the site.
According to Eckelberry et al. (2007) the page in question was

13. not discovered in “any of the caches or Internet history files or
the Internet History DAT files. The post-trial investigative
team through meticulous investigation and use of the scientific
method were able to present facts that were “exculpatory
evidence showing that the link was never clicked on by the
defendant” or any other person, and disproved most of the
statements made by the forensics examiner and the witnesses for
the prosecution (Eckelberry et al., 2007, p. 12-14).
The prosecution testimony stated that there was no evidence of
uncontrollable pop ups found on the suspect machine, however,
the post-trial investigative team discovered irrefutable evidence
that the page in question was loaded twenty-one times in one
second using a computer forensics tool called X-Ways Trace.
Eckleberry et al. (2007) detail many other instances where
testimony was haphazard and discovered that a Halloween
screen saver was the source of the adware that presented the
continuous stream of pornographic sites. The chain of custody
was also compromised in that the disk image was from a Dell
PC but the defense witness saw a Gateway PC stored at the
police station. The officer reportedly seized a computer but the
police report contradicts this and states that only a drive was
taken (Eckelberry et al., 2007, p. 14-17).
The case described and investigated by Eckelberry et al. (2007)
resembles a staged blunder designed as a humorous sample case
for beginning forensic students to discuss. The case was

14. however very real and even though the defendant was
eventually acquitted she suffered lasting harm from the
notoriety based on the initial conviction of contributing to the
delinquency of minors. If the prosecution or defense had
investigated the evidence using the scientific method and
maintained a credible chain of custody, or at least used clear
critical thinking while performing a thorough forensic
investigation this case may never have gone to trial. It wasted
the time and resources of judge, jury, and countless other
participants in the trial and permanently damaged an innocent
victim (Eckelberry et al., 2007).
Conclusion
The scientific method is a process that allows confidence in a
hypothesis when it can be subjected to repeated identical tests.
The use of the scientific method not only provides a methodical
structure to a forensic investigation, it lends credibility to a
case in the very nature of the steps used to document and
diligently test any given hypothesis. The case independently
investigated post-trial by Eckelberry et al. (2007) was
performed by a team of trained experts who were well aware of
the necessity of the methodical requirements and necessity of
the scientific method of discovery. Their findings proved that
the suspect was in fact a victim of poorly maintained computers
by a local Connecticut school system, that the forensic expert
and witnesses who testified in the case were untrained and

15. uninformed and used inadequate tools for the investigation.
Cases such as State of Connecticut v. Julie Amero illustrate the
importance of using the scientific method, and the necessity of
proper training in the art and science of digital forensics.
References
Carrier, B. (2002, October). Open Source Digital Forensics
Tools: The Legal Argument. In @ Stake Inc. Retrieved
September 8, 2011, from
http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.19.78
99&rep=rep1&type=pdf
Casey, E. (Ed.). (2010). Handbook of Digital Forensics and
Investigation (Kindle ed.). Burlington, MA: Elsevier, Inc.
Eckelberry, A., Dardick, G., Folkerts, J., Shipp, A., Sites, E.,
Stewart, J., & Stuart, R. (2007, March 21). Technical Review of
the Trial Testimony of State of Connecticut vs. Julie Amero.
Retrieved September 9, 2011, from http://www.sunbelt-
software.com/ihs/alex/julieamerosummary.pdf
Nelson, B., Phillips, A., & Steuart, C. (2010). Guide to
Computer Forensics and Investigations (4th ed.). Boston, MA:
Course Technology, Cengage Learning.
Peisert, S., Bishop, M., & Marzullo, K. (2008, April).
Computer Forensics in Forensis. Retrieved September 8, 2011,
from

16. http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.140.3
949&rep=rep1&type=pdf