Julia Katchum is in charge of the Eastern Regional Counterterrorism Computer Forensics Unit. Her recent investigations led her to believe that an imminent threat of a terrorist act in the Chicago area exists. She did not know much about the attack except that at least four terrorists were involved, and one of them had just made a phone call from inside the main offices of Stevenson and Barnes International Accounting Firm. Her immediate task was to proceed directly to Stevens and Barnes with an eight-person tactical team including a counterterrorism field officer to apprehend the suspect.
Julia's primary mission was to search the suspect's office and home computers and find any information that could help thwart the attack. It was though the attack could take place before the day was over.
When Julia and the CTU (counterterrorism unit) team arrived at the accounting firm, only the CTU officer went inside to avoid drawing undue attention. Inside, the CTU officer surreptitiously spoke to the security guard at the front desk and asked to be escorted to the office of the head of security. Once there, the CTU officer used the building's surveillance cameras to locate the suspect who was in the center of a very large room full of staff accountants working in individual cubicles.
The CTU officer decided against sending in the entire team and to make the arrest alone. There was too big a chance that the suspect could see the team coming at him because of his position in the center of the room. If he saw them coming, he could have time to delete valuable evidence or to notify other terrorists.
The CTU officer worked his way through the cubicles in as casual a way as possible, but when he got half way to his destination; the suspect seemed to identify him and began typing frantically on his computer. When the CTU officer realized what the suspect was doing, he ran the rest of the way and stopped the suspect by pressing his 10mm pistol into the side of the man's head.
The CTU raided the suspect's home at the same moment he was arrested. Just a few minutes later, the officer in charge of that raid delivered the notebook computer to John Dobson, CTU's forensic accountant, as he was just beginning to look over the suspect's computer in the Stevens and Barnes offices.
John noted the following facts:
The suspect's office computer had opened an instant messenger program. He could see a piece of a message written in Arabic.
The battery in the home notebook computer was warm, even though it was turned off and not plugged in when it was seized.
What approach should John take in examining the two computers? What are some specific things that he should include in his examination?