db cybercrime week3

pdf1.pdf

Home >Law homework help >Criminal homework help >db cybercrime week3

Digital Evidence Guide for

First Responders

May 2015

Massachusetts Digital Evidence Consortium

Digital Evidence Guide for First Responders - MDEC

A Note to the ReAdeR There are an unlimited number of legal and technical variables in any criminal investigation involving digital evidence that will determine the appropriate course of action in a particular case. This guide is intended to serve as a basic educational resource for law enforcement officers encountering digital evidence in criminal investigations. This guide does not and should not be interpreted as a policy or legal document. Law enforcement agents seizing digital evidence should contact their local prosecutor or agency counsel with requests for legal guidance. Within this guide you will find forms frequently used in the collection of digital evidence. These forms are designed for you to photocopy to letterhead for ease of use.

AdditioNAl AssistANce If you need further assistance in the seizure of digital evidence, or you are in an emergency situation requiring immediate assistance, please contact a digital evidence analyst in your jurisdiction.

Page 1

AdditioNAl digitAl evideNce FiRst RespoNdeR ResouRces

United States Secret Service: Best Practices for Seizing Electronic Evidence http://www.forwardedge2.usss.gov/pdf/bestPractices.pdf

National Institute of Justice: Forensic Examination of Digital Evidence: A Guide for Law Enforcement https://www.ncjrs.gov/pdffiles1/nij/199408.pdf

National Institute of Justice: Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition https://www.ncjrs.gov/pdffiles1/nij/219941.pdf

National Institute of Justice: Electronic Crime Scene Investigation: An On-the-Scene Reference for First Responders https://www.ncjrs.gov/pdffiles1/nij/227050.pdf

National Institute of Justice: Digital Evidence in the Courtroom: A Guide for Law Enforcement and Prosecutors https://www.ncjrs.gov/pdffiles1/nij/211314.pdf

Department of Justice: Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations http://www.justice.gov/criminal/cybercrime/docs/ssmanual2009.pdf

Page 2

http://www.forwardedge2.usss.gov/pdf/bestPractices.pdf

https://www.ncjrs.gov/pdffiles1/nij/199408.pdf

https://www.ncjrs.gov/pdffiles1/nij/219941.pdf

https://www.ncjrs.gov/pdffiles1/nij/211314.pdf

https://www.ncjrs.gov/pdffiles1/nij/199408.pdf

Digital Evidence Guide for First Responders - MDEC

iNteRview ANd iNteRRogAtioN QuestioNs FoR cRimes iNvolviNg digitAl evideNce

Always obtain passwords and/or security codes for all pieces of digital evidence.

1. Where are the digital crime scenes? These crime scenes may include: (1) locations within the jurisdiction, like homes, where computers and other digital devices are located; (2) offices and business networks; and (3) third-party providers like internet or cellular service providers. The legal and technical considerations for digital evidence collection vary depending upon the type of crime scene.

2. Is there an ongoing risk of injury or loss to any person or property?

3. What is the motive for the offense? Determining motive will help the investigator locate essential witnesses and critical evidence.

4. What computers, mobile devices, digital media, or internet accounts do the victims, witnesses, and suspects use? How and where do these individuals access these systems and/or devices?

5. Is evidence of the crime also held by a third party internet, cellular, or remote computing service provider? If so, collection of the information may be subject to the provisions of federal and state statutes pertaining to law enforcement access to records and communications held by these providers. Preserve any records, communications, or subscriber information held by these providers using the freeze order in this Guide, then consult with legal counsel or your local prosecutor. To find appropriate law enforcement contacts at these companies, visit www.search.org/programs/hightech/isp/.

Page 3

www.search.org/programs/hightech/isp/

iNteRview ANd iNteRRogAtioN QuestioNs FoR cRimes iNvolviNg digitAl evideNce

Always obtain passwords and/or security codes for all pieces of digital evidence.

6. For computer systems, what is the name of each person who uses the computer? What are each users’ account name(s), privileges, passwords, and usage habits?

7. For computer systems and mobile devices, what operating system is installed? What applications on the computer or mobile device relate to the current investigation?

8. Are there any data encryption, security, or backup applications installed on the device? What are the names of the applications, and passwords to bypass the security? Where is backup data saved? (ie. cloud account, removable media, computer system, etc.)

9. What internet-based (ie. social network, web, electronic mail, etc.) or cellular services or accounts do the witnesses and suspects in your case use? How are they accessed by the user? What are the user names and passwords? Does anyone else have access to or use these accounts?

10. Has the witness or suspect lost, lent out, allowed access to, or experienced problems with a device or computer that contains evidence? If the answer is yes, ask for a detailed explanation.

Page 4

Digital Evidence Guide for First Responders - MDEC

FReQueNtly seized devices - smARtphoNes ANd otheR mobile devices

Step 1 - Document the device and all collection procedures and information • Photograph • Video • Sketch • Notes • Chain of custody

Step 2 - Determine if the device is on or off • Look for lights • Listen for sounds • Feel for vibrations or heat

NOTE - Many mobile devices save power by turning off screens after a specified amount of time. Despite the screen status, the device is likely still active. Ask if the device is currently powered on. Where legal, pressing the home button quickly will activate the screen.

Step 3 - If the device is off, do not turn it on • Collect and package (see Step 5) • Ask for password/pass pattern • Transport (see Step 6)

Page 5

Android unlock screen

BlackBerry Classic

Apple iPhone 6 and 6 Plus

Step 4 - If the device is on, proceed with caution

WARNING - The two most significant challenges for officers seizing mobile devices are: (1) isolating the device from cellular and Wi-Fi networks; and (2) obtaining security passwords or pass patterns for the device so the evidence can be examined forensically. Always ask if there is any security feature enabled on the phone. These can include passwords (simple or complex), security/wiping apps, pass patterns, or biometrics (facial scan). Document (see the attached consent form for guidance) and confirm the password or pass pattern. Turning the device off could result in the loss of evidence. The best option is to keep the device powered, unlocked (if locked, collect any available passwords, PIN codes, or security unlock information), and in airplane mode until it is in the hands of an experience technician.

Step 5 - Collection and Package

WARNING - You may need to collect other forensic evidence including fingerprints, biological samples, DNA, etc. from smartphones and mobile devices. Work with crime scene technicians or trained forensic personnel to preserve such evidence without disturbing the integrity of the

data on the device. Be sure to advise forensic examiners in advance of submission of the possible existence of hazardous material on the device.

• Secure data and power cables • Consider collecting computers that may contain

device backups • Package the device so it will not be physically

damaged or deformed • Package the device in evidence bags or boxes

Step 6 - Transport • Deliver evidence to a secure law enforcement facility

or digital evidence laboratory as soon as possible • Protect from temperature extremes and moisture

Page 6

Samsung Galaxy S6

Faraday Bag

Digital Evidence Guide for First Responders - MDEC

FReQueNtly seized devices – lAptop ANd desktop computeR systems

Step 1 - Document the System • Photograph • Video • Sketch • Notes • Chain of custody

Step 2 - Determine if the system is on or off • Apply the “Look, Listen, and Feel” test • Look for flashing lights, listen for sounds, and feel

for heat or vibrations

Step 3 - If the system is off, do not turn it on • Disassemble (see Step 5) • Transport (see Step 6)

Step 4 – If the system is on, proceed with CAUTION • Do not type, click the mouse, or explore files or

directories without advanced training or expert consultation

• Ask about passwords and/or encryption of the system • Observe the screen, and look for any running programs that indicate access to internet-based accounts, open files, encryption, or the presence of files or data of potential evidentiary value • If you see anything on the screen that

concerns you or needs to be preserved, consult with an expert (if you don’t know who to contact, call the number on the inside cover of this manual)

• Photograph the screen • Once you are prepared to power

down the system, pull the plug from the back of the computer system

• Remove the battery from a laptop system

Page 7

Page 8

Step 5 – Disassemble and package the system WARNING – You may need to collect other forensic evidence including fingerprints, biological samples, DNA, etc. from computer systems, digital devices, and electronic media. Work with crime scene service technicians or trained forensic personnel to preserve such evidence without disturbing the integrity of the digital media.

• Photograph the system from all perspectives

• Clearly mark evidence and document chain of custody, location, and other important details about the seized item(s)

• Disconnect and secure cables • Check media ports and cd/dvd trays for

the presence of removable media • Package the system, and peripheral

devices, for transport using laptop bags (if applicable), boxes, or evidence bags

Step 6 – Transport • Protect from temperature extremes and moisture • Do not place evidence in the cruiser’s trunk • Protect from electro-static discharge • Package evidence so it will not be physically

damaged or deformed • Deliver evidence to a secure law enforcement facility

or digital evidence laboratory as soon as practicable

Digital Evidence Guide for First Responders - MDEC

otheR commoNly seized devices thAt mAy stoRe digitAl evideNce

There are many other storage media and technical devices that may process and store digital evidence. Examples of these devices include media cards (ie. secure digital, SIM, flash, memory sticks), thumb drives, optical media (ie. CD, DVD, and Blu-ray), digital cameras, MP3 players, iPods, servers, surveillance systems, gaming stations (ie. Xbox, PlayStation, Wii), and GPS devices.

Each of these devices is capable of holding significant digital evidence that will help your case. And each is handled in a separate way. Seizure of these items should be performed with special care. Consider working with an experienced digital evidence analyst to collect these items.

Step 1 - Document the device and all collection procedures and information • Photograph • Video • Sketch • Notes • Chain of custody

Step 2 - For items that have power, determine if the device is on or off • Look for lights • Listen for sounds • Feel for vibrations or heat

Step 3 - Ask if there are any security features enabled on the device including passwords or encrypted file protection.

Step 4 - If the device is off, do not turn it on • Collect and package (see Step 6) • Transport (see Step 7)

Page 9

Sony PlayStation 4

USB drive

Blu-ray Disc

MicroSD Card

Step 5 - While assessing, collecting, packaging, and transporting, follow these device-specific rules

• Only trained personnel should collect data from a server. If you don’t know what you are doing, stop and call an expert. Be careful when asking for the assistance of information technology or other personnel on-site

• GPS devices, MP3 players, and digital cameras should be turned off to secure data. Be sure to ask for any passwords or security features • If available, paper evidence bags, or static-free evidence bags, are best for the storage of media • Media contained in binders or carriers should

remain in the container • Be careful not to scratch optical media during seizure. • Gaming stations should be seized in the same manner as

computers

WARNING - Collecting evidence from surveillance systems can be difficult. Time is of the essence as digital surveillance systems often have proprietary software and hardware needs for playback. Speak to your prosecutor or agency legal counsel when making a decision about the seizure of a digital surveillance system as opposed to footage or segments of video extracted from the system. Also, be sure to get the company and installer name and contact information for the person that installed or maintains the system.

Step 6 - Collection and Package • Follow chain-of-custody procedures • Secure data and power cables • Label the evidence container(s), not the device(s) • Package the device so it will not be physically damaged

or deformed • Package the device in

evidence bags or boxes

Step 7 - Transport • Deliver evidence to a secure law enforcement facility

or digital evidence laboratory as soon as practicable • Protect from temperature extremes and moisture

Page 10

Microsoft Xbox One

Garmin GPS

D EM

A N

D F

O R

TH E

PR ES

ER V A TI

O N

O F

RE C

O RD

S PU

RS U

A N

T TO

1 8 U

.S .C

. §

2 7 0 3 (f )

A TT

EN TI

O N

: K

EE PE

R O

F RE

C O

RD S

PR O

V ID

ER :

__ __

_ D

A TE

__ __

_ FA

__ __

__ _

D ea

r Si

r o r

M a d a m

ea se

b e

a d vi

se d t h a t th

is a

g en

cy is

c o n d u ct

in g a

n o

ff ic

ia l c

ri m

in a l i

n ve

st ig

a tio

n t h a t in

vo lv

es t h e

b el

o w

li st

a cc

o u n t.

W e

a re

in t h e

p ro

ce ss

o f re

vi ew

in g t h e

in ve

st ig

a tio

n t o o

b ta

in a

s ea

rc h w

a rr

a n t, g

ra n d ju

ry s

u b p o en

a , o r

o th

a p p lic

a b le

c o u rt

o rd

er t o o

b ta

in in

fo rm

a tio

n b

el ie

ve d t o b

e in

y o u r

p o ss

es si

o n . A

s I a m

s u re

y o u a

re a

w a re

, 1 8 U

.S .C

§ 2

7 0 3 (f ), t itl

ed “

Re q u ir

em en

t to

P re

se rv

e Ev

id en

ce ,”

p ro

vi d es

“( 1 ) In

g en

er al

- A

p ro

vi de

r of

w ir e

or e

le ct

ro ni

c co

m m

un ic

at io

n se

rv ic

es o

r a

re m

ot e

co m

pu tin

g se

rv ic

e, u

po n

th e

re qu

es t o

f a g

ov er

nm en

ta l e

nt ity

, sh

al l t

ak e

al l n

ec es

sa ry

s te

ps to

p re

se rv

e re

co rd

s an

d ot

he r

ev id

en ce

in it

s po

ss es

si on

p en

di ng

th e

is su

an ce

o f a

c ou

rt o

rd er

o r

ot he

r pr

oc es

(2 )

Pe ri od

o f r

et en

tio n

- R ec

or ds

r ef

er re

d to

in p

ar ag

ra ph

( 1

) sh

al l b

e re

ta in

ed fo

r a

pe ri od

o f 9

0 d

ay s,

w hi

sh al

l b e

ex te

nd ed

fo r

an a

dd iti

on al

9 0 d

ay p

er io

d up

on a

r en

ew ed

r eq

ue st

b y

th e

go ve

rn m

en ta

l e nt

ity .”

s su

ch ,

w e

a re

r eq

u es

tin g t h a t yo

u r

o ff ic

e ta

ke s

te p s

to im

m ed

ia te

ly p

re se

rv e

a n y

a n d a

ll in

fo rm

a tio

n in

y o u r

cu st

o d y

re la

te d t o t h e

a cc

o u n t b el

o w

, in

cl u d in

g b

u t n o t lim

ite d t o , su

b sc

ri b er

in fo

rm a tio

n , tr

a n sa

ct io

n a l r

ec o rd

s, s

er vi

h is

to ry

, p a ym

en t re

co rd

s, lo

g in

a n d lo

g o u t re

co rd

s, a

n d a

cc o u n t co

n te

n t fo

r th

e u se

r o r

su b sc

ri b er

__ __

B ec

a u se

t h is

is a

c ri

m in

a l i

n ve

st ig

a tio

n , w

e a re

r eq

u es

tin g t h a t n ei

th er

y o u n

o r

yo u r

o ff ic

e d is

cl o se

t h e

fa ct

o r

th e

ex is

te n ce

o f o u r

re q u es

t, t h e

in ve

st ig

a tio

n , a n d /o

r a n y

co m

p lia

n ce

o r

a ct

io n m

a d e

w ith

r es

p ec

t th

er et

o .

I t h a n k

yo u in

a d va

n ce

f o r

yo u r

a tte

n tio

n t o t h is

m a tte

r. Sh

o u ld

y o u h

a ve

a n y

q u es

tio n , p le

a se

d o n

o t h es

ita te

t o c

o n ta

ct m

e u si

n g t h e

co n ta

ct in

fo rm

a tio

n b

el o w

n ce

re ly

y o u rs

__ __

C o n ta

ct N

a m

__ __

A g en

cy :

__ __

Ph o n e:

__ __

Em a il:

__ __

I, __

__ __

__ _,

(D O

B __

__ /

_ __

_ /

__ __

), h

er eb

y au

th or

iz e

__ __

, a n

of fic

er w

ith th

e __

__ __

__ ,

or a

ny o

th er

la w

en fo

rc em

en t o

ffi ce

r o r d

ig ita

l e vi

de nc

e an

al ys

t w or

ki ng

w ith

th e

af or

em en

tio ne

d of

fic er

, t o

ta ke

c us

to dy

o f,

co py

, a nd

a na

ly ze

th e

ite m

s de

ta ile

d be

lo w

fo r e

vi de

nc e.

I u

nd er

st an

d th

at c

op ie

s of

th e

co nt

en ts

o f t

he it

em s,

in cl

ud in

g al

l f ile

s an

d da

ta , m

be c

re at

ed a

nd re

ta in

ed fo

r a na

ly si

s. I

al so

u nd

er st

an d

th at

th e

an al

ys is

o f t

he c

op ie

s o f t

he m

ed ia

m ay

c on

tin ue

e ve

n af

te r t

ite m

s d es

ig na

te d

fo r a

na ly

si s a

re re

tu rn

ed .

I p ro

vi de

m y

co ns

en t t

o th

is a

na ly

si s f

re el

y, w

ill in

gl y,

a nd

v ol

un ta

ri ly

, a nd

w ith

th e

kn ow

le dg

e th

at I h

av e

th e

ri gh

t t o

re fu

se to

c on

se nt

. I p

ro vi

de m

y co

ns en

t w ith

ou t f

ea r,

th re

at , c

oe rc

io n,

o r p

ro m

is e

of a

ny k in

M a ke

M o d el

Se ri

a l N

u m

b er

O w

n er

/U se

r( s)

C o m

p u te

r/ D

ev ic

e Se

cu ri

ty Pa

ss w

o rd

T yp

e (D

ev ic

e, A

cc t, E

tc .) :

__ __

Pa ss

P a tte

rn ( U

se A

rr o w

s fo

r D

ir ec

tio n )

Pa ss

w o rd

T yp

e (D

ev ic

e, A

cc t, E

tc .) :

__ __

N o te

s __

__ __

Pr in

te d N

a m

e Si

g n a tu

W itn

es s

1 N

a m

e Si

g n a tu

W itn

es s

2 N

a m

e Si

g n a tu

oFFiceR sAFety is top pRioRity

do…

Make sure you are lawfully present and have appropriate legal authority to conduct the search.

Secure the scene.

Make sketches and/or take photos.

Consult technical experts as needed.

Use seizure form if collecting digital evidence.

do Not…

Turn on computers or other digital devices.

Touch a computer if it is ‘on’ unless you are properly trained.

Allow anyone access to computers or other digital devices.

Members of the MDEC Executive Board represent the following agencies