Computer Forensics and Cyber Crime

Computer Forensics and Cyber Crime

• Computer forensics is a legal approach to finding digital evidence in cybercrime scenes.
• Pre-search activities include gathering information, determining the number and type of computers, identifying potential risks from personnel affecting evidence, and understanding the volatility of evidence.
• Pre-search activities also involve reliance on judicial authority for data gathering, possible expert consultation, social engineering, and dumpster diving.
• Warrant preparation and application requires thorough review by legal counsel and computer experts. Probable cause must be demonstrated.
• Seizing equipment procedures must explicitly justify the seizure of hardware and storage devices—not just the search.
• Items like criminal contraband, fruits of the crime, and items criminally possessed may be seized without warrants.
• No-knock warrants may be used in exigent circumstances like specific offense type, potential for evidence destruction, target sophistication, or absence of the resident.
• Secondary/multiple warrants are sometimes necessary, for example, when searching for theft of identity and encountering drug trafficking records, or for networked computers with off-site storage.
• Pre-search activities incorporate a five-paragraph military order (SMEAC): situation, mission, execution, avenues of approach and escape, and communications.
• On-site personnel may include a case supervisor, arrest team, security team, interrogation team, sketch and photo team, physical search team, and seizure team, the latter which usually goes last.
• Law enforcement tool kits depend on what they expect to find on the scene.
• This may include evidence tape, packing tape, evidence containers, labels, anti-static bags, conductive bags, and Faraday bags.
• Computer-specific equipment and materials may include multiple boot disks, backup hardware, new hard drives, color scanners, color printers, computer paper, current anti-virus software, imaging software, and application software.

Forensic Investigation

• Legal approach to find digital evidence in cybercrime scene.
• Pre-search activities; On-site search activities.

Traditional Problems Associated with Finding Digital Evidence

• Multirole operation: Computer crime investigators need to take on multiple roles (e.g., case supervisors, investigators, technicians, forensic scientists), leading to complications due to resource limitations.
• Fragility of evidence: Digital evidence is susceptible to environmental damage (e.g., climatic, environmental), human error, and is often voluminous.
• Size of potential evidence: The need to analyze all potential evidence, not just samples.
• Costly Investigations: Incorrect procedures can lead to lawsuits against the investigating agency.
• Complexity: Growing criminal sophistication (encryption, steganography, self-destructive programs) makes finding evidence difficult.
• Slow legislation: Technological advancement outpaces the pace of law enforcement training.

Pre-search Activities

• Reliance on traditional methods for gathering information and preparing for scene arrival.
• Determining computer location, size, type, and number.
• Personnel risks affecting potential evidence and evidence volatility.
• Judicial authorization for data gathering.
• Potential need for expertise or non-departmental experts.
• Social engineering and dumpster diving for potential evidence.

Warrant Preparation and Application

• Search warrant applications should be reviewed by computer experts and legal counsel.
• Demonstrating probable cause is critical (crime committed, evidence exists in a specific location)

Seizing Equipment

• Justification needed for seizure of equipment (not just search), including all hardware and storage devices.
• Justification is based on constitutionally justifiable reasons.

No-knock warrants

• No-knock warrants may be considered based on the nature of the offense, potential for evidence destruction, sophistication and maturity of the target, and absence of the resident.

Secondary/multiple warrants

• Secondary/multiple warrants may be necessary when searching for specific crimes or for networked computers.

Plan Preparation and Personnel Gathering

• Uses a five-paragraph military order approach (SMEAC): Situation, Mission, Execution, Avenues of approach and escape, and Communications
• On-scene Personnel Roles: Including Case Supervisor, Arrest Team, Security Team, Interrogation Team, Sketch & Photo Team, Physical Search Team, and Seizure Team.

Traditional Equipment

• Evidence tape, Packing tape, Evidence Containers, Labels, Anti-static Bags, Conductive Bags, Faraday Bags

Computer-Specific Equipment and Materials

• Multiple boot disks
• Backup hardware and miscellaneous computer peripherals
• New hard drives
• Color scanner
• Color printer and computer paper
• Current antivirus software
• Imaging software
• Application software

On-Scene Activities

• Steps involved in serving a warrant (Knock, Notice, Document)
• Dealing with dangerous individuals/safety hazards
• Locating and securing all computers.
• Removing personnel from evidence area.
• Ascertaining network connections.
• Disabling network access (ideally by a network administrator).
• Protecting computers by a police officer.
• Collection of evidence-related literature.
• Determining the need for external specialists.
• Documentation of scene information like date, time, and detailed description of computer ( including physical damage) including info of all investigative personnel, suspect, and witnesses .
• Documenting all clues and leads found.
• Using investigative software.
• Photograph/Video documentation to verify and challenge corrupted/contaminated evidence
• Critical identifying info must be included in scene sketches.
• Non-digital evidence (trace evidence, hair, fibers, fingerprints) should not be overlooked.
• Circumstantial evidence should be noted (post-it notes, computer printouts, paper types, labels, DVD burners, packaging).
• Computer components and evidence should be noted (desktops, monitors, keyboards, telephones, wallets/purse, clothing, trash cans, recycle bins, printers, and inside the computer itself)
• Seizure and documentation of evidence limited by warrant, get secondary warrants if needed, all annotations must be in ink.
• Comprehensive notes must be generated and contents of computer drives imaged to clean media.
• Document the computer status before powering off (photos, sketches, notes, connections).
• Place evidence tape over all disk openings after powering off computer.
• Label all cords and empty slots.

Bagging and Tagging

• Use a chain of custody log to record items taken.
• Labels include investigator's initials, date found, and location of evidence.
• Taking pictures or making video documentation of the equipment.

Considerations and Factors

• Factors for packaging and transporting computers include temperature (heat), oil, dirt, dust, magnetic fields, and other environmental factors.
• Maintaining a chain of custody by clearly logging the evidence at each handling step.
• Consider who controlled the digital evidence, when it was collected and stored, where it was collected and what type of equipment was used to hold it, who had access, and who owned the equipment, after the forensic analysis.
• Relays on traditional methods for leaving the crime scene.

Scene Departure and Transportation

• Reliance on traditional methods for leaving the crime scene
• Review of shipping manifests upon arrival
• Documentation to evidence control systems for analysis.

This quiz covers the critical concepts of computer forensics and its legal implications in cybercrime investigations. It explores pre-search activities, warrant preparation, and procedures for seizing equipment, along with the importance of judicial oversight. Test your knowledge on this crucial aspect of digital evidence gathering.