Chapter 15 legal issues Computer Forensics Fundamentals

• Computer forensics involves the scientific collection and examination of data on electronic devices.
• The purpose of computer forensics is to discover evidence related to an event or crime.
• It is a demanding field, with new data storage technologies emerging constantly.
• The U.S. Department of Labor projects higher-than-average job growth in computer forensics.

Fields of Computer Forensics:

• Individuals may use computer forensics to find evidence for tort claims, including sexual harassment, discrimination, and other civil litigation.
• Computer forensics helps uncover evidence for criminal defense cases.
• The military employs computer forensics for intelligence and cyberattack preparedness.
• Organizations use computer forensics to investigate employee misconduct, embezzlement, and intellectual property theft, integrating it into incident response programs.
• Colleges and universities utilize computer forensics for research and internal incident response.
• Data recovery firms apply computer forensics to data rescue and advise clients on data loss prevention.

Sources of Digital Evidence:

• Computer systems include desktops, laptops, and servers, along with associated hardware and software.
• Peripheral devices such as keyboards, microphones, web cameras, and memory card readers fall under computer systems.
• Storage devices encompass internal/external hard drives, floppy disks, CDs, DVDs, and flash drives.
• Mobile devices include cell phones, smartphones, tablets, PDAs, pagers, and GPS devices.
• Digital cameras, video cameras, and multimedia devices are relevant sources.
• Networking equipment includes hubs, routers, servers, switches, and power supplies.
• Other sources include copiers, fax machines, answering machines, printers, scanners, DVRs, and video game systems.
• Internet of Things (IoT) devices, fitness trackers, medical devices, environmental sensors, and industrial equipment.

Specializations:

• Media analysis focuses on data stored on physical media to discover normal, deleted, encrypted, or hidden data; this chapter mainly focuses on media analysis concepts.
• Code analysis (malware forensics) involves reviewing code for malicious signatures from viruses, worms, and Trojans, remaining essential due to evolving malware.
• Network analysis is focused on examining network traffic, like transaction logs, to investigate incidents using real-time monitoring.
• Examiners may specialize in email forensics, which uses media and network analysis to find sender, recipient, and content details, particularly relevant due to malware often spread via email.
• In 2019, almost 94% of malware came via email.

Role of a Computer Forensic Examiner

• The field of computer forensics is relatively new and growing fast.
• The FBI started creating software to collect computer evidence in 1984.
• In 1990, the oldest group dedicated to computer forensics, IACIS, was formed.
• The first conference on computer forensics was held in 1993.
• Although the IOCE no longer exists, it established some early principles for computer forensic examiners after being formed in 1995.
• Scientific Working Group on Digital Evidence (SWGDE) was created in 1998 to participate in IOCE efforts.
• Computer forensic examiners find and collect evidence on electronic devices for civil and criminal cases.
• They must collect evidence scientifically and understand technologies, hardware, and software.
• Computer forensic examiners should be able to provide answers to ‘who, what, where, when, why, and how’.

Qualifications:

• Knowledge of computing technologies is essential.
• Ability to employ the scientific method for repeatable, verifiable examinations is needed.
• An understanding of evidence laws and legal procedures is required
• Access to and skill in using computer forensic tools is helpful.
• They should have outstanding record-keeping abilities
• People leave traces when interacting, according to Locard's exchange principle.
• Examiners need to find trace evidence, including log information that can be used to prove activity on a system.
• Recovery procedures require examiners to protect data, avoid altering it, and make exact data copies.
• Discovering normal, deleted, password-protected, hidden, and encrypted files.
• Study data to create timelines of electronic activity.
• Identify case-relevant files and data and fully document all evidence-collection activities.
• Provide expert testimony on digital evidence recovery.

Certification:

• Examiners should be competent, showcased through advanced degrees or certifications.
• Courts use legal principles and rules to screen examiners.
• Examiners may be governed by state private detective laws, requiring licensing.
• The ABA asked states to stop needing computer forensic examiners to get a private detective license.

Credential Examples:

• (CCE) —From the International Society of Forensic Computer Examiners (ISFCE), vendor-neutral since 2003. -(CCFE)—From the Information Assurance Certification Review Board (IACRB), vendor-neutral, requires practical/written exams. -(CFCE)—From the IACIS, vendor-neutral; only for law enforcement personnel, requires a practical exam. -(GCFA)—Tests practical knowledge, a vendor neutral from the Global Information Assurance Certification (GIAC).
• Vendor-specific credentials, e.g., EnCase Certified Examiner (EnCE).
• AccessData Certified Examiner (ACE) for FTK tool knowledge.

Licensing:

• Some states such as Illinois, Michigan, Oregon, and Texas require computer forensic examiners to have a private detective license, but it may encompass computer technicians/repair personnel.
• Other states such as North Carolina and Virginia don't include computer forensic examiners in private detective licensing laws.

Collecting and Handling Data:

• Evidence must be admissible so a judge or jury can assess it in court
• Evidence must be collected lawfully and scientifically for digital evidence which means a repeatable examination.
• Examiners must use practices and explain results clearly to clients, judges, or juries.

Investigative Process:

• The process agencies use will vary in the specific steps, types of incident, urgency of the case, and organization performing the investigation.
• Identification
• Preservation
• Collection
• Examination
• Presentation
• This provides law enforcement or agencies the means to identify, collect, and preserve digital evidence
• Examiners must identify involved devices and ensure adequate tools are available, tailoring their approach to case facts.
• Secure the scene to prevent tampering to evidence by suspects, witnesses, or unauthorized remote access, thus this is to make sure evidence isn't altered or reversed.
• The Chain of Custody proves evidence admissibility, which requires documenting who obtained it, how, when, where and who secured/possessed it to prove reliability, protecting the evidence

Collection In Practice:

• Data may need to be collected on-site due to device location (business computers), ownership restrictions, or device use in ongoing criminal activity.
• Examiners should know device operation to gather details of the device usage.
• Documentation involves recording location, on/off status, condition, and screen content of devices using video, photos, and notes for chain of custody.
• The collection which involves "bag and tag" involves collecting electronic devices using collection, packaging, and transportation methods to reserve evidence.

Encryption and Digital Evidence:

• Electronic device locks/encryption can hinder computer forensic examiners.
• The Fifth Amendment protects against compelled, testimonial, incriminating communications.
• Providing a password/passcode potentially incriminates, shielding defendants from sharing their minds' contents unless proven otherwise.
• Passwords/passcodes stored in mind are more likely to be protected versus biometrics, not protected under the Fifth Amendment.
• Merging the best of law and technology means newer privacy features quickly disable biometric locks and revert the smartphone to requiring a password

Electronic Device Handling:

• Electronic devices should be protected with the longest password under current law to best protect the data.
• Stored communications are protected by the ECPA.
• Particular topic area is determined by the U.S. Supreme Court because this topic is an area of federal constitutional law
• Cell phones should stay on in order to preserve the data, and it must be protected from incoming calls or messages.
• Shielded evidence bags or Faraday bags shield a device from incoming interference.
• Document physical evidence by recording the state of how all electronic devices are configured, including things such as mouse and keyboard, tagging cables, and manuals.

Computer Forensics Examination:

• Examiners duplicate electronic storage media through imaging.
• A forensic duplicate image is an exact copy of the storage media that contains the deleted files, normal files, and other data.
• Examiners use write blockers to prevent alteration to the storage media by only allowing data to move in one direction.
• Verifying images ensures its identical to the original by using an algorithm.
• An algorithm is applied to the data so that it can create a "hash” on both the duplicate and the original.
• It can be proven that both images are correct if the hash is the same on both images, making sure data hasn't changed.
• A hashing algorithm output may be a checksum.
• Persistent data is stored on hard drives.
• Volatile data is stored in memory.

Forensic Examiners look at the following aspects:

• File access and download histories
• Internet browsing history
• data/file deletion attempts
• Email communications
• Chat logs
• Image files
• Financial/medical documents
• Address books

Reporting:

• Examinations must be auditable to ensure examination procedures are repeatable and verifiable with the same results.
• Computer forensic examiners must report findings, explain data collection, and act as expert witnesses with knowledge of computing technologies and the scientific method.
• Follow a scientific methodology to ensure reliability in court, with the reliability measured using the Daubert test.
• Examiner must have the ability to testify on behalf of forensic tools.

Ethical Principles:

• Common principles that are adopted include not altering digital evidence, ensuring competence, fully documenting handling, proper possession, and agency compliance.
• The CCE credential requires CCE holders need to follow a code of ethics.

Laws:

• Laws will ask if the evidence authority is legal and whether or not the evidence is valid in court.
• Laws regarding the ability to collect data on an individual is the first question Rules and case law addresses the second. Federal and state courts have rules for trials. evidentiary, with the FRE used to determine admissibility
• It’s better to keep in mind the difference between law enforcement and private entities in regards to legal parameters
• There are many laws that define the ability for the government to watch and collect data. Most stem from protections of constitutional rights.
• Intrusive powers of the government is curbed by The Fourth Amendment

Electronic Communications Privacy Act (ECPA):

• The ECPA sets the guidelines for rules regarding accessing or interception of electronic communications. They include things such as texts, emails, telephone calls, and faxes
• ECPA says that people cannot access communications unless otherwise stated in the terms. Rules are different for private entities than the government
• The government needs a warrant with probable cause to look at what is contained in stored communications
• Lawful disclosure to law enforcement is allowed for private entitles of criminal activity. The "silver platter" doctrine also applies.
• 4th Amendment prevents Government search/seizure of privacy.
• Need search warrant that specifies criminal activity, location and expected items (exclusionary rule applied if violated).

There are some conditions to the 4th Amendment:

• Consent to authority
• Plain view that the officer has legal right where they can the things that are illegal such as drugs to be seized
• Public hazards and the need to have a emergency circumstance in which legal authority is needed.
• Search is needed to be done because there is a lawful arrest, to ensure no one is hiding. The area must be visually confirmed. Known as a "protective sweep".
• Inventory as means of safe-keeping for the arrest.

Federal Laws regarding electronic data collection:

• Wiretap Act governs real-time interception content. The Acts forbids this in general , but it covers email, phone calls, and others.
• The consent exception is is that banner notices must be presented to someone who will use it
• A private entity can use their communications as means to protect property
• Private entities can hire the government in special cases that the entity might lack.
• Pen Register and Trap and Trace governs real time interceptions of data, the same rules still apply in that context.

Legal Issues:

• Follow state laws
• Credibility may be affected depending on examiner
• In criminal cases, attorneys want to show the prosecution evidence that is exculpatory
• Inculpatory that supports
• Even when an is lawfully collected, it has to be admissible

Key concepts that determine admissibility in computer forensics:

• Created automatically by a program, regardless of any personal processes or intervention.
• Records made by people in storage on computer files is admissible as long as its in digital form
• Is a long legal standing that is that illegally gathered evidence is not able to be used. Is known as the "Fruit of the Poisonous Tree Doctrine", so is gathered legally because of the first illegal action.
• Computer forensic science is reliable and authentic, by way of using the FRE.
• It also needs to be probative and relevant.
• In courts, technical data is hard to understand and can bring challenges.
• Electronic documents should be what they contain with a description along with it.
• The reliability of a product can change by with the use of another output. In order to know what's reliable, one has to understand it may involve a Daubert test to provide reliable answers.
• Sedona Conference, “The Sedona Principles, Third Edition: Best Practices, Recommendations & Principles for Addressing Electronic Document Production

Hearsay:

• Used often, very confusing and intricate
• A out of court statement that is used for evidence when there are not any witnesses. An exception to the the rule that the hearsay in not admissible, gossip has been a example for a long time.
• A result from a computer can be used in the hearsay rule.
• FRE requires all documents have to be used to ensure they are reliable. This can be an issue when using the digital evidence.

Test your knowledge of computer forensics principles. This quiz covers essential skills, the role of organizations like IOCE and SWGDE, and the importance of the scientific method in digital evidence examination.