Podcast
Questions and Answers
Quale position es tenite per Robert Morgester?
Quale position es tenite per Robert Morgester?
- Attorney Advisor
- Vice President
- Detective
- Deputy Attorney General (correct)
Unde se trova le office de Abigail Abraham?
Unde se trova le office de Abigail Abraham?
- Sacramento, California
- Chicago, Illinois (correct)
- Charlotte, North Carolina
- Phoenix, Arizona
Qual es le titolo de Amber Haqqani?
Qual es le titolo de Amber Haqqani?
- Sergeant
- Chief Systems Engineer
- Director de Digital Evidence (correct)
- Staff Attorney
Quale departamento es David Arnett associate?
Quale departamento es David Arnett associate?
Ubi se trova le Postal Inspection Service?
Ubi se trova le Postal Inspection Service?
Quale rol es tenite per Don Flynn?
Quale rol es tenite per Don Flynn?
Qual es le nomine del attorney contente in le documento?
Qual es le nomine del attorney contente in le documento?
Qual es le profession de Walter E. Bruehs?
Qual es le profession de Walter E. Bruehs?
Quale unitate de le National Institute of Standards and Technology es Rick Ayers membro?
Quale unitate de le National Institute of Standards and Technology es Rick Ayers membro?
Quale es le localitate del office de Menz and Associates?
Quale es le localitate del office de Menz and Associates?
Quo es le location de le NSLEC Centre for National High Tech Crime Training?
Quo es le location de le NSLEC Centre for National High Tech Crime Training?
Qual es le responsabile de le Technical Assistance Section?
Qual es le responsabile de le Technical Assistance Section?
Quale position non es mentionate in le document?
Quale position non es mentionate in le document?
Quo es le location de le Nebraska State Patrol?
Quo es le location de le Nebraska State Patrol?
Quale section es associate con Dave Ausdenmoore?
Quale section es associate con Dave Ausdenmoore?
Qual es le profession de Chip Johnson?
Qual es le profession de Chip Johnson?
Qual es le principale objective de un examination forense digital?
Qual es le principale objective de un examination forense digital?
Qual information pote esser revelate per un examination de media electronic?
Qual information pote esser revelate per un examination de media electronic?
Qual es un challenge in le analysis de recordings audio obtinente per le polizia?
Qual es un challenge in le analysis de recordings audio obtinente per le polizia?
Qual technologia es usate pro mejorar le qualitá de videos in le context de le investigation?
Qual technologia es usate pro mejorar le qualitá de videos in le context de le investigation?
Que type de files pote esser recuperate durante un analysis forense?
Que type de files pote esser recuperate durante un analysis forense?
Qual information de le usuarios pote esser includite in un examination forense de computer?
Qual information de le usuarios pote esser includite in un examination forense de computer?
Qual de le subsequente es un usus forense de examination de datos?
Qual de le subsequente es un usus forense de examination de datos?
Le qual es un aspecte negativo de tapes de surveillance durante un investigation?
Le qual es un aspecte negativo de tapes de surveillance durante un investigation?
Qual informationes un investigator pote compeler in conformitate con 18 U.S.C.§ 2703(f)?
Qual informationes un investigator pote compeler in conformitate con 18 U.S.C.§ 2703(f)?
Qual necessitas pro obtiner informationes de un proveedor de service in relation al VoIP?
Qual necessitas pro obtiner informationes de un proveedor de service in relation al VoIP?
Quo es le contento de communicationes in le contexto de VoIP?
Quo es le contento de communicationes in le contexto de VoIP?
Qual es le restrictives che governante le investigatores e societates de telecommunications?
Qual es le restrictives che governante le investigatores e societates de telecommunications?
Qual informationes pote un provider de VoIP mantener?
Qual informationes pote un provider de VoIP mantener?
Quo de le mesme processu legal es usate per obtenir informationes de VoIP e de un ISP?
Quo de le mesme processu legal es usate per obtenir informationes de VoIP e de un ISP?
Qual es un exemplo de dato transaccional que un provider pote tener?
Qual es un exemplo de dato transaccional que un provider pote tener?
Quo es le consequente pro le non-consensual interception de communicationes?
Quo es le consequente pro le non-consensual interception de communicationes?
Qual es le methodo le investigator deberea usar si il es incert si un dispositivo es conectante con altere?
Qual es le methodo le investigator deberea usar si il es incert si un dispositivo es conectante con altere?
Que debe le investigator facer si illes decide connectar duo dispositivos?
Que debe le investigator facer si illes decide connectar duo dispositivos?
Qual de le sequente non es un tipo de accesso controle?
Qual de le sequente non es un tipo de accesso controle?
Qual es le triade essential in le authentication de identitate?
Qual es le triade essential in le authentication de identitate?
Qual tipo de dispositivo evalua “qualcosa que tu es”?
Qual tipo de dispositivo evalua “qualcosa que tu es”?
Quo es un potenzial risk si un dispositivo es connectate a un altere dispositivo durante le data transfer?
Quo es un potenzial risk si un dispositivo es connectate a un altere dispositivo durante le data transfer?
Qual es le beneficio principal de usar dispositivis de accesso controle per un investigator?
Qual es le beneficio principal de usar dispositivis de accesso controle per un investigator?
Que pote complicar le recuperação de data si un dispositivo es inactive o dormiente?
Que pote complicar le recuperação de data si un dispositivo es inactive o dormiente?
Which office administers the Interagency Agreement #2003–IJ–R–029?
Which office administers the Interagency Agreement #2003–IJ–R–029?
The National Institute of Justice includes only the Office for Victims of Crime and the Office of Juvenile Justice and Delinquency Prevention.
The National Institute of Justice includes only the Office for Victims of Crime and the Office of Juvenile Justice and Delinquency Prevention.
Name one primary role of Phillip Osborn mentioned in the document.
Name one primary role of Phillip Osborn mentioned in the document.
The National Institute of Justice is a component of the Office of ______ Programs.
The National Institute of Justice is a component of the Office of ______ Programs.
Match the following individuals to their respective roles:
Match the following individuals to their respective roles:
Which of the following is NOT listed as a component of the Office of Justice Programs?
Which of the following is NOT listed as a component of the Office of Justice Programs?
The Technology Working Group includes members from only local law enforcement agencies.
The Technology Working Group includes members from only local law enforcement agencies.
What role does Joseph Duke hold as mentioned in the document?
What role does Joseph Duke hold as mentioned in the document?
What is the screen name of the suspect involved in the investigation?
What is the screen name of the suspect involved in the investigation?
Records obtained from Acme Online indicate that the account established in the name of Mike Smith used a credit card associated with himself.
Records obtained from Acme Online indicate that the account established in the name of Mike Smith used a credit card associated with himself.
What purpose did the undercover activity serve in locating the suspect?
What purpose did the undercover activity serve in locating the suspect?
The suspect, Mike Smith, is the owner of a child talent agency in _______.
The suspect, Mike Smith, is the owner of a child talent agency in _______.
Match the terms with their descriptions:
Match the terms with their descriptions:
Who is the Assistant Director at the National White Collar Crime Center?
Who is the Assistant Director at the National White Collar Crime Center?
Tom Kolpacki works for the Denver District Attorney's Office.
Tom Kolpacki works for the Denver District Attorney's Office.
What is the primary role of Al Lewis as mentioned in the content?
What is the primary role of Al Lewis as mentioned in the content?
The _____ is associated with the CyberScience Lab.
The _____ is associated with the CyberScience Lab.
Match the following individuals with their respective organizations:
Match the following individuals with their respective organizations:
What city is the Air Force Office of Special Investigations located in?
What city is the Air Force Office of Special Investigations located in?
Jim Riccardi, Jr. is a Computer Training Specialist.
Jim Riccardi, Jr. is a Computer Training Specialist.
Who is the Chief of Research and Development at the Air Force Office of Special Investigations?
Who is the Chief of Research and Development at the Air Force Office of Special Investigations?
Richard Salgado is associated with the _____ Section.
Richard Salgado is associated with the _____ Section.
Which of the following individuals works for the Denver District Attorney’s Office?
Which of the following individuals works for the Denver District Attorney’s Office?
What is the focus of techniques discussed in Chapter 1?
What is the focus of techniques discussed in Chapter 1?
Digital evidence can only be found on computers.
Digital evidence can only be found on computers.
Name one type of tool used for video surveillance.
Name one type of tool used for video surveillance.
________ is used to track the location of a vehicle using satellite signals.
________ is used to track the location of a vehicle using satellite signals.
Match the following tools with their primary functions:
Match the following tools with their primary functions:
Which of the following concerns is associated with battery-operated devices?
Which of the following concerns is associated with battery-operated devices?
Steganography is used to conceal information within files.
Steganography is used to conceal information within files.
What is one method used for data preservation?
What is one method used for data preservation?
The primary purpose of __________ devices is to verify the identity of users.
The primary purpose of __________ devices is to verify the identity of users.
Which of the following tools is NOT typically used for audio examination?
Which of the following tools is NOT typically used for audio examination?
What is the primary purpose of this special report?
What is the primary purpose of this special report?
The information in the report is considered all-inclusive regarding technology-related investigations.
The information in the report is considered all-inclusive regarding technology-related investigations.
What must investigators consider when implementing the information from the report?
What must investigators consider when implementing the information from the report?
The report recognizes that all investigations are __________.
The report recognizes that all investigations are __________.
Match the following terms to their descriptions:
Match the following terms to their descriptions:
Which area of law enforcement does this report primarily serve?
Which area of law enforcement does this report primarily serve?
Investigators are discouraged from using their judgment when applying information from the report.
Investigators are discouraged from using their judgment when applying information from the report.
What aspect of technology does the report emphasize in law enforcement investigations?
What aspect of technology does the report emphasize in law enforcement investigations?
The report is intended for law enforcement personnel including investigators, first responders, and ______.
The report is intended for law enforcement personnel including investigators, first responders, and ______.
What should be adjusted in accordance with the information in the report?
What should be adjusted in accordance with the information in the report?
Who holds the position of Assistant U.S. Attorney in the Western District of Wisconsin?
Who holds the position of Assistant U.S. Attorney in the Western District of Wisconsin?
Susan Ballou is the President & CEO of a forensic science company.
Susan Ballou is the President & CEO of a forensic science company.
Name the location of Thom Quinn's position?
Name the location of Thom Quinn's position?
Anjali R. Swienton is the President and CEO of ______.
Anjali R. Swienton is the President and CEO of ______.
Match the following professionals with their roles:
Match the following professionals with their roles:
Which member is from Madison, Wisconsin?
Which member is from Madison, Wisconsin?
All members of the Technology Working Group are from federal agencies.
All members of the Technology Working Group are from federal agencies.
Identify the professional role of Susan Ballou.
Identify the professional role of Susan Ballou.
What is the primary purpose of authenticating a recording?
What is the primary purpose of authenticating a recording?
Advanced skills are not required to analyze and interpret audio data.
Advanced skills are not required to analyze and interpret audio data.
What legal consideration should be taken before examining original recordings?
What legal consideration should be taken before examining original recordings?
The process of converting _______ to digital formats is a common use of audio examination tools.
The process of converting _______ to digital formats is a common use of audio examination tools.
Match the following tools with their primary function:
Match the following tools with their primary function:
Which of the following technologies is mentioned as potentially having investigative value?
Which of the following technologies is mentioned as potentially having investigative value?
The physical location of the devices always aligns with the location of the data.
The physical location of the devices always aligns with the location of the data.
What is one factor to consider about the security of a device?
What is one factor to consider about the security of a device?
The _______ of the user can impact the effectiveness of using technology during investigations.
The _______ of the user can impact the effectiveness of using technology during investigations.
Match the following terms with their definitions:
Match the following terms with their definitions:
What information might be revealed if a device is connected to the internet?
What information might be revealed if a device is connected to the internet?
All user accounts and passwords are always stored securely on devices.
All user accounts and passwords are always stored securely on devices.
If information is transmitted to other recipients, it can happen through _______ methods.
If information is transmitted to other recipients, it can happen through _______ methods.
What can complicate data retrieval if a device is inactive?
What can complicate data retrieval if a device is inactive?
Who may have administrative privileges on a system?
Who may have administrative privileges on a system?
What should be done with electronic evidence during its seizure and examination?
What should be done with electronic evidence during its seizure and examination?
Specialized training is not necessary for the examination of digital evidence.
Specialized training is not necessary for the examination of digital evidence.
What should be available for review after the examination of electronic evidence?
What should be available for review after the examination of electronic evidence?
Actions taken to secure and collect evidence should not ______ that evidence.
Actions taken to secure and collect evidence should not ______ that evidence.
Match the type of evidence with its documentation requirement:
Match the type of evidence with its documentation requirement:
Which of the following is essential before conducting an examination of electronic evidence?
Which of the following is essential before conducting an examination of electronic evidence?
Documentation of the examination process is optional.
Documentation of the examination process is optional.
Name one source where further information on electronic evidence can be found.
Name one source where further information on electronic evidence can be found.
The handling of electronic evidence must adhere to various ______ and laws.
The handling of electronic evidence must adhere to various ______ and laws.
Which of the following actions is NOT appropriate when dealing with electronic evidence?
Which of the following actions is NOT appropriate when dealing with electronic evidence?
Which of the following devices can be modified to perform functions beyond their intended purpose?
Which of the following devices can be modified to perform functions beyond their intended purpose?
Data can be maintained in devices powered by batteries as long as the power supply is continuous.
Data can be maintained in devices powered by batteries as long as the power supply is continuous.
What should investigators do to prevent data loss in battery-operated devices?
What should investigators do to prevent data loss in battery-operated devices?
Some small electronic devices, such as PDAs, can connect to more ______ devices like computers.
Some small electronic devices, such as PDAs, can connect to more ______ devices like computers.
Match the following devices with their possible modifications:
Match the following devices with their possible modifications:
What could complicate the recovery of data from a device?
What could complicate the recovery of data from a device?
All cords connected to devices are easily identifiable for power and data transfer.
All cords connected to devices are easily identifiable for power and data transfer.
Why should investigators be aware of the surroundings of a device?
Why should investigators be aware of the surroundings of a device?
As devices become ______ functional, more data can be stored in everyday objects.
As devices become ______ functional, more data can be stored in everyday objects.
What must receiving personnel be alerted about when custody of a device is transferred?
What must receiving personnel be alerted about when custody of a device is transferred?
Which of the following individuals is associated with the USSS Electronic Crimes Task Force?
Which of the following individuals is associated with the USSS Electronic Crimes Task Force?
Henry (Dick) Reeve is the Deputy District Attorney in Chicago, Illinois.
Henry (Dick) Reeve is the Deputy District Attorney in Chicago, Illinois.
What city is Glenn Lewis associated with?
What city is Glenn Lewis associated with?
Tom Kolpacki works as a ___________ for the Ann Arbor Police.
Tom Kolpacki works as a ___________ for the Ann Arbor Police.
Match the following individuals with their roles:
Match the following individuals with their roles:
Which organization's office is located in Fairmont, West Virginia?
Which organization's office is located in Fairmont, West Virginia?
Richard Salgado is a forensic audio specialist.
Richard Salgado is a forensic audio specialist.
Who is the Chief of Research and Development at the Air Force Office of Special Investigations?
Who is the Chief of Research and Development at the Air Force Office of Special Investigations?
Which of the following describes the purpose of the special report?
Which of the following describes the purpose of the special report?
The special report includes exhaustive information on all technology-related crimes.
The special report includes exhaustive information on all technology-related crimes.
What should be considered in the implementation of the special report?
What should be considered in the implementation of the special report?
The report is a resource for law enforcement personnel, including ______, first responders, and prosecutors.
The report is a resource for law enforcement personnel, including ______, first responders, and prosecutors.
Match the following sections of the report with their content:
Match the following sections of the report with their content:
Which of the following is NOT included in the appendices of the report?
Which of the following is NOT included in the appendices of the report?
The special report suggests that all investigations are identical.
The special report suggests that all investigations are identical.
What must investigators give deference to when implementing the report?
What must investigators give deference to when implementing the report?
The section titled 'Statutes that affect the seizure and search of ______ evidence' covers legal guidelines regarding electronic evidence.
The section titled 'Statutes that affect the seizure and search of ______ evidence' covers legal guidelines regarding electronic evidence.
Which of the following is a key focus of the special report?
Which of the following is a key focus of the special report?
What types of information can be acquired through service provider records?
What types of information can be acquired through service provider records?
Law enforcement officers should avoid revealing their identity when using the Internet in undercover operations.
Law enforcement officers should avoid revealing their identity when using the Internet in undercover operations.
What is a potential risk associated with visiting a website while conducting undercover operations?
What is a potential risk associated with visiting a website while conducting undercover operations?
E-mails and chat activity contain ______ information that can reveal the identity of the sender.
E-mails and chat activity contain ______ information that can reveal the identity of the sender.
Which of the following is an example of proactive undercover operations?
Which of the following is an example of proactive undercover operations?
Investigators do not need to request preservation of records from online services.
Investigators do not need to request preservation of records from online services.
Match the following law enforcement actions to their purposes:
Match the following law enforcement actions to their purposes:
What specialized assistance is often required for undercover operations?
What specialized assistance is often required for undercover operations?
Websites often track the user's ______, time, and date of access.
Websites often track the user's ______, time, and date of access.
What kind of information can online chat content provide in a criminal investigation?
What kind of information can online chat content provide in a criminal investigation?
Which of the following items may indicate the existence of a related device?
Which of the following items may indicate the existence of a related device?
Publicly available information cannot be obtained from Internet searches.
Publicly available information cannot be obtained from Internet searches.
What is one type of consumer electronic device mentioned that might be involved in an investigation?
What is one type of consumer electronic device mentioned that might be involved in an investigation?
Documents containing access information may include user names and __________.
Documents containing access information may include user names and __________.
Match the following items to their potential purpose:
Match the following items to their potential purpose:
Which of the following is an example of storage media?
Which of the following is an example of storage media?
Recovering abandoned property is a method that can be used in investigations.
Recovering abandoned property is a method that can be used in investigations.
Name one type of document that might provide evidence during an investigation.
Name one type of document that might provide evidence during an investigation.
The presence of __________ at or near the crime scene may indicate possible criminal activity.
The presence of __________ at or near the crime scene may indicate possible criminal activity.
Which device is commonly associated with monitoring and controlling physical access?
Which device is commonly associated with monitoring and controlling physical access?
What items were seized during the execution of the search warrant at Smith's residence?
What items were seized during the execution of the search warrant at Smith's residence?
A covert account should be used for undercover activities to ensure communications are traceable.
A covert account should be used for undercover activities to ensure communications are traceable.
What type of images did the suspect transmit during the online chats?
What type of images did the suspect transmit during the online chats?
The address identified through records obtained from the phone company is located in ______, USA.
The address identified through records obtained from the phone company is located in ______, USA.
Match the following items with their descriptions:
Match the following items with their descriptions:
Flashcards are hidden until you start studying
Study Notes
Personen in Securitate Cybernetic
- Multe personas de diverse organisationes es mentionate in le textu como expertos in le campo de securitate cybernetic
- Le personas e lor roles es mentionate, per exemplo: Robert Morgester - Deputy Attorney General, State of California Department of Justice, Abigail Abraham - Assistant Attorney General, Illinois Attorney General’s Office, Dave Ausdenmoore - Detective, Regional Electronics and Computer Investigation Section, Hamilton County Sheriff’s Office/ Cincinnati Police Department, Rick Ayers - National Institute of Standards and Technology etc.
- Le personas mentionate representa un varie de sectores, incluente le governamento, le policia, le industria private e le academia
Analyse de Evidentia Digital
- Analyse de evidentia digital debe esser facite per personnel formate in un copia forense pro mantener le integritate del evidentia original
- Le examination de media electronic pote revelar informationes como:
- Informationes de proprietate e registration de software
- Diarios, jornales e logarithmos
- Bases de datos, folios de calculo, imagines e documentos
- Files eliminate e occulte
- Activitate del internet
- Communicationes - input del usator (per exemplo, correos electronic, logarithmos de chat)
- Communicationes - transferencias de datos (per exemplo, peer to peer (P2P), gruppos de novas)
- Registros financiar
- Datos pro esser usate in un analyse de linea de tempore
- Contraband
Analyse de Audio, Video e Imagines
- Technologie existe pro analisar e ameliorar le qualitate de recordings de audio, video e imagines
- Le analyse de audio pote esser usate pro ameliorar le qualitate de recordings de audio que contine sonos ambiente que interfere con le interpretation
- Le analyse de video pote esser usate pro ameliorar le qualitate de tapes de surveillance, que pote esser multiplexate (multiple o division de ecran), proprie in formato, necessitante un platforma specific pro esser visualisate, o de qualitate basse
- Le analyse de imagines pote esser usate pro ameliorar le qualitate de imagines immobile
- Le technologie pro analizar e ameliorar le qualitate de audio, video e imagines pote esser disponibile ab le fabricante o le usator final del equipaggiamento
Informationes de Servitores de Internet (ISP)
- Investigatores pote obtenir informationes ab ISPs con le processo legal appropriate e sufficiente informationes (per exemplo, nomine de usator o adresse IP e data/hora)
- ISPs pote provider le sequente informationes:
- Informationes del subscriber (per exemplo, nomine e adresse)
- Methodo de pagamento e informationes de facturation
- Datos transactional (logarithmo de connectiones, per exemplo, location, hora, ID del chiamante del location de connection, e duration del connection al internet)
- Contenito del communicationes
- Informationes miscellanee (per exemplo, nomines de usator additional in le conto, listas de amicos, transmission de correos electronic)
Protocol de Voce super Protocollo Internet (VoIP)
- VoIP permitte al usatores de ordinatores facer appellos telephonic super le internet o reti de ordinatores
- Provideres de communicationes que ofrece VoIP pote mantener informationes del subscriber e informationes transactional concernente iste connections
- Iste informationes pote esser obtenite per le mesme processo legal usate pro obtener informationes ab un ISP, sed le interception in tempore real non-consensual del contenito de iste communicationes pote requirer un ordine de escuta telefonic
Telecommunicationes
- Retis telephonic public provide services de telecommunication per un varie de dispositivos electronic de ordinatores e consumers, como PDAs, telephonos cellular, e alteres
- Investigatores e compania de telecommunicationes es guidate per le autoritate e constraints de Tito III e le Lege de Assistentia de Communicationes pro le Application de Lege de 1994 (CALEA)
- Ordines specific pro le production del sequente typos de informationes es addressate in le Capitulo 3, Questiones Legal
Dispositivos de Controlo de Accesso
- Dispositivos de controlo de accesso tenta autenticar le identitate de un individuo
- Autentication es basate super un o plus elementos del sequente triada: "Alicun cosa que tu ha, alicun cosa que tu sap, alicun cosa que tu es"
- Claves de fob e cartas inteligente es "alicun cosa que tu ha": un objecto physic que establis le identitate
- Teclados require "alicun cosa que tu sap," generalmente un codice de access
- Dispositivos biometric evalua "alicun cosa que tu es" per mesurar o avaliar un characteristic physic specific al persona
- Dispositivos biometric include scanners de iris o retina, scanners de impressione digital, recognition de facie o voce, detectores de passo, e detectores de geometria de mano
Valor de Dispositivos de Controlo de Accesso
- Investigatores pote usar iste dispositivos pro:
- Stablir le presentia o absentia de un individuo in un location controlate (como in casos de furto de identitate e espionage)
Investigative Tools an Techniques
- This special report is intended to provide guidance to law enforcement personnel, who may have limited or no experience with technology-related crimes. It is not all inclusive, and focuses on the most common techniques, devices, and tools encountered.
- Technology is constantly evolving so users must consider current technologies and practices, adjusting as necessary.
- The special report notes that all investigations are unique and the judgment of investigators should be considered when implementing the information.
- The report offers a practical example of how technology is used in an investigation.
- The example involves a user named LittleMS123 and his association with an account on Acme Online.
- The account is connected to a credit card of the suspect's mother.
- The report suggests that the dial-up access number used by the account may provide clues as to the suspect's location.
- The special report underlines the importance of being aware that fraudulent identification might be used to create user accounts and that multiple users may access the same account from different locations.
- The example then describes an undercover strategy, using a local ICAC Task Force, to locate the suspect. The undercover agent engages the suspect in an online conversation, eventually gaining his telephone number to arrange a meeting.
Legal Issues concerning technology
- The report moves on to legal issues related to the use of technology in investigations.
- It examines constitutional issues and specifically references searches and seizures.
- The special report discusses warrants and warrantless searches, outlining their legal context within the context of electronic evidence.
- It also touches upon those statutes which influence the seizure and search of electronic evidence.
- The report highlights the importance of understanding legal considerations when utilizing technology in investigations.
Introduction
- This report is about investigative techniques for using high technology
- General principles of forensics and procedures are applicable to the use of technology in investigations
- Special training is needed for examining electronic devices
- Electronic evidence should be fully documented, preserved, and available for review
Techniques
- This chapter discusses techniques and resources that can be used in investigations
- These techniques should be considered:
- What technologies did the parties involved have access to, use, and knowledge?
- What is the skill level of the user?
- What is the security of the device?
- Who owns the equipment?
- What accounts, logins, and passwords are on the device?
- What logs are available?
- How frequently was the device used?
- How was the device used?
- Is there offsite storage?
- Was information transmitted to others?
- What services and providers are used?
- Who is the system administrator?
- Who has administrative privileges?
- Is there remote access to the devices or computer systems?
- Is the system patched and up to date?
- It is important to identify the location of information with investigative value, which may not be the same as the physical location of the devices or subjects
- Investigators should collect all relevant devices and media because devices can be multifunctional
- Devices can be modified to perform functions beyond their original intent
- Investigators should be aware of the environment that a device has been found in, to search for potential modifications
Power Concerns with Battery-Operated Devices
- Some devices contain memory that requires continuous power to maintain information
- To avoid data loss, place devices in their chargers or replace their batteries immediately
- Receiving personnel should be notified about the power requirements of devices
- Some devices connect to computers to synchronize data
- Be sure to determine the use and need for all cables attached to devices
Audio/Video Recordings
- Audio/video recordings can be used in cases where the identity of the speaker or the content of the conversation is in question
- Ensure the recording was lawfully acquired.
- Consider seeking legal guidance prior to the examination of the original recording
- Authenticate a recording by determining the origin and whether it has been altered
- Determine the time, sequence, and direction of the source of sounds on a recording
- Convert recordings to other formats
Caller ID Devices
- Caller ID devices display telephone numbers of incoming calls
Investigative Uses of Technology
- The text describes investigative techniques and tools used in technology-related crimes.
- The text emphasizes the importance of using current technology and adjusting practices as needed.
- Investigators should consider available devices, tools, and techniques when investigating technology-related crimes. The text also provides examples of resources that can be helpful for investigations.
- Investigators can use publicly available information from government records, internet searches, internet registries, transactional information related to the internet connection, or direct evidence of the crime.
- Internet tools can be used to identify users and internet connections; they can be used to collect evidence directly and proactively communicate with suspects.
- The text discusses proactive undercover operations on the internet as a tool for investigation, especially for areas like child exploitation and trafficking of contraband.
- Undercover operations require specialized training and legal counsel.
- Law enforcement should use covert accounts during undercover activities as to not reveal their identity or agency affiliation.
- Documenting undercover and online activities is essential and requires specialized training.
- Agency and legal authorization are required in conducting undercover activity.
- The text highlights the importance of preserving and obtaining records from service providers like telephone companies because the records may only exist for a limited time.
- Web sites often track IP addresses, time, and date of access, which can be used as evidence.
- The text provides a case study of an investigation that involved an undercover operation and the use of a search warrant to seize digital evidence.
- The text also states that several printed images from the suspect's residence appeared to be identical to the images from the station computer.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.