Forensic Examination of Digital Evidence

More documents

Recommendations

Info

FORENSIC EXAMINATION OF DIGITAL EVIDENCE: A GUIDE FOR LAW ENFORCEMENT Developing technical procedures Established procedures should guide the technical process of the examination of evidence. Procedures should be tested prior to their implementation to ensure that the results obtained are valid and independently reproducible. The steps in the development and validation of the procedures should be documented and include: ■ Identifying the task or problem. ■ Proposing possible solutions. ■ Testing each solution on a known control sample. ■ Evaluating the results of the test. ■ Finalizing the procedure. Original evidence should never be used to develop procedures. 5
Chapter 2. Evidence Assessment Principle: The digital evidence should be thoroughly assessed with respect to the scope of the case to determine the course of action. Procedure: Conduct a thorough assessment by reviewing the search warrant or other legal authorization, case detail, nature of hardware and software, potential evidence sought, and the circumstances surrounding the acquisition of the evidence to be examined. Case assessment ■ Review the case investigator’s request for service. — Identify the legal authority for the forensic examination request. — Ensure there is a completed request for assistance (see appendix D for examples). — Complete documentation of chain of custody. ■ Consult with the case investigator about the case and let him or her know what the forensic examination may or may not discover. When talking with the investigator about the facts of the case, consider the following: — Discuss whether other forensic processes need to be performed on the evidence (e.g., DNA analysis, fingerprint, toolmarks, trace, and questioned documents). — Discuss the possibility of pursuing other investigative avenues to obtain additional digital evidence (e.g., sending a preservation order to an Internet service provider (ISP), identifying remote storage locations, obtaining e-mail). — Consider the relevance of peripheral components to the investigation. For example, in forgery or fraud cases consider noncomputer equipment such as laminators, credit card blanks, check paper, scanners, and printers. In child pornography cases consider digital cameras. — Determine the potential evidence being sought (e.g., photographs, spreadsheets, documents, databases, financial records). — Determine additional information regarding the case (e.g., aliases, e-mail accounts, e-mail addresses, ISP used, names, network configuration and users, system logs, passwords, user names). This information may be obtained through interviews with the system administrator, users, and employees. 7
Page 1 and 2: APR. 04 U.S. Department of Justice
Page 3 and 4: APR. 04 Forensic Examination of Dig
Page 5 and 6: Foreword Developments in the world
Page 7 and 8: Technical Working Group for the Exa
Page 9 and 10: Michael Finnie Forensic Specialist
Page 11 and 12: Contents Foreword . . . . . . . . .
Page 13 and 14: SPECIAL REPORT / APR. 04 Examinatio
Page 15: SPECIAL REPORT / APR. 04 ongoing tr
Page 19 and 20: FORENSIC EXAMINATION OF DIGITAL EVI
Page 21 and 22: Chapter 3. Evidence Acquisition Pri
Page 25 and 26: SPECIAL REPORT / APR. 04 ■ File c
Page 27 and 28: SPECIAL REPORT / APR. 04 ■ Analyz
Page 29 and 30: SPECIAL REPORT / APR. 04 During the
Page 31 and 32: Appendix A. Case Examples The follo
Page 46 and 47: Appendix B. Glossary The following
Page 50 and 51: SPECIAL REPORT / APR. 04 Computer E
Page 52 and 53: SPECIAL REPORT / APR. 04 Hard Drive
Page 54 and 55: SPECIAL REPORT / APR. 04 Removable
Page 56 and 57: Appendix D. Examples of Request for
Page 64 and 65: Appendix F. Technical Resources Lis
Page 66 and 67:
FORENSIC EXAMINATION OF DIGITAL EVI
Page 68 and 69:
Page 70 and 71:
Page 72 and 73:
Page 74 and 75:
Page 76 and 77:
Page 78 and 79:
Page 80 and 81:
Page 82 and 83:
Page 84 and 85:
Page 86 and 87:
SPECIAL REPORT / APR. 04 High Techn
Page 88 and 89:
Appendix H. List of Organizations T
Page 90 and 91:
About the National Institute of Jus
show all

Forensic Examination of Digital Evidence

Create successful ePaper yourself

Delete template?

Save as template?