Forensic Examination of Digital Evidence
SPECIAL REPORT / APR. 04 —Assess the skill levels of the computer users involved. Techniques employed by skilled users to conceal or destroy evidence may be more sophisticated (e.g., encryption, booby traps, steganography). —Prioritize the order in which evidence is to be examined. — Determine if additional personnel will be needed. — Determine the equipment needed. The assessment might uncover evidence pertaining to other criminal activity (e.g., money laundering in conjunction with narcotics activities). Onsite considerations The following material does not provide complete information on examination of digital evidence; it is a general guide for law enforcement agencies that assess digital evidence at the crime scene. Readers may also want to consult Electronic Crime Scene Investigation: A Guide for First Responders, available at http://www.ojp.usdoj.gov/ nij/pubs-sum/187736.htm. Consider safety of personnel at the scene. Always ensure the scene is properly secured before and during the search. In some cases, the examiner may only have the opportunity to do the following while onsite: ■ Identify the number and type of computers. ■ Determine if a network is present. ■ Interview the system administrator and users. ■ Identify and document the types and volume of media, including removable media. Document the location from which the media was removed. ■ Identify offsite storage areas and/or remote computing locations. ■ Identify proprietary software. 8
FORENSIC EXAMINATION OF DIGITAL EVIDENCE: A GUIDE FOR LAW ENFORCEMENT ■ Evaluate general conditions of the site. ■ Determine the operating system in question. Determine the need for and contact available outside resources, if necessary. Establish and retain a phone list of such resources. Processing location assessment Assess the evidence to determine where the examination should occur. It is preferable to complete an examination in a controlled environment, such as a dedicated forensic work area or laboratory. Whenever circumstances require an onsite examination to be conducted, attempt to control the environment. Assessment considerations might include the following: ■ The time needed onsite to accomplish evidence recovery. ■ Logistic and personnel concerns associated with long-term deployment. ■ The impact on the business due to a lengthy search. ■ The suitability of equipment, resources, media, training, and experience for an onsite examination. Legal considerations ■ Determine the extent of the authority to search. ■ Identify possible concerns related to applicable Federal statutes (such as the Electronic Communications Privacy Act of 1986 (ECPA) and the Cable Communications Policy Act (CCPA), both as amended by the USA PATRIOT ACT of 2001, and/or the Privacy Protection Act of 1980 (PPA)), State statutes, and local policies and laws. If evidence is located that was not authorized in the original search authority, determine what additional legal process may be necessary to continue the search (e.g., warrant, amended consent form). Contact legal advisors for assistance if needed. Evidence assessment ■ Prioritize the evidence (e.g., distribution CDs versus user-created CDs). —Location where evidence is found. —Stability of media to be examined. 9
- Page 1 and 2: APR. 04 U.S. Department of Justice
- Page 3 and 4: APR. 04 Forensic Examination of Dig
- Page 5 and 6: Foreword Developments in the world
- Page 7 and 8: Technical Working Group for the Exa
- Page 9 and 10: Michael Finnie Forensic Specialist
- Page 11 and 12: Contents Foreword . . . . . . . . .
- Page 13 and 14: SPECIAL REPORT / APR. 04 Examinatio
- Page 15 and 16: SPECIAL REPORT / APR. 04 ongoing tr
- Page 17: Chapter 2. Evidence Assessment Prin
- Page 21 and 22: Chapter 3. Evidence Acquisition Pri
- Page 23 and 24: FORENSIC EXAMINATION OF DIGITAL EVI
- Page 25 and 26: SPECIAL REPORT / APR. 04 ■ File c
- Page 27 and 28: SPECIAL REPORT / APR. 04 ■ Analyz
- Page 29 and 30: SPECIAL REPORT / APR. 04 During the
- Page 31 and 32: Appendix A. Case Examples The follo
- Page 33 and 34: FORENSIC EXAMINATION OF DIGITAL EVI
- Page 35 and 36: FORENSIC EXAMINATION OF DIGITAL EVI
- Page 37 and 38: FORENSIC EXAMINATION OF DIGITAL EVI
- Page 39 and 40: FORENSIC EXAMINATION OF DIGITAL EVI
- Page 42 and 43: FORENSIC EXAMINATION OF DIGITAL EVI
- Page 44 and 45: FORENSIC EXAMINATION OF DIGITAL EVI
- Page 46 and 47: Appendix B. Glossary The following
- Page 48 and 49: FORENSIC EXAMINATION OF DIGITAL EVI
- Page 50 and 51: SPECIAL REPORT / APR. 04 Computer E
- Page 52 and 53: SPECIAL REPORT / APR. 04 Hard Drive
- Page 54 and 55: SPECIAL REPORT / APR. 04 Removable
- Page 56 and 57: Appendix D. Examples of Request for
- Page 58 and 59: FORENSIC EXAMINATION OF DIGITAL EVI
- Page 60 and 61: FORENSIC EXAMINATION OF DIGITAL EVI
- Page 62 and 63: FORENSIC EXAMINATION OF DIGITAL EVI
- Page 64 and 65: Appendix F. Technical Resources Lis
- Page 66 and 67: FORENSIC EXAMINATION OF DIGITAL EVI
SPECIAL REPORT / APR. 04<br />
—Assess the skill levels <strong>of</strong> the computer users involved. Techniques employed<br />
by skilled users to conceal or destroy evidence may be more sophisticated<br />
(e.g., encryption, booby traps, steganography).<br />
—Prioritize the order in which evidence is to be examined.<br />
— Determine if additional personnel will be needed.<br />
— Determine the equipment needed.<br />
The assessment might uncover evidence pertaining to other criminal activity<br />
(e.g., money laundering in conjunction with narcotics activities).<br />
Onsite considerations<br />
The following material does not provide complete information on examination <strong>of</strong> digital<br />
evidence; it is a general guide for law enforcement agencies that assess digital evidence<br />
at the crime scene. Readers may also want to consult Electronic Crime Scene<br />
Investigation: A Guide for First Responders, available at http://www.ojp.usdoj.gov/<br />
nij/pubs-sum/187736.htm.<br />
Consider safety <strong>of</strong> personnel at the scene. Always ensure the scene is properly<br />
secured before and during the search.<br />
In some cases, the examiner may only have the opportunity to do the following while<br />
onsite:<br />
■ Identify the number and type <strong>of</strong> computers.<br />
■ Determine if a network is present.<br />
■ Interview the system administrator and users.<br />
■ Identify and document the types and volume <strong>of</strong> media, including removable media.<br />
Document the location from which the media was removed.<br />
■ Identify <strong>of</strong>fsite storage areas and/or remote computing locations.<br />
■ Identify proprietary s<strong>of</strong>tware.<br />
8
Change language