SLIDE KHÓA học PHÁP lý CHƯƠNG 5 processing crime and incident scenes

.c om du o ng th an co ng Guide to Computer Forensics and Investigations Fourth Edition cu u Chapter Processing Crime and Incident Scenes CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Objectives cu u du o ng th an co ng • Explain the rules for digital evidence • Describe how to collect evidence at private-sector incident scenes • Explain guidelines for processing law enforcement crime scenes • List the steps in preparing for an evidence search • Describe how to secure a computer incident or crime scene CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Objectives (continued) cu u du o ng th an co ng • Explain guidelines for seizing digital evidence at the scene • List procedures for storing digital evidence • Explain how to obtain a digital hash • Review a case to identify requirements and plan your investigation CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om ng co an cu u du o ng th Identifying Digital Evidence CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Identifying Digital Evidence ng • Digital evidence an co – Can be any information stored or transmitted in digital form ng th • U.S courts accept digital evidence as physical evidence du o – Digital data is a tangible object cu u • Some require that all digital evidence be printed out to be presented in court CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Identifying Digital Evidence (continued) co ng • General tasks investigators perform when working with digital evidence: cu u du o ng th an – Identify digital information or artifacts that can be used as evidence – Collect, preserve, and document evidence – Analyze, identify, and organize evidence – Rebuild evidence or repeat a situation to verify that the results can be reproduced reliably • Collecting computers and processing a criminal or incident scene must be done systematically CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Understanding Rules of Evidence cu u du o ng th an co ng • Consistent practices help verify your work and enhance your credibility • Comply with your state’s rules of evidence or with the Federal Rules of Evidence • Evidence admitted in a criminal case can be used in a civil suit, and vice versa • Keep current on the latest rulings and directives on collecting, processing, storing, and admitting digital evidence CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Understanding Rules of Evidence (continued) co ng • Data you discover from a forensic examination falls under your state’s rules of evidence an – Or the Federal Rules of Evidence ng th • Digital evidence is unlike other physical evidence because it can be changed more easily cu u du o – The only way to detect these changes is to compare the original data with a duplicate • Most federal courts have interpreted computer records as hearsay evidence – Hearsay is secondhand or indirect evidence CuuDuongThanCong.com https://fb.com/tailieudientucntt ng • Business-record exception c om Understanding Rules of Evidence (continued) th an co – Allows “records of regularly conducted activity,” such as business memos, reports, records, or data compilations cu u du o ng • Generally, computer records are considered admissible if they qualify as a business record • Computer records are usually divided into: – Computer-generated records – Computer-stored records CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Understanding Rules of Evidence (continued) co ng • Computer records must be shown to be authentic and trustworthy an – To be admitted into court ng th • Computer-generated records are considered authentic cu u du o – If the program that created the output is functioning correctly • Collecting evidence according to the proper steps of evidence control helps ensure that the computer evidence is authentic CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Sample Civil Investigation an – Or noncriminal cases co ng • Most cases in the corporate environment are considered low-level investigations th • Common activities and practices ng – Recover specific evidence du o • Suspect’s Outlook e-mail folder (PST file) u – Covert surveillance cu • Its use must be well defined in the company policy • Risk of civil or criminal liability – Sniffing tools for data transmissions CuuDuongThanCong.com https://fb.com/tailieudientucntt ng th an co ng c om Covert Surveillance Tools cu u du o • Spector • WinWhatWhere • EnCase Enterprise Edition CuuDuongThanCong.com https://fb.com/tailieudientucntt ng • Computer crimes examples c om Sample Criminal Investigation th an co – Fraud – Check fraud – Homicides du o ng • Need a warrant to start seizing evidence cu u – Limit searching area CuuDuongThanCong.com https://fb.com/tailieudientucntt cu u du o ng th an co ng c om Sample Criminal Investigation (continued) CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Reviewing Background Information for a Case ng • Company called Superior Bicycles an co – Specializes in creating new and inventive modes of human-driven transportation cu u du o ng th • Two employees, Chris Murphy and Nau Tjeriko, have been missing for several days • A USB thumb drive has been recovered from Chris’s office with evidence that he had been conducting a side business using company computers CuuDuongThanCong.com https://fb.com/tailieudientucntt du o ng th an co Nature of the case Suspect’s name Suspect’s activity Suspect’s hardware and software specifications u – – – – ng Identify requirements such as: cu • c om Identifying the Case Requirements CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Planning Your Investigation ng • List what you can assume or know ng th an co – Several incidents may or may not be related – Suspect’s computer can contain information about the case – If someone else has used suspect’s computer cu u du o • Make an image of suspect’s computer disk drive • Analyze forensics copy CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Conducting the Investigation: Acquiring Evidence with AccessData FTK ng • Functions cu u du o ng th an co – Extract the image from a bit-stream image file – Analyze the image CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om ng co an th ng du o u cu CuuDuongThanCong.com https://fb.com/tailieudientucntt cu u du o ng th an co ng c om Conducting the Investigation: Acquiring Evidence with AccessData FTK (continued) CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om ng co an th ng du o u cu CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om ng co an th ng du o u cu CuuDuongThanCong.com https://fb.com/tailieudientucntt cu u du o ng th an co ng c om Conducting the Investigation: Acquiring Evidence with AccessData FTK (continued) CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om ng co an th ng du o u cu CuuDuongThanCong.com https://fb.com/tailieudientucntt cu u du o ng th an co ng c om Conducting the Investigation: Acquiring Evidence with AccessData FTK (continued) CuuDuongThanCong.com https://fb.com/tailieudientucntt ... private-sector incident scenes • Explain guidelines for processing law enforcement crime scenes • List the steps in preparing for an evidence search • Describe how to secure a computer incident or crime. .. .c om ng co cu u du o ng th an Processing Law Enforcement Crime Scenes CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Processing Law Enforcement Crime Scenes du o ng th an co ng •... on the latest rulings and directives on collecting, processing, storing, and admitting digital evidence CuuDuongThanCong.com https://fb.com/tailieudientucntt .c om Understanding Rules of Evidence