Digital Forensics for Legal Professionals: Understanding Digital Evidence From The Warrant To The Courtroom

Description

Digital Forensics for Legal Professionals provides you with a guide to digital technology forensics in plain English. In the authors' years of experience in working with attorneys as digital forensics experts, common questions arise again and again: What do I ask for? Is the evidence relevant? What does this item in the forensic report mean? What should I ask the other expert? What should I ask you? Can you explain that to a jury? This book answers many of those questions in clear language that is understandable by non-technical people. With many illustrations and diagrams that will be usable in court, they explain technical concepts such as unallocated space, forensic copies, timeline artifacts and metadata in simple terms that make these concepts accessible to both attorneys and juries. The authors also explain how to determine what evidence to ask for, evidence might be that could be discoverable, and the methods for getting to it including relevant subpoena and motion language. Additionally, this book provides an overview of the current state of digital forensics, the right way to select a qualified expert, what to expect from a qualified expert and how to properly use experts before and during trial. Front Cover Digital Forensics for Legal Professionals Copyright Page Contents Preface Intended Audience Organization of this Book Section I: Overview of Digital Forensics Section II: Experts Section III: Motions and Discovery Section IV: Common Types of Digital Evidence About the Authors About the Tech Editors SECTION 1 WHAT IS DIGITAL FORENSICS? CHAPTER 1 Digital Evidence Is Everywhere Introduction 1.1 What is Digital Forensics? 1.2 What is Digital Evidence? 1.3 How Digital Evidence is Created And Stored Summary CHAPTER 2 Overview of Digital Forensics Introduction 2.1 Digital Forensics 2.1.1 Acquisition 2.1.2 Preservation 2.1.3 Analysis 2.1.4 Presentation 2.2 A Little Computer History 2.3 A Brief History of Computer Forensics 2.4 Computer Forensics Becomes Digital Forensics Summary CHAPTER 3 Digital Forensics: The Subdisciplines Introduction 3.1 The Subdisciplines 3.2 Computer Forensics 3.2.1 Incident response 3.2.2 Cell phone forensics 3.2.3 GPS forensics 3.2.4 Media device forensics 3.2.5 Social media forensics 3.2.6 Digital video and photo forensics 3.2.7 Digital camera forensics 3.2.8 Digital audio forensics 3.2.9 Multiplayer game forensics 3.2.10 Game console forensics Summary CHAPTER 4 The Foundations of Digital Forensics: Best Practices Introduction 4.1 Who Establishes Best Practices? 4.2 Who should be Following Best Practices? 4.3 Summary of Best Practices 4.3.1 Volatile data and live forensics 4.3.2 Preservation best practices 4.3.3 Acquisition best practices 4.4 What Really Happens in Many Cases Summary CHAPTER 5 Overview of Digital Forensics Tools Introduction 5.1 What Makes a Tool Forensically Sound? 5.2 Who Performs Tool Testing? 5.3 Computer Forensics Tools: An Overview 5.4 Classes of Forensics Tools 5.5 Mobile Device Forensics Tools Summary References CHAPTER 6 Digital Forensics at Work in the Legal System Introduction 6.1 Mitigation 6.2 Pre-trial Motions 6.3 Trial Preparation 6.4 Example Trial Questions 6.4.1 A civil case example 6.4.2 Criminal trial example 6.5 Trial Phase Summary SECTION 2 EXPERTS CHAPTER 7 Why Do I Need an Expert? Introduction 7.1 Why Hire a Digital Forensics Expert? 7.2 When to Hire a Digital Forensics Expert Summary CHAPTER 8 The Difference between Computer Experts and Digital Forensics Experts Introduction 8.1 The Computer Expert 8.2 The Digital Forensics Expert 8.3 A Side-by-Side Comparison 8.4 Investigation of Digital Evidence 8.4.1 What does it mean to “investigate”? Summary CHAPTER 9 Selecting a Digital Forensics Expert Introduction 9.1 What is an Expert? 9.2 Locating and Selecting an Expert 9.2.1 Establishing your selection criteria 9.2.2 What evidence is part of your case? 9.2.3 What type of case do you have? 9.2.4 The prequalification process 9.2.5 What is a reasonable fee? 9.2.6 How can you tell what is a reasonable fee quote? 9.3 Certifications 9.4 Training, Education, and Experience 9.5 The Right Forensic Tools Summary References CHAPTER 10 What to Expect from an Expert Introduction 10.1 General Expectations 10.2 Where to Begin? 10.2.1 Sample protocol for evidence collection by a third or opposing party 10.3 The Examination 10.4 Court Preparation 10.5 Expert Advice Summary CHAPTER 11 Approaches by Different Types of Examiners Introduction 11.1 Standards 11.2 Training and Experience 11.3 Impact on Examinations 11.4 Ethics 11.5 The Approach to an Examination Summary References CHAPTER 12 Spotting a Problem Expert Introduction 12.1 Beyond the Window Dressings 12.1.1 Verifiable experience and criminal records 12.1.2 Attitude 12.1.3 The bull factor 12.1.4 Appearance matters 12.1.5 The big problems 12.1.6 Aversion Summary CHAPTER 13 Qualifying an Expert in Court Introduction 13.1 Qualifying an Expert 13.1.1 Federal Rules of Evidence: Rule 702 Expert Witnesses 13.1.2 The resume or curriculum vitae 13.1.3 Certifications 13.1.4 Training 13.1.5 Experience 13.1.6 Education 13.2 Qualifying Experts in Court 13.2.1 Sample qualification questions Summary Reference SECTION 3 MOTIONS AND DISCOVERY CHAPTER 14 Overview of Digital Evidence Discovery Introduction 14.1 Discovery Motions in Civil and Criminal Cases 14.1.1 Common challenges in criminal and civil cases Summary CHAPTER 15 Discovery of Digital Evidence in Criminal Cases Introduction 15.1 Sources of Digital Evidence 15.2 Building the Motion 15.2.1 Discovery motion specifics Summary CHAPTER 16 Discovery of Digital Evidence in Civil Cases Introduction 16.1 Rules Governing Civil Discovery 16.2 Electronic Discovery in Particular 16.3 Time is of the Essence 16.4 Getting to the Particulars 16.4.1 What happened? 16.4.2 Who was involved? 16.4.3 How would electronic evidence be involved? 16.4.4 Where might electronic evidence be stored? 16.4.5 Who has control of the electronic evidence you need to collect? 16.5 Getting the Electronic Evidence Summary References CHAPTER 17 Discovery of Computers and Storage Media Introduction 17.1 An Example of a Simple Consent to Search Agreement 17.2 Example of a Simple Order for Expedited Discovery 17.3 Example of an Order for Expedited Discovery and Temporary Restraining Order Summary CHAPTER 18 Discovery of Video Evidence Introduction 18.1 Common Issues with Video Evidence 18.1.1 Collecting and preserving tape media 18.1.2 Video recording devices 18.2 Collecting Video Evidence 18.3 Example Discovery Language for Video Evidence Summary CHAPTER 19 Discovery of Audio Evidence Introduction 19.1 Common Issues with Audio Evidence 19.1.1 Audio recording devices 19.1.2 Tape media 19.1.3 Audio metadata 19.1.4 File formats and audio programs 19.2 Example Discovery Language for Audio Evidence Summary CHAPTER 20 Discovery of Social Media Evidence Introduction 20.1 Legal Issues in Social Media Discovery 20.2 Finding Custodian of Records Contact Information 20.3 Facebook Example 20.3.1 Sample language to include for Facebook 20.4 Google Information 20.4.1 Google blogger example 20.4.2 Sample language for Google Blogger accounts and posts 20.5 Online E-Mail Accounts Summary References CHAPTER 21 Discovery in Child Pornography Cases Introduction 21.1 The Adam Walsh Child Protection and Safety Act of 2006 21.2 The Discovery Process 21.2.1 First round of discovery 21.2.2 The second round of discovery Summary References CHAPTER 22 Discovery of Internet Service Provider Records Introduction 22.1 Internet Service Provider Records or IP Addresses 22.1.1 How to find the Internet service provider for an IP address step by step 22.1.2 Motion language once you know the IP address 22.2 Example Language for Web-Based E-Mail Addresses 22.3 What to Expect From an Internet Service Provider (ISP) Subpoena Summary CHAPTER 23 Discovery of Global Positioning System Evidence Introduction 23.1 GPS Tracking Evidence Overview 23.1.1 Categories of potential GPS tracking evidence 23.2 Discovery of GPS Evidence 23.2.1 Language for getting a GPS device for examination 23.2.2 Language for getting information from a manufacturer about a device 23.2.3 Language for getting GPS evidence from a third party Summary CHAPTER 24 Discovery of Call Detail Records Introduction 24.1 Discovery Issues in Cellular Evidence 24.2 Example Language for Call Detail Records Summary CHAPTER 25 Obtaining Expert Funding in Indigent Cases Introduction 25.1 Justifying Extraordinary Expenses 25.2 Example Language for an Ex Parte Motion for Expert Funds Summary SECTION 4 COMMON TYPES OF DIGITAL EVIDENCE CHAPTER 26 Hash Values: The Verification Standard Introduction 26.1 Hash Values 26.2 How Hash Values are Used in Digital Forensics 26.2.1 Using hash values to find hidden files 26.2.2 How to determine whether a file exists on a computer 26.2.3 De-duplicating data in e-discovery 26.2.4 The dangers of court testimony without verification 26.2.5 What if an opposing expert did not verify evidence? Summary CHAPTER 27 Metadata Introduction 27.1 The Purpose of Metadata 27.2 Common Types of Metadata 27.2.1 File system metadata 27.2.2 Internet metadata 27.2.3 Document metadata 27.2.4 Picture metadata Summary CHAPTER 28 Thumbnails and the Thumbnail Cache Introduction 28.1 Thumbnails and the Thumbnail Cache 28.2 How Thumbnails and the Thumbnail Cache Work 28.2.1 When are these thumbs.db cache files created? 28.2.2 Changes in Windows Vista and Windows 7 28.2.3 Thumbs.db and networked drives 28.3 Thumbnails and the Thumbnail Cache as Evidence Summary Reference CHAPTER 29 Deleted Data Introduction 29.1 How Data is Stored on a Hard Drive 29.1.1 Hard drive data storage structure 29.2 Deleted File Recovery 29.2.1 Simple file recovery 29.2.2 Advanced file recovery: file carving 29.3 Evidence of Data Destruction 29.3.1 Physical destruction Summary CHAPTER 30 Computer Time Artifacts (MAC Times) Introduction 30.1 Computer File System Time Stamps 30.2 Fundamental Issues in Forensic Analysis of Timeline 30.3 Created, Modified, Accessed 30.4 The Bottom Line Summary CHAPTER 31 Internet History (Web and Browser Caching) Introduction 31.1 What is Web Caching? 31.2 How Internet Browser (Web) Caching Works 31.3 Internet (Web) Caching as Evidence 31.4 What if the Internet Cache is Cleared by the User? Summary CHAPTER 32 Windows Shortcut Files (Link Files) Introduction 32.1 The Purpose of Link Files, How They are Created, and How They Work 32.2 How Link Files can be of Evidentiary Value 32.3 Link Files as Evidence 32.3.1 Using link files to show that a file was accessed by the user 32.3.2 Using link files to show that a deleted file once existed on a computer 32.3.3 Using link files to show that a contraband image was saved to a computer but never opened again 32.3.4 Connecting a deleted file on a computer to a USB device using link file evidence Summary CHAPTER 33 Cellular System Evidence and Call Detail Records Introduction 33.1 An Overview of the Cellular Phone System 33.2 How Cell Phones Work 33.2.1 Anatomy of a Cell Phone Call 33.3 Call Detail Records 33.4 Call Detail Records as Evidence of Cell Phone Location 33.4.1 A Cell Tower Location Example 33.5 Enhanced 911 Wireless Location Services 33.6 The E911 System Overview 33.7 Emergency Situations: Real-Time Cell Phone Tracking Summary Reference CHAPTER 34 E-mail Evidence Introduction 34.1 E-mail as Evidence 34.2 E-mail Storage and Access: Where is it? 34.2.1 Server-based storage 34.2.2 User-based E-mail Storage 34.3 Web Mail Summary Reference CHAPTER 35 Social Media Introduction 35.1 Common Forms of Social Networking (Social Media) 35.2 Evidence Out in the Open 35.3 Convenience Versus Security 35.4 The Allure of Anonymity 35.4.1 Hobby or obsession? 35.5 Social Media as Evidence 35.5.1 Connecting evidence from a device to social media evidence 35.6 Getting Information from Online Services Summary References CHAPTER 36 Peer-to-Peer Networks and File Sharing 36.1 What is Peer-to-Peer File Sharing? 36.2 How it Works 36.2.1 It’s all about sharing! 36.2.2 Using a file-sharing program 36.3 Privacy and Security Issues with Peer-to-Peer File Sharing 36.4 Peer-to-Peer Network Evidence 36.4.1 Investigating file-sharing networks Summary Reference CHAPTER 37 Cell Phones Introduction 37.1 The Fragile Nature of Cellular Evidence 37.1.1 Protecting cell phone evidence 37.2 Forensic Acquisition Methods for Cellular Phones 37.2.1 Logical acquisitions 37.2.2 Physical acquisitions 37.2.3 Manual examinations 37.3 Subscriber Identity Module (SIM) Cards 37.3.1 Media cards (removable storage cards) 37.4 Cell Phone Backup Files 37.5 Advanced Cell Phone Data Analytics 37.6 The Future of Cell Phone Forensics Summary References CHAPTER 38 Video and Photo Evidence Introduction 38.1 The Most Critical Steps in the Forensic Examination of Video and Photo Evidence 38.1.1 Documentation 38.1.2 Knowing how your tools work 38.2 Using Video and Photo Evidence in Cases 38.2.1 Enhancing an image or video 38.2.2 Determining the authenticity of a video or image 38.2.3 Contesting unqualified claims to video or image evidence Summary References CHAPTER 39 Databases Introduction 39.1 Databases in Everyday Life 39.2 What is a Database? 39.2.1 What is a database management system? 39.2.2 Modern databases 39.2.3 Database formats 39.3 Database Files as Evidence 39.4 Database Recovery 39.5 Data as Evidence Summary CHAPTER 40 Accounting Systems and Financial Software Introduction 40.1 Accounting and Money Management Programs 40.2 Personal Money Management Software 40.3 Business Accounting Software 40.3.1 Small business accounting software 40.3.2 Mid-level to enterprise accounting software 40.4 Getting the Evidence 40.5 Types of Evidence from Financial Software 40.6 Batch Files as Evidence 40.7 Other Sources of Financial Evidence Summary CHAPTER 41 Multiplayer Online Games Introduction 41.1 The Culture of Massively Multiplayer Online Role Playing Games (MMORPGs) 41.2 MMORPG Data as Evidence 41.2.1 Timeline evidence 41.2.2 Content evidence 41.2.3 General location evidence 41.2.4 Game subscriber information 41.2.5 Getting server-side evidence Summary References CHAPTER 42 Global Positioning Systems Introduction 42.1 An Overview of Global Positioning Systems 42.2 An Overview of the Navstar Global Positioning System 42.3 How GPS Works 42.3.1 How geolocation works using GPS 42.4 Types of GPS Evidence 42.4.1 Waypoints and routes 42.4.2 Track points and track logs 42.4.3 Other GPS device evidence 42.5 Collection of Evidence from GPS Devices 42.5.1 Preservation of GPS data 42.5.2 Challenges to data collection 42.5.3 Service-based data collection 42.6 Interpretation of GPS Evidence 42.6.1 Data errors 42.6.2 Map errors Summary References Index