Digital Forensics for Attorneys - Part 2

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Digital Forensics for Attorneys - Part 2"

Transcription

1 Lars Daniel, EnCE Digital Forensics for Attorneys - Part 2 Experts, Analysis, Challenging Evidence

2 Digital Forensics For Attorneys Part I Overview of Digital Forensics Types of Digital Evidence Acquisition (Collection) and Preservation Part 2 Experts, Evidence and Analysis Understand Forensic Experts vs. Computer Experts Digital evidence: discovery and usage Overview of Digital Forensics Analysis Challenging Digital Evidence

3 Experts

4 Defendant as Expert

5 Why a Forensics Expert? Computer Forensics Expert Should have comparable or better training and experience than the other expert. Should have specific training and experience as a digital forensics expert Should have access to the same tools as the opposing expert Must be able to qualify as a forensic expert in court

6

7 Technical Expertise Comparison

8 Technical Expertise Comparison

9 Legal Expertise Comparison

10 Investigative Expertise Comparison Computer Experts No training in examination or investigation, as they do not need to. Digital Forensics Expert Digital Forensics Experts Examples: USB Device history, authentication, internet history, data deletion, Peer to Peer cases, etc.

11 Selecting a Digital Forensics Expert

12 Reasonable Costs

13 Certifications

14 Forensic Tools Do they have appropriate forensic tools? - Required to perform many digital forensic functions - Computer Forensics (EnCase, FTK) - Cell Phone Forensics (CelleBrite, Paraben, Susteen) - Almost always needed to perform forensically sound acquisitions and examinations.

15 Selecting an Expert: Overview 1. Actual training in digital forensics and sub-disciplines? 2. Digital Forensics certifications? Or just computer based certifications? 3. Actual case experience? 4. Recommendation letters from other professionals, particularly attorneys?

16 Spotting a Problem Expert Attitude: How does the expert interact with your team? 1. Arrogant or superior? 2. Does he or she take the time to explain to properly explain technical concepts in easy to understand language? The Bull Factor 1. If an expert does not have the answer to a question, does he or she try to convince you that they do anyway? 2. Great risk when testifying. 3. Use of jargon to cover up ignorance.

17 Spotting a Problem Expert Appearance Matters 1. Expert should engage with others and dress in a way that conveys professionalism and competence. Aversion 1. Some experts will take cases they should not because they cannot emotionally handle the contents of the evidence. a. Particularly true with sex crimes cases and other defense related cases.

18 Spotting a Problem Expert Does the Examiner Have Time? 1. Does the examiner have time to work the case? Some cases (particularly Child Pornography) can require travel. Is Forensics a second job? Avocation?

19 Expectations of a Forensics Expert Computer Forensics Expert Expected to Anticipate testimony of opposing expert based on the forensic reports and discovery. Duplicate and verify the opposing expert s work. Assist the attorney in preparation for trial Advise the attorney as to the merits of the case in regards to the digital evidence presented.

20 Expectations of a Forensics Expert Computer Forensics Expert Expected to testify if needed as to: Various files on the client s computer. Ownership of the computer and files. Forensic processes used to extract and verify data. Handling and collection of the evidence. Specifics relating to software installed, dates and times of computer activities

21 Analysis

22 Analyzing the Case Approaching the case holistically Digital evidence can reach into all corners of a case:» Cell records» » Pictures» Timelines» Internet Activity

23 Analyzing the Case Always work the case like you are the primary examiner. Never assume anything. Check all the points in the case where mistakes are normally made: Chain of custody. Examination standard procedures. RTC verified for all evidence containing clocks. Evidence handling at the scene. Was everything examined. Claims made in the forensics report. Pay particular attention to keyword search results, internet history results, link files, etc. Placing the defendant at the computer.

24 Performing the Analysis Step one: Duplicate the other side s work. Verify the accuracy of their findings Did they represent their findings correctly? How thorough was the examination? Verify the completeness of their report Is everything they found in the report?» Why or why not? Was exculpatory evidence ignored or missed?

25 Establishing a framework for analysis Reading discovery documents Reading the computer forensics reports What claims are being made? What statements were made? What facts support the claims and which do not?

26 What clues can lead to a more thorough digital analysis? Defendant's statements Witness statements Police statements and interviews Call center records Search warrants and subpoenas Other supporting documents Law Enforcement's computer forensics report

27 Case Analysis Examples

28 Document Metadata Example

29 Picture Metadata Example

30 Internet History Before Clearing

31 Internet History After Clearing

32 Challenging the evidence Common mistakes that open digital evidence to challenges Failing to verify clock times Computer Clocks (Real Time Clock Setting) Affects everything related to time lines:» Internet history» s» Computer activity Digital Cameras Affects the metadata inside the digital images.

33 Challenging the evidence Is the evidence in the report allowed by the search warrant? Was a separate warrant obtained for searching the specific computers and devices? Did the language of the warrant restrict the search in any way? Was evidence obtained through a private party under the direction of law enforcement outside the warrant? Did a verbal request to preserve evidence outside a subpoena without subsequent paperwork cause the third party to become an agent and subject to 4 th amendment search restrictions?

34 Challenging the evidence Is there an attempt to place a person at a computer without adequate proof? How can you tell? Did the analyst check for unique user accounts with passwords? Is there evidence anyone else used the computer under that person s account or profile? Was the computer in a common area? Did others know the passwords to the user s account? Was access to the computer restricted by physical boundaries or location?

35 Challenging the evidence Games people play Stating facts out of context Keywords Keyword hits are not always relevant» Murder case example» Hits were found for the keywords murder (156), kidnapping (34), disposal (76), and death (273) on the subject s computer.

36 Challenging the evidence Games people play Stating facts out of context Keywords» Hits were found for the keywords murder (156), kidnapping (34), disposal (76), and death (273) on the subject s computer. Where can these hits come from? Lexicons, thesaurus, and spell check dictionaries News focused web pages (MSN, Newspaper sites, Television sties, CNN, etc.) When is a hit a hit?» Is 156 hits for murder meaningful?

37 Challenging the evidence Games people play Stating facts out of context Internet Searches» Murder case example» Searches were found for the keywords murder, kidnapping, disposal and death on the subject s computer.

38 Google Search Result Riehl World View: Murder, Kidnapping Alleged In Holloway Arrest The arrestee is held in Utrecht and suspected of kidnapping and murder.... Aruba is SURROUNDED by the ideal body disposal mechanism - the ocean k - Cached - Similar pages - Note this #05-624: Jose Padilla Charged With Conspiracy To Murder charges Padilla with conspiracy to murder, kidnap and maim individuals in a... every tool at our disposal in vigorously fighting the war on terrorism, k - Cached - Similar pages - Note this The Agenda Kidnapping, murder, and holding - overpowering the kidnap victim,... Our capabilities and the means at our disposal - our capability of reaching the target k - Cached - Similar pages - Note this David Coltart (Official Website)» Cain Nkala murder Deadly AK47 rifles have become the weapon of choice for thugs involved in murder, kidnapping and torture throughout Zimbabwe.... davidcoltart.com/archive/category/press-reports/cain-nkala-murder - 35k - Cached - Similar pages - Note this Supreme Court of Ohio / Public Information / Case Summaries McKnight was found guilty of the kidnapping, robbery and aggravated murder of 20 -year-old Kenyon College student Emily Murray in November 2000 and the k - Cached - Similar pages - Note this [PDF] Jose Padilla Charged With Conspiracy To Murder Individuals... File Format: PDF/Adobe Acrobat - View as HTML demonstrates that we will use every tool at our disposal in vigorously... violent jihad, which would include acts of murder, kidnapping and maiming,... nefafoundation.org/miscellaneous/featureddocs/u.s._v_padilla_dojpr_ind.pdf - Similar pages - Note this

39 Challenging the evidence Games people play Playing the techie game Technical words no one understands Unallocated space Slack space Browser cache Typed URLs Gnutella and Limewire What does that mean?

40 Challenging the evidence Child porn example (State s forensics report) 35 images depicting child pornography were located on suspects hard drive. Details 1. Images were found in the browser cache at C:\user\documents and settings\internet history\hro5ij (10 images in all) 2. Images were found and extracted from C:\ drive unallocated space. (10 images in all) 3. Images were found in The BearShare Shared folder at C:\user\Program Files\BearShare\Shared (15) When presented with this kind of report, what do you do?

41 Challenging the evidence What does that mean? If it is in the browser cache, does that mean the user did it on purpose?» How browser caching works.

42

43 Challenging the evidence What the heck is unallocated space?» Unallocated space is areas on the hard drive that are available to store data.» When a file is deleted, it is only marked as deleted, so the old data remains on the hard drive in the unallocated space.» Forensic tools can recover files from this unallocated area of the hard drive.

44 Challenging the evidence Peer to Peer Software: It s in the shared folder right? MAC Times, Multi-select Program Installation (Default Sharing)

45

46 Multi-Select

47 Challenging the evidence Digital evidence can also be used to Help to establish the whereabouts of the defendant. Was the defendant doing something on the computer that matches his statements about his activities at a certain time? Establish mitigating circumstances Was something going on that can be found on the computer or cell phone that shows this? Disprove pre-meditation in a death penalty case? Real case example: Fake account created after a murder to cover it up, versus before hand.

48 Contact Information: Web: Blog: Phone: Questions? Coming soon: Attorney Resource Center Online Book: Digital Forensics for Legal Professionals May 2011, Syngress Publishing Larry E. Daniel and Lars E. Daniel

10/11/2012. Digital Forensics for Attorneys - Part 2. Digital Forensics For Attorneys. Experts. Larry E. Daniel, EnCE, DFCP, BCE

10/11/2012. Digital Forensics for Attorneys - Part 2. Digital Forensics For Attorneys. Experts. Larry E. Daniel, EnCE, DFCP, BCE Larry E. Daniel, EnCE, DFCP, BCE Digital Forensics for Attorneys - Part 2 Experts, Analysis, Challenging Evidence Digital Forensics For Attorneys Part I Overview of Digital Forensics Types of Digital Evidence

More information

About Your Presenter. Digital Forensics For Attorneys. Overview of Digital Forensics

About Your Presenter. Digital Forensics For Attorneys. Overview of Digital Forensics Larry E. Daniel, EnCE, DFCP, BCE Digital Forensic Examiner Digital Forensics for Attorneys An Overview of Digital Forensics About Your Presenter EnCase Certified Examiner (EnCE) Digital Forensics Certified

More information

Digital Forensics for Attorneys Overview of Digital Forensics

Digital Forensics for Attorneys Overview of Digital Forensics Lars Daniel,, EnCE, ACE, CTNS Digital Forensic Examiner Digital Forensics for Attorneys Overview of Digital Forensics Digital Forensics For Attorneys Overview of Digital Forensics Types of Digital Evidence

More information

Digital Forensics. Larry Daniel

Digital Forensics. Larry Daniel Digital Forensics Larry Daniel Introduction A recent research report from The Yankee Group found that 67.6 percent of US households in 2002 contained at least one PC The investigators foresee three-quarters

More information

Cell Phone Forensics For Legal Professionals

Cell Phone Forensics For Legal Professionals 1 Cell Phone Forensics For Legal Professionals Lars E. Daniel, EnCE, ACE, AME, CTNS, SCE, SCCM, SCA Digital Forensics Examiner Cell Phone Acquisition and Examination Collection and Acquiring Cell Phones

More information

Computer Forensic Capabilities

Computer Forensic Capabilities Computer Forensic Capabilities Agenda What is computer forensics? Where to find computer evidence Forensic imaging Forensic analysis What is Computer Forensics? The preservation, identification, extraction,

More information

Cell Phone Acquisition and Examination. Dangers Of Thumb Forensics

Cell Phone Acquisition and Examination. Dangers Of Thumb Forensics Cell Phone Forensics For Legal Professionals Lars Daniel, EnCE, ACE, CTNS Cell Phone Acquisition and Examination Collection and Acquiring Cell Phones Unique Preservation Issues Phone must be isolated from

More information

Digital Forensic Techniques

Digital Forensic Techniques Digital Forensic Techniques Namrata Choudhury, Sr. Principal Information Security Analyst, Symantec Corporation Professional Techniques T23 CRISC CGEIT CISM CISA AGENDA Computer Forensics vs. Digital Forensics

More information

Lecture outline. Computer Forensics and Digital Investigation. Defining the word forensic. Defining Computer forensics. The Digital Investigation

Lecture outline. Computer Forensics and Digital Investigation. Defining the word forensic. Defining Computer forensics. The Digital Investigation Computer Forensics and Digital Investigation Computer Security EDA263, lecture 14 Ulf Larson Lecture outline! Introduction to Computer Forensics! Digital investigation! Conducting a Digital Crime Scene

More information

Where can I get help after a sexual assault?

Where can I get help after a sexual assault? Sexual Assault What is assault? Assault is when someone uses force to hurt you. Slapping, kicking and pushing can be assault. Sometimes touching can be an assault. Threatening or trying to hurt someone

More information

Hands-On How-To Computer Forensics Training

Hands-On How-To Computer Forensics Training j8fm6pmlnqq3ghdgoucsm/ach5zvkzett7guroaqtgzbz8+t+8d2w538ke3c7t 02jjdklhaMFCQHihQAECwMCAQIZAQAKCRDafWsAOnHzRmAeAJ9yABw8v2fGxaq skeu29sdxrpb25zidxpbmznogtheories...ofhilz9e1xthvqxbb0gknrc1ng OKLbRXF/j5jJQPxXaNUu/It1TQHSiyEumrHNsnn65aUMPnrbVOVJ8hV8NQvsUE

More information

YOUR CONTACT DETAILS (ADDRESS, PHONE, EMAIL etc.):

YOUR CONTACT DETAILS (ADDRESS, PHONE, EMAIL etc.): Justice WA YOUR NAME: YOUR CONTACT DETAILS (ADDRESS, PHONE, EMAIL etc.): TODAY S DATE: INDICATE WHO IS COMPLETING THIS FORM: Defendant Family Member of Defendant (Relationship : ) Friend of Defendant Other:

More information

Community Legal Information Association of PEI, Inc. Sexual Assault

Community Legal Information Association of PEI, Inc. Sexual Assault Community Legal Information Association of PEI, Inc. Sexual Assault As an adult in Canada, you have the right to choose when or if you engage in sexual activity. Sexual activity without your consent is

More information

TABLE OF CONTENTS. Homicide Case Flowchart...3. Overview of Homicide Trial...4. Location of Local Court Houses...5. General Courtroom Diagram...

TABLE OF CONTENTS. Homicide Case Flowchart...3. Overview of Homicide Trial...4. Location of Local Court Houses...5. General Courtroom Diagram... A Guide to the Homicide Criminal Justice Process P a g e 2 TABLE OF CONTENTS Homicide Case Flowchart...3 Overview of Homicide Trial...4 Location of Local Court Houses...5 General Courtroom Diagram...6

More information

A Victim s Guide to Understanding the Criminal Justice System

A Victim s Guide to Understanding the Criminal Justice System A Victim s Guide to Understanding the Criminal Justice System The Bartholomew County Prosecutor s Office Victim Assistance Program Prosecutor: William Nash 234 Washington Street Columbus, IN 47201 Telephone:

More information

MSc Computer Security and Forensics. Examinations for 2009-2010 / Semester 1

MSc Computer Security and Forensics. Examinations for 2009-2010 / Semester 1 MSc Computer Security and Forensics Cohort: MCSF/09B/PT Examinations for 2009-2010 / Semester 1 MODULE: COMPUTER FORENSICS & CYBERCRIME MODULE CODE: SECU5101 Duration: 2 Hours Instructions to Candidates:

More information

Digital Forensics. Dr. Vic Fay-Wolfe Department of Computer Science University of Rhode Island

Digital Forensics. Dr. Vic Fay-Wolfe Department of Computer Science University of Rhode Island Digital Forensics Dr. Vic Fay-Wolfe Department of Computer Science University of Rhode Island Topics What is Digital Forensics? Cases Digital Forensics Practice Algorithms and Computer Sci Digital Forensics

More information

Breakfast Meeting: Securing your Secured Data Digital Forensics, Fraud and Forensic Advancements

Breakfast Meeting: Securing your Secured Data Digital Forensics, Fraud and Forensic Advancements Breakfast Meeting: Securing your Secured Data Digital Forensics, Fraud and Forensic Advancements 9 April 2013 Facilitator: Dr. Sheau-Dong Lang, Coordinator Master of Science in Digital Forensics University

More information

Open Source Digital Forensics Tools

Open Source Digital Forensics Tools The Legal Argument 1 carrier@cerias.purdue.edu Abstract This paper addresses digital forensic analysis tools and their use in a legal setting. To enter scientific evidence into a United States court, a

More information

Criminal Investigation CRJ141. Matthew McCarty

Criminal Investigation CRJ141. Matthew McCarty Criminal Investigation CRJ141 Matthew McCarty Chapter 1 Criminal Investigation: An Overview CSI Effect The exaggerated depiction of how television forensic science operates, creating a phenomenon in which

More information

To Catch a Thief: Computer Forensics in the Classroom

To Catch a Thief: Computer Forensics in the Classroom To Catch a Thief: Computer Forensics in the Classroom Anna Carlin acarlin@csupomona.edu Steven S. Curl scurl@csupomona.edu Daniel Manson dmanson@csupomona.edu Computer Information Systems Department California

More information

EC-Council Ethical Hacking and Countermeasures

EC-Council Ethical Hacking and Countermeasures EC-Council Ethical Hacking and Countermeasures Description This class will immerse the students into an interactive environment where they will be shown how to scan, test, hack and secure their own systems.

More information

Austin Independent School District Police Department Policy and Procedure Manual

Austin Independent School District Police Department Policy and Procedure Manual Policy 4.11 Austin Independent School District Police Department Policy and Procedure Manual Domestic Violence I. POLICY (TPCAF 7.08.1) It is the policy of the AISD Police Department to respond to all

More information

Computer Hacking Forensic Investigator v8

Computer Hacking Forensic Investigator v8 CÔNG TY CỔ PHẦN TRƯỜNG CNTT TÂN ĐỨC TAN DUC INFORMATION TECHNOLOGY SCHOOL JSC LEARN MORE WITH LESS! Computer Hacking Forensic Investigator v8 Course Description: EC-Council releases the most advanced Computer

More information

Stages in a Capital Case from http://deathpenaltyinfo.msu.edu/

Stages in a Capital Case from http://deathpenaltyinfo.msu.edu/ Stages in a Capital Case from http://deathpenaltyinfo.msu.edu/ Note that not every case goes through all of the steps outlined here. Some states have different procedures. I. Pre-Trial Crimes that would

More information

Victims of Crime Act

Victims of Crime Act Victims of Crime Act PURPOSE Recognizing the state's concern for victims of crime, it is the purpose of the Victims of Crime Act [31-26-1 NMSA 1978] to assure that: A. the full impact of a crime is brought

More information

Certified Digital Forensics Examiner

Certified Digital Forensics Examiner Certified Digital Forensics Examiner Course Name: CDFE V6.0 Duration: Language: 5 days English Format: Instructor-led (Lecture and Lab) Prerequisite: Experience in using a computer Student Materials: Student

More information

Digital Forensics & e-discovery Services

Digital Forensics & e-discovery Services Digital Forensics & e-discovery Services U.S. Security Associates Digital Forensics & e-discovery Services 21st century fraud investigations require expert digital forensics skills to deal with the complexities

More information

Certified Digital Forensics Examiner

Certified Digital Forensics Examiner Certified Digital Forensics Examiner Course Name: CDFE V6.0 Duration: Language: 5 days English Format: Instructor-led (Lecture and Lab) Prerequisite: Experience in using a computer Student Materials: Student

More information

Digital Forensics & e-discovery Services

Digital Forensics & e-discovery Services Digital Forensics & e-discovery Services Andrews International Digital Forensics & e-discovery Services 21st century fraud investigations require expert digital forensics skills to deal with the complexities

More information

The Rights of Crime Victims in Texas

The Rights of Crime Victims in Texas The Rights of Crime Victims in Texas 1 Housekeeping Please turn off cell phones and pagers or place in a silent mode. Questions can be answered in presentations or during break. 2 Constitutional Rights

More information

YAVAPAI COUNTY PUBLIC DEFENDER 595 WHITE SPAR ROAD PRESCOTT, ARIZONA 86303 PHONE: (928) 771-3588 FAX: (928) 771-3413 INFORMATION BOOKLET

YAVAPAI COUNTY PUBLIC DEFENDER 595 WHITE SPAR ROAD PRESCOTT, ARIZONA 86303 PHONE: (928) 771-3588 FAX: (928) 771-3413 INFORMATION BOOKLET YAVAPAI COUNTY PUBLIC DEFENDER 595 WHITE SPAR ROAD PRESCOTT, ARIZONA 86303 PHONE: (928) 771-3588 FAX: (928) 771-3413 INFORMATION BOOKLET Table of Contents CRIMINAL PROCEDURE Initial Appearance/Bond Preliminary

More information

OBJECTIVES CRIMINAL PROCESS- PROSECUTING ATTORNEY S OFFICE NAVIGATING THE CRIMINAL AND CIVIL PROCESS IN CHILD ABUSE AND NEGLECT CASES

OBJECTIVES CRIMINAL PROCESS- PROSECUTING ATTORNEY S OFFICE NAVIGATING THE CRIMINAL AND CIVIL PROCESS IN CHILD ABUSE AND NEGLECT CASES NAVIGATING THE CRIMINAL AND CIVIL PROCESS IN CHILD ABUSE AND NEGLECT CASES LORI FLUEGEL ASSISTANT PROSECUTING ATTORNEY JACKSON COUNTY OBJECTIVES UNDERSTANDING OF THE CRIMINAL AND CIVIL PROCESS OF CHILD

More information

BDO CONSULTING FORENSIC TECHNOLOGY SERVICES

BDO CONSULTING FORENSIC TECHNOLOGY SERVICES BDO CONSULTING FORENSIC TECHNOLOGY SERVICES MARCH 2013 AGENDA Introduction About BDO Consulting Computer Forensics & E-Discovery Practice Current Trends Case Studies Q&A Page 2 Michael Barba Managing Director,

More information

Sensitive Incident Investigations. Digital Risk Management. Forensics Testing.

Sensitive Incident Investigations. Digital Risk Management. Forensics Testing. Sensitive Incident Investigations. Digital Risk Management. Forensics Testing. 2009 Innovation Award Winner Austin Chamber of Commerce 2010 Innovation Award Finalist Austin Chamber of Commerce Only private

More information

Where is computer forensics used?

Where is computer forensics used? What is computer forensics? The preservation, recovery, analysis and reporting of digital artifacts including information stored on computers, storage media (such as a hard disk or CD-ROM), an electronic

More information

Glossary of Terms Acquittal Affidavit Allegation Appeal Arraignment Arrest Warrant Assistant District Attorney General Attachment Bail Bailiff Bench

Glossary of Terms Acquittal Affidavit Allegation Appeal Arraignment Arrest Warrant Assistant District Attorney General Attachment Bail Bailiff Bench Glossary of Terms The Glossary of Terms defines some of the most common legal terms in easy-tounderstand language. Terms are listed in alphabetical order. A B C D E F G H I J K L M N O P Q R S T U V W

More information

The Criminal Justice System The Police. I. The Police. II. Organization a. Most agencies located in counties, cities and towns

The Criminal Justice System The Police. I. The Police. II. Organization a. Most agencies located in counties, cities and towns The Criminal Justice System The Police I. The Police a. More than 725,000 police across the country b. Local, state and national levels c. Protect, maintain peace & order, investigate, arrest, and book

More information

Purpose of the Victim/Witness Unit

Purpose of the Victim/Witness Unit Purpose of the Victim/Witness Unit The Victim/Witness Assistance Division of the Lake County State s Attorney s Office was formed to serve the needs of people like you. The division is meant to ensure

More information

Computer Forensics Processing Checklist. Pueblo High-Tech Crimes Unit

Computer Forensics Processing Checklist. Pueblo High-Tech Crimes Unit Computer Forensics Processing Checklist Pueblo High-Tech Crimes Unit Cmdr. Dave Pettinari Pueblo County Sheriff's Office davepet@cops.org The purpose of this document is to provide computer forensic technicians

More information

SOLVING VIOLENT CRIMES WITH A UNIFIED WORKFLOW

SOLVING VIOLENT CRIMES WITH A UNIFIED WORKFLOW Use Case SOLVING VIOLENT CRIMES WITH A UNIFIED WORKFLOW In a Violent Home Invasion Investigation, the UFED Series Seamlessly Unifies Workflows from Field to Lab A series of violent home invasions has everyone

More information

CAPABILITY STATEMENT. > Forensic Technology Team < Daniel Hains, Director t (07) 3228 4028 e dhains@vincents.com.au w www.vincents.com.

CAPABILITY STATEMENT. > Forensic Technology Team < Daniel Hains, Director t (07) 3228 4028 e dhains@vincents.com.au w www.vincents.com. CAPABILITY STATEMENT > Forensic Technology Team < Daniel Hains, Director t (07) 3228 4028 e dhains@vincents.com.au w www.vincents.com.au CAPABILITY FORENSIC TECHNOLOGY INDEX Page No. Introduction... 3

More information

The Witness and the Justice System in Alberta

The Witness and the Justice System in Alberta The Witness and the Justice System in Alberta Introduction This booklet provides basic information about appearing as a witness in the courts of Alberta. It is designed to explain your role as a witness,

More information

Domestic Violence Case Management Plan

Domestic Violence Case Management Plan Domestic Violence Case Management Plan From the commencement of litigation to its resolution, whether by trial or settlement, it is the goal of this Court to reduce delay and enable just and efficient

More information

REPRESENTING THE ACCUSED COP KILLER (Lessons from the Trenches) STATE OF ALABAMA VS. MARIO DION WOODWARD 03-CC-2007-1388-TMH (Mont. Co. Cir.

REPRESENTING THE ACCUSED COP KILLER (Lessons from the Trenches) STATE OF ALABAMA VS. MARIO DION WOODWARD 03-CC-2007-1388-TMH (Mont. Co. Cir. REPRESENTING THE ACCUSED COP KILLER (Lessons from the Trenches) STATE OF ALABAMA VS. MARIO DION WOODWARD 03-CC-2007-1388-TMH (Mont. Co. Cir. Court) I. PUBLICITY: Joseph P. Van Heest, Esq., Richard K. Keith,

More information

IN THE SUPREME COURT OF THE STATE OF DELAWARE

IN THE SUPREME COURT OF THE STATE OF DELAWARE IN THE SUPREME COURT OF THE STATE OF DELAWARE ORLANDO INGRAM, No. 460, 2014 Defendant Below, Appellant, Court Below: Superior Court of the State of Delaware in v. and for Kent County STATE OF DELAWARE,

More information

System Overview ~~~~~ Presented by: Darcie McElwee

System Overview ~~~~~ Presented by: Darcie McElwee System Overview ~~~~~ Presented by: Darcie McElwee SYSTEM OVERVIEW OBJECTIVES Upon conclusion of this module the participant will be able to: Describe the overall structure, case flow process, and roles

More information

GETTING THROUGH THE CRIMINAL JUSTICE SYSTEM

GETTING THROUGH THE CRIMINAL JUSTICE SYSTEM GETTING THROUGH THE CRIMINAL JUSTICE SYSTEM ARREST An ARREST starts the criminal justice process. It is called an arrest whether the police officer hands you a summons or puts handcuffs on you and takes

More information

Role Preparation. Preparing for a Mock Trial

Role Preparation. Preparing for a Mock Trial Civil Law Mock Trial: Role Preparation This package contains: PAGE Preparing for a Mock Trial 1-5 Time Chart 6 Etiquette 7-8 Role Preparation for: Plaintiff and Defendant Lawyers 9-12 Judge 13 Jury 13

More information

Immigration and Customs Enforcement Forensic Analysis of Electronic Media

Immigration and Customs Enforcement Forensic Analysis of Electronic Media for the Immigration and Customs Enforcement Forensic Analysis of Electronic Media DHS/ICE/PIA-042 May 11, 2015 Contact Point Peter T. Edge Executive Assistant Director Homeland Security Investigations

More information

Colorado Criminal Jury Instruction Chapter 1:04 and Chapter 3

Colorado Criminal Jury Instruction Chapter 1:04 and Chapter 3 Attachment No. 2 Proposed Plain Language Revisions to Colorado Criminal Jury Instruction Chapter 1:04 and Chapter 3 The work of the Plain Language Subcommittee is set forth below. For comparison, the redrafted

More information

WILLIAM OETTINGER PHONE (702) 292-4645 WOETTINGER@GMAIL.COM

WILLIAM OETTINGER PHONE (702) 292-4645 WOETTINGER@GMAIL.COM WILLIAM OETTINGER PHONE (702) 292-4645 WOETTINGER@GMAIL.COM SUMMARY OF QUALIFICATIONS Veteran investigator in a traditional and computer-related environment. A leader experienced in organizing, directing,

More information

12.412 DOMESTIC VIOLENCE

12.412 DOMESTIC VIOLENCE 12.412 DOMESTIC VIOLENCE References: Procedure 12.400, Incident and Miscellaneous Reporting Procedure 12.403, Crime Victim/Witness Notification and Assistance Procedure 12.413, Enforcement of Court Orders

More information

PROSECUTION DIVISION THE MISSION

PROSECUTION DIVISION THE MISSION PROSECUTION DIVISION THE MISSION Chief Prosecutor Phillip J. Tydingco The Office of the Attorney General, through its Prosecution Division, plays a vital role in Guam s criminal justice system as part

More information

Course Court Systems and Practices. Unit X Pre-trial

Course Court Systems and Practices. Unit X Pre-trial Course Court Systems and Practices Unit X Pre-trial Essential Question What happens to a case between the time a person is arrested and the time they have their trial? TEKS 130.296(c) (1)(G) (4)(B)(E)

More information

grand larceny robbery vandalism arson victimless crimes white-collar crimes community policing probable cause arrest warrant own

grand larceny robbery vandalism arson victimless crimes white-collar crimes community policing probable cause arrest warrant own Unit 8 (2 weeks) SECTIONS Don t do the crime if you do not want to serve the time! 1. Causes of crimes (2 Days) 2. Crime classification (2 Days) 3. Criminal defenses (2 Days) 4. Criminal justice procedures

More information

MODEL CRIMINAL DEFENSE MENTORING PROGRAM Utah State Bar New Lawyer Training Program

MODEL CRIMINAL DEFENSE MENTORING PROGRAM Utah State Bar New Lawyer Training Program MODEL CRIMINAL DEFENSE MENTORING PROGRAM Utah State Bar New Lawyer Training Program The following is submitted as a Model Mentoring Plan for the criminal defense practice field. It was prepared by an experienced

More information

DNA & CRIME VICTIMS: WHAT VICTIMS NEED TO KNOW

DNA & CRIME VICTIMS: WHAT VICTIMS NEED TO KNOW DNA & CRIME VICTIMS: WHAT VICTIMS NEED TO KNOW DNA & CRIME VICTIMS: What Victims Need to Know The increasing use of DNA evidence in criminal cases gives victims of crime new hope that offenders will be

More information

Criminal Law. Month Content Skills August. Define the term jurisprudence. Introduction to law. What is law? Explain several reasons for having laws.

Criminal Law. Month Content Skills August. Define the term jurisprudence. Introduction to law. What is law? Explain several reasons for having laws. Criminal Law Month Content Skills August Introduction to law Define the term jurisprudence. What is law? Explain several reasons for having laws. Discuss the relationship between laws and values. Give

More information

Franklin County State's Attorney Victim Services

Franklin County State's Attorney Victim Services Franklin County State's Attorney Victim Services FREQUENTLY ASKED QUESTIONS What type of services and information can I get through Victim Services Program? A Victim Advocate will be assigned to assist

More information

Forensic Toolkit. Sales and Promotional Summary ACCESSDATA, ON YOUR RADAR

Forensic Toolkit. Sales and Promotional Summary ACCESSDATA, ON YOUR RADAR Forensic Toolkit Sales and Promotional Summary ACCESSDATA, ON YOUR RADAR What is AccessData s Forensic Toolkit? Also known as FTK, this application enables you to perform complete and thorough computer

More information

Services. Computer Forensic Investigations

Services. Computer Forensic Investigations DataTriangle, Inc. is uniquely structured to provide you with a high quality expert as expeditiously as possible. Charles Snipes has nearly 15 years of experience with criminal investigations in the areas

More information

Introduction to Data Forensics. Jeff Flaig, Security Consultant January 15, 2014

Introduction to Data Forensics. Jeff Flaig, Security Consultant January 15, 2014 Introduction to Data Forensics Jeff Flaig, Security Consultant January 15, 2014 WHAT IS COMPUTER FORENSICS Computer forensics is the process of methodically examining computer media (hard disks, diskettes,

More information

Issue Brief. Arizona State Senate ARIZONA SEX OFFENDER REGISTRATION AND NOTIFICATION INTRODUCTION ADAM WALSH ACT. November 23, 2009.

Issue Brief. Arizona State Senate ARIZONA SEX OFFENDER REGISTRATION AND NOTIFICATION INTRODUCTION ADAM WALSH ACT. November 23, 2009. Arizona State Senate Issue Brief November 23, 2009 Note to Reader: The Senate Research Staff provides nonpartisan, objective legislative research, policy analysis and related assistance to the members

More information

HOW A TYPICAL CRIMINAL CASE IS PROSECUTED IN ALASKA

HOW A TYPICAL CRIMINAL CASE IS PROSECUTED IN ALASKA HOW A TYPICAL CRIMINAL CASE IS PROSECUTED IN ALASKA The Office of Victims Rights receives many inquiries from victims about how a criminal case in Alaska is investigated by police and then prosecuted by

More information

Data Mining Minnesota Murder Victim s Cell Phone Reveals. Smoking Gun Evidence

Data Mining Minnesota Murder Victim s Cell Phone Reveals. Smoking Gun Evidence Data Mining Minnesota Murder Victim s Cell Phone Reveals Smoking Gun Evidence State v. Ferguson, 804 N.W.2d 586 (Minn. 2011) Introduction Television programs routinely show attorneys and investigators

More information

Teacher Assessment Blueprint. Criminal Justice. Test Code: 5269 / Version: 01. Copyright 2010 NOCTI. All Rights Reserved.

Teacher Assessment Blueprint. Criminal Justice. Test Code: 5269 / Version: 01. Copyright 2010 NOCTI. All Rights Reserved. Teacher Assessment Blueprint Test Code: 5269 / Version: 01 Copyright 2010 NOCTI. All Rights Reserved. General Assessment Information Blueprint Contents General Assessment Information Written Assessment

More information

Best Practices in Electronic Record Retention

Best Practices in Electronic Record Retention I. Some Key Considerations In Whether To Engage An E-Discovery Vendor (Or Vendors) A. It is difficult to decide whether to retain a vendor if you don t know what your organization can do and at what cost.

More information

Introduction. IMF Conference September 2008

Introduction. IMF Conference September 2008 Live Forensic Acquisition as Alternative to Traditional Forensic Processes Marthie Lessing* Basie von Solms Introduction The Internet and technology developments introduced a sharp increase in computer

More information

The Indiana Coalition Against Domestic Violence

The Indiana Coalition Against Domestic Violence Evidentiary Issues in Domestic Cases: An Overview Introduction A. Importance of legal representation in cases that involve domestic violence. B. History of protection order laws and implications for evidence.

More information

How will I know if I have to give evidence in court?

How will I know if I have to give evidence in court? Being a Witness What is a witness? A witness is a person who is required to come to court to answer questions about a case. The answers a witness gives in court are called evidence. Before giving evidence,

More information

Victim Witness Assistance Program

Victim Witness Assistance Program Victim Witness Assistance Program of Santa Clara County Kasey Halcón Director Case Study Law enforcement responds to a domestic disturbance. The officer enters the home and a woman is crying on the couch,

More information

ediscovery: The New Information Management Battleground Developments in the Law and Best Practices

ediscovery: The New Information Management Battleground Developments in the Law and Best Practices Sponsored by ediscovery: The New Information Management Battleground Developments in the Law and Best Practices Kahn Consulting Inc. (847) 266-0722 info@kahnconsultinginc.com Introduction The following

More information

Battling Current Technological Trends

Battling Current Technological Trends Law Enforcement Incident Response to Cybercrimes & Battling Current Technological Trends Corey J. Bourgeois, Computer Forensic Examiner & David Ferris, Investigator Louisiana Department of Justice HTCU

More information

Juvenile Offenders Crime Victims Rights Law Enforcement Responsibilities

Juvenile Offenders Crime Victims Rights Law Enforcement Responsibilities Juvenile Offenders Crime Victims Rights Law Enforcement Responsibilities Crime Victims Rights when involving a Juvenile Offender are the same as if the offender were an adult in cases of -- felony grade

More information

the best defense R a t e d t o p 5 % U. S. L a w F i r m Exclusively Criminal Defense Former Los Angeles Prosecutors Immediate Response 24/7

the best defense R a t e d t o p 5 % U. S. L a w F i r m Exclusively Criminal Defense Former Los Angeles Prosecutors Immediate Response 24/7 the best defense Exclusively Criminal Defense Former Los Angeles Prosecutors Immediate Response 24/7 AGGRESSIVE DEFENSE IN STATE AND FEDERAL COURTS R a t e d t o p 5 % U. S. L a w F i r m AGGRESSIVE DEFENSE

More information

COMMONWEALTH OF MASSACHUSETTS THE TRIAL COURT STANDING ORDER NO. 2-86 (AMENDED)

COMMONWEALTH OF MASSACHUSETTS THE TRIAL COURT STANDING ORDER NO. 2-86 (AMENDED) COMMONWEALTH OF MASSACHUSETTS THE TRIAL COURT SUFFOLK, ss. SUPERIOR COURT DEPARTMENT STANDING ORDER NO. 2-86 (AMENDED) Applicable to All Counties to cases initiated by indictment on or after September

More information

VOIR DIRE 2/11/2015 STATE OF TEXAS VS JANE DOE 1. CONVERSATION - ONLY TIME YOU CAN ASK THE LAWYERS QUESTIONS 2. NO RIGHT OR WRONG ANSWER

VOIR DIRE 2/11/2015 STATE OF TEXAS VS JANE DOE 1. CONVERSATION - ONLY TIME YOU CAN ASK THE LAWYERS QUESTIONS 2. NO RIGHT OR WRONG ANSWER STATE OF TEXAS VS JANE DOE VOIR DIRE 1. CONVERSATION - ONLY TIME YOU CAN ASK THE LAWYERS QUESTIONS 2. NO RIGHT OR WRONG ANSWER 3. DESELECTION (TO MAKE THE JURY = SIT THERE & BE QUIET) 4. SOME QUESTIONS

More information

SUMMARY OF RULES AND STATUTES REGARDING BAIL FOR INDICTABLE OFFENSES

SUMMARY OF RULES AND STATUTES REGARDING BAIL FOR INDICTABLE OFFENSES SUMMARY OF RULES AND STATUTES REGARDING BAIL FOR INDICTABLE OFFENSES Rule or Statute Rule3:3-1. Determination on whether to issue a Summons or Warrant Description The Rule provides that a summons shall

More information

Authentication of Cell Phone Text Messages

Authentication of Cell Phone Text Messages Authentication of Cell Phone Text Messages By Pierre Grosdidier Parties seeking to admit cell phone text messages at trial face two authentication challenges. They must show that the documents they seek

More information

What is DOMESTIC VIOLENCE?

What is DOMESTIC VIOLENCE? What is DOMESTIC VIOLENCE? Domestic violence is a pattern of control used by one person to exert power over another. Verbal abuse, threats, physical, and sexual abuse are the methods used to maintain power

More information

Digital Forensics Case Study

Digital Forensics Case Study Digital Forensics Case Study Using metadata to prove a case Challenge: Forensically collect and investigate digital files for a complex employment case with noncompete covenants and trade secrets at stake.

More information

CASCADE COUNTY ATTORNEY S OFFICE PARTNER/FAMILY MEMBER ASSAULT PROSECUTION PLAN

CASCADE COUNTY ATTORNEY S OFFICE PARTNER/FAMILY MEMBER ASSAULT PROSECUTION PLAN CASCADE COUNTY ATTORNEY S OFFICE PARTNER/FAMILY MEMBER ASSAULT PROSECUTION PLAN I. DEFINITIONS A. (a). Partner/Family Member Assault, 45-5-206 MCA, means the following, if committed against a partner or

More information

Certified Digital Forensics Examiner

Certified Digital Forensics Examiner Cyber Security Training & Consulting Certified Digital COURSE OVERVIEW 5 Days 40 CPE Credits $3,000 Digital is the investigation and recovery of data contained in digital devices. This data is often the

More information

Special Topics. Goals and Objectives

Special Topics. Goals and Objectives Special Topics Goals and Objectives 1. Forensic Psychiatric Evaluation To be capable of performing a competent comprehensive forensic psychiatric evaluation whether it is a civil dispute or criminal matter.

More information

FREQUENTLY ASKED QUESTIONS (FAQ s) ABOUT DNA SAMPLES TAKEN AT TIME OF ARREST OR CONVICTION & OPPORTUNITIES FOR EXPUNGEMENT

FREQUENTLY ASKED QUESTIONS (FAQ s) ABOUT DNA SAMPLES TAKEN AT TIME OF ARREST OR CONVICTION & OPPORTUNITIES FOR EXPUNGEMENT 1 FREQUENTLY ASKED QUESTIONS (FAQ s) ABOUT DNA SAMPLES TAKEN AT TIME OF ARREST OR CONVICTION & OPPORTUNITIES FOR EXPUNGEMENT FAQ #1: Am I required to submit a DNA sample in connection with my criminal

More information

Massachusetts Major City Chiefs. Best Practices in Eyewitness Identification and the Recording of Suspect Interviews

Massachusetts Major City Chiefs. Best Practices in Eyewitness Identification and the Recording of Suspect Interviews Massachusetts Major City Chiefs Best Practices in Eyewitness Identification and the Recording of Suspect Interviews September 2010 Introduction In December 2009 the Boston Bar Association published Getting

More information

Overview of Computer Forensics

Overview of Computer Forensics Overview of Computer Forensics Don Mason, Associate Director National Center for Justice and the Rule of Law University of Mississippi School of Law [These materials are based on 4.3.1-4.3.3 in the National

More information

Computer Forensics and What Is, and Is Not, There on Your Client s Computer. Rick Lavaty, Computer Systems Administrator, District of Arizona

Computer Forensics and What Is, and Is Not, There on Your Client s Computer. Rick Lavaty, Computer Systems Administrator, District of Arizona Computer Forensics and What Is, and Is Not, There on Your Client s Computer Rick Lavaty, Computer Systems Administrator, District of Arizona Eddy Archibeque, Computer Systems Administrator, District of

More information

Decades of Successful Sex Crimes Defense Contact the Innocence Legal Team Now

Decades of Successful Sex Crimes Defense Contact the Innocence Legal Team Now Criminal Court Felonies The U.S. has the highest rate of felony conviction and imprisonment of any industrialized nation. A felony crime is more serious than a misdemeanor, but the same offense can be

More information

VI. Preparing for Successful Prosecution

VI. Preparing for Successful Prosecution VI. Preparing for Successful Prosecution Prosecutors at all levels share law enforcement s challenges in successfully bringing often complex identity crime cases to closure. Key challenges cited by members

More information

Computer Forensics: More Places to Look Social Networking & Cell Phone Evidence John R. Mallery

Computer Forensics: More Places to Look Social Networking & Cell Phone Evidence John R. Mallery Computer Forensics: More Places to Look Social Networking & Cell Phone Evidence John R. Mallery Managing Consultant Introduction Wikipedia lists more than 175 social network sites Risks Productivity Issues

More information

Getting Physical with the Digital Investigation Process

Getting Physical with the Digital Investigation Process Getting Physical with the Digital Investigation Process Brian Carrier Eugene H. Spafford Center for Education and Research in Information Assurance and Security CERIAS Purdue University Abstract In this

More information

JURY QUESTIONNAIRE [PLEASE PRINT]

JURY QUESTIONNAIRE [PLEASE PRINT] JURY QUESTIONNAIRE [PLEASE PRINT] BACKGROUND INFORMATION Full name: Date of birth: Any other names you have used: City/Area of residence: Place of birth: Are you a citizen of the United States? Yes No

More information

BRYCE A. FETTER ORLANDO JUVENILE CHARGES ATTORNEY

BRYCE A. FETTER ORLANDO JUVENILE CHARGES ATTORNEY BRYCE A. FETTER ORLANDO JUVENILE CHARGES ATTORNEY People make mistakes, especially young people. Juvenile lawyer Bryce Fetter believes children should get a second chance through rehabilitation rather

More information

Forensic Photographic Comparison Analysis

Forensic Photographic Comparison Analysis Forensic Photographic Comparison Analysis Richard W. Vorder Bruegge, Ph.D. Examiner of Questioned Photographic Evidence FBI Operational Technology Division Forensic Audio, Video and Image Analysis Unit

More information

Child Abduction Unit Request for Investigation Summary

Child Abduction Unit Request for Investigation Summary JESUS RODRIGUEZ ASSISTANT DISTRICT ATTORNEY OFFICE OF THE DISTRICT ATTORNEY COUNTY OF SAN DIEGO BONNIE M. DUMANIS DISTRICT ATTORNEY Child Abduction Unit Request for Investigation Summary San Diego 330

More information

Computer Forensics & Electronic Discovery Setec Investigations offers unparalleled expertise in computer forensics and electronic discovery,

Computer Forensics & Electronic Discovery Setec Investigations offers unparalleled expertise in computer forensics and electronic discovery, Computer Forensics & Electronic Discovery Setec Investigations offers unparalleled expertise in computer forensics and electronic discovery, providing highly personalized, case-specific forensic analysis

More information

THE COURT: You have been selected and sworn to determine the facts and

THE COURT: You have been selected and sworn to determine the facts and 1 THE COURT: You have been selected and sworn to determine the facts and render a verdict in the case of the Commonwealth / 1 of Pennsylvania versus Robert Greene, who is charged with one count of robbery,

More information

Name: State Bar number: Telephone: Fax: Full time SF office address: Mailing address (if different):

Name: State Bar number: Telephone: Fax: Full time SF office address: Mailing address (if different): Lawyer Referral and Information Service 301 Battery Street, Third Floor San Francisco, CA 94111 Telephone: (415) 477-2374 Fax: (415) 477-2389 URL: www.sfbar.org APPLICATION FOR JUVENILE DELINQUENCY LAW

More information