1 Lars Daniel, EnCE Digital Forensics for Attorneys - Part 2 Experts, Analysis, Challenging Evidence
2 Digital Forensics For Attorneys Part I Overview of Digital Forensics Types of Digital Evidence Acquisition (Collection) and Preservation Part 2 Experts, Evidence and Analysis Understand Forensic Experts vs. Computer Experts Digital evidence: discovery and usage Overview of Digital Forensics Analysis Challenging Digital Evidence
4 Defendant as Expert
5 Why a Forensics Expert? Computer Forensics Expert Should have comparable or better training and experience than the other expert. Should have specific training and experience as a digital forensics expert Should have access to the same tools as the opposing expert Must be able to qualify as a forensic expert in court
7 Technical Expertise Comparison
8 Technical Expertise Comparison
9 Legal Expertise Comparison
10 Investigative Expertise Comparison Computer Experts No training in examination or investigation, as they do not need to. Digital Forensics Expert Digital Forensics Experts Examples: USB Device history, authentication, internet history, data deletion, Peer to Peer cases, etc.
11 Selecting a Digital Forensics Expert
12 Reasonable Costs
14 Forensic Tools Do they have appropriate forensic tools? - Required to perform many digital forensic functions - Computer Forensics (EnCase, FTK) - Cell Phone Forensics (CelleBrite, Paraben, Susteen) - Almost always needed to perform forensically sound acquisitions and examinations.
15 Selecting an Expert: Overview 1. Actual training in digital forensics and sub-disciplines? 2. Digital Forensics certifications? Or just computer based certifications? 3. Actual case experience? 4. Recommendation letters from other professionals, particularly attorneys?
16 Spotting a Problem Expert Attitude: How does the expert interact with your team? 1. Arrogant or superior? 2. Does he or she take the time to explain to properly explain technical concepts in easy to understand language? The Bull Factor 1. If an expert does not have the answer to a question, does he or she try to convince you that they do anyway? 2. Great risk when testifying. 3. Use of jargon to cover up ignorance.
17 Spotting a Problem Expert Appearance Matters 1. Expert should engage with others and dress in a way that conveys professionalism and competence. Aversion 1. Some experts will take cases they should not because they cannot emotionally handle the contents of the evidence. a. Particularly true with sex crimes cases and other defense related cases.
18 Spotting a Problem Expert Does the Examiner Have Time? 1. Does the examiner have time to work the case? Some cases (particularly Child Pornography) can require travel. Is Forensics a second job? Avocation?
19 Expectations of a Forensics Expert Computer Forensics Expert Expected to Anticipate testimony of opposing expert based on the forensic reports and discovery. Duplicate and verify the opposing expert s work. Assist the attorney in preparation for trial Advise the attorney as to the merits of the case in regards to the digital evidence presented.
20 Expectations of a Forensics Expert Computer Forensics Expert Expected to testify if needed as to: Various files on the client s computer. Ownership of the computer and files. Forensic processes used to extract and verify data. Handling and collection of the evidence. Specifics relating to software installed, dates and times of computer activities
22 Analyzing the Case Approaching the case holistically Digital evidence can reach into all corners of a case:» Cell records» » Pictures» Timelines» Internet Activity
23 Analyzing the Case Always work the case like you are the primary examiner. Never assume anything. Check all the points in the case where mistakes are normally made: Chain of custody. Examination standard procedures. RTC verified for all evidence containing clocks. Evidence handling at the scene. Was everything examined. Claims made in the forensics report. Pay particular attention to keyword search results, internet history results, link files, etc. Placing the defendant at the computer.
24 Performing the Analysis Step one: Duplicate the other side s work. Verify the accuracy of their findings Did they represent their findings correctly? How thorough was the examination? Verify the completeness of their report Is everything they found in the report?» Why or why not? Was exculpatory evidence ignored or missed?
25 Establishing a framework for analysis Reading discovery documents Reading the computer forensics reports What claims are being made? What statements were made? What facts support the claims and which do not?
26 What clues can lead to a more thorough digital analysis? Defendant's statements Witness statements Police statements and interviews Call center records Search warrants and subpoenas Other supporting documents Law Enforcement's computer forensics report
27 Case Analysis Examples
28 Document Metadata Example
29 Picture Metadata Example
30 Internet History Before Clearing
31 Internet History After Clearing
32 Challenging the evidence Common mistakes that open digital evidence to challenges Failing to verify clock times Computer Clocks (Real Time Clock Setting) Affects everything related to time lines:» Internet history» s» Computer activity Digital Cameras Affects the metadata inside the digital images.
33 Challenging the evidence Is the evidence in the report allowed by the search warrant? Was a separate warrant obtained for searching the specific computers and devices? Did the language of the warrant restrict the search in any way? Was evidence obtained through a private party under the direction of law enforcement outside the warrant? Did a verbal request to preserve evidence outside a subpoena without subsequent paperwork cause the third party to become an agent and subject to 4 th amendment search restrictions?
34 Challenging the evidence Is there an attempt to place a person at a computer without adequate proof? How can you tell? Did the analyst check for unique user accounts with passwords? Is there evidence anyone else used the computer under that person s account or profile? Was the computer in a common area? Did others know the passwords to the user s account? Was access to the computer restricted by physical boundaries or location?
35 Challenging the evidence Games people play Stating facts out of context Keywords Keyword hits are not always relevant» Murder case example» Hits were found for the keywords murder (156), kidnapping (34), disposal (76), and death (273) on the subject s computer.
36 Challenging the evidence Games people play Stating facts out of context Keywords» Hits were found for the keywords murder (156), kidnapping (34), disposal (76), and death (273) on the subject s computer. Where can these hits come from? Lexicons, thesaurus, and spell check dictionaries News focused web pages (MSN, Newspaper sites, Television sties, CNN, etc.) When is a hit a hit?» Is 156 hits for murder meaningful?
37 Challenging the evidence Games people play Stating facts out of context Internet Searches» Murder case example» Searches were found for the keywords murder, kidnapping, disposal and death on the subject s computer.
38 Google Search Result Riehl World View: Murder, Kidnapping Alleged In Holloway Arrest The arrestee is held in Utrecht and suspected of kidnapping and murder.... Aruba is SURROUNDED by the ideal body disposal mechanism - the ocean k - Cached - Similar pages - Note this #05-624: Jose Padilla Charged With Conspiracy To Murder charges Padilla with conspiracy to murder, kidnap and maim individuals in a... every tool at our disposal in vigorously fighting the war on terrorism, k - Cached - Similar pages - Note this The Agenda Kidnapping, murder, and holding - overpowering the kidnap victim,... Our capabilities and the means at our disposal - our capability of reaching the target k - Cached - Similar pages - Note this David Coltart (Official Website)» Cain Nkala murder Deadly AK47 rifles have become the weapon of choice for thugs involved in murder, kidnapping and torture throughout Zimbabwe.... davidcoltart.com/archive/category/press-reports/cain-nkala-murder - 35k - Cached - Similar pages - Note this Supreme Court of Ohio / Public Information / Case Summaries McKnight was found guilty of the kidnapping, robbery and aggravated murder of 20 -year-old Kenyon College student Emily Murray in November 2000 and the k - Cached - Similar pages - Note this [PDF] Jose Padilla Charged With Conspiracy To Murder Individuals... File Format: PDF/Adobe Acrobat - View as HTML demonstrates that we will use every tool at our disposal in vigorously... violent jihad, which would include acts of murder, kidnapping and maiming,... nefafoundation.org/miscellaneous/featureddocs/u.s._v_padilla_dojpr_ind.pdf - Similar pages - Note this
39 Challenging the evidence Games people play Playing the techie game Technical words no one understands Unallocated space Slack space Browser cache Typed URLs Gnutella and Limewire What does that mean?
40 Challenging the evidence Child porn example (State s forensics report) 35 images depicting child pornography were located on suspects hard drive. Details 1. Images were found in the browser cache at C:\user\documents and settings\internet history\hro5ij (10 images in all) 2. Images were found and extracted from C:\ drive unallocated space. (10 images in all) 3. Images were found in The BearShare Shared folder at C:\user\Program Files\BearShare\Shared (15) When presented with this kind of report, what do you do?
41 Challenging the evidence What does that mean? If it is in the browser cache, does that mean the user did it on purpose?» How browser caching works.
43 Challenging the evidence What the heck is unallocated space?» Unallocated space is areas on the hard drive that are available to store data.» When a file is deleted, it is only marked as deleted, so the old data remains on the hard drive in the unallocated space.» Forensic tools can recover files from this unallocated area of the hard drive.
44 Challenging the evidence Peer to Peer Software: It s in the shared folder right? MAC Times, Multi-select Program Installation (Default Sharing)
47 Challenging the evidence Digital evidence can also be used to Help to establish the whereabouts of the defendant. Was the defendant doing something on the computer that matches his statements about his activities at a certain time? Establish mitigating circumstances Was something going on that can be found on the computer or cell phone that shows this? Disprove pre-meditation in a death penalty case? Real case example: Fake account created after a murder to cover it up, versus before hand.
48 Contact Information: Web: Blog: Phone: Questions? Coming soon: Attorney Resource Center Online Book: Digital Forensics for Legal Professionals May 2011, Syngress Publishing Larry E. Daniel and Lars E. Daniel
Larry E. Daniel, EnCE, DFCP, BCE Digital Forensics for Attorneys - Part 2 Experts, Analysis, Challenging Evidence Digital Forensics For Attorneys Part I Overview of Digital Forensics Types of Digital Evidence
Larry E. Daniel, EnCE, DFCP, BCE Digital Forensic Examiner Digital Forensics for Attorneys An Overview of Digital Forensics About Your Presenter EnCase Certified Examiner (EnCE) Digital Forensics Certified
Lars Daniel,, EnCE, ACE, CTNS Digital Forensic Examiner Digital Forensics for Attorneys Overview of Digital Forensics Digital Forensics For Attorneys Overview of Digital Forensics Types of Digital Evidence
Digital Forensics Larry Daniel Introduction A recent research report from The Yankee Group found that 67.6 percent of US households in 2002 contained at least one PC The investigators foresee three-quarters
1 Cell Phone Forensics For Legal Professionals Lars E. Daniel, EnCE, ACE, AME, CTNS, SCE, SCCM, SCA Digital Forensics Examiner Cell Phone Acquisition and Examination Collection and Acquiring Cell Phones
Computer Forensic Capabilities Agenda What is computer forensics? Where to find computer evidence Forensic imaging Forensic analysis What is Computer Forensics? The preservation, identification, extraction,
Cell Phone Forensics For Legal Professionals Lars Daniel, EnCE, ACE, CTNS Cell Phone Acquisition and Examination Collection and Acquiring Cell Phones Unique Preservation Issues Phone must be isolated from
Digital Forensic Techniques Namrata Choudhury, Sr. Principal Information Security Analyst, Symantec Corporation Professional Techniques T23 CRISC CGEIT CISM CISA AGENDA Computer Forensics vs. Digital Forensics
Computer Forensics and Digital Investigation Computer Security EDA263, lecture 14 Ulf Larson Lecture outline! Introduction to Computer Forensics! Digital investigation! Conducting a Digital Crime Scene
Sexual Assault What is assault? Assault is when someone uses force to hurt you. Slapping, kicking and pushing can be assault. Sometimes touching can be an assault. Threatening or trying to hurt someone
Justice WA YOUR NAME: YOUR CONTACT DETAILS (ADDRESS, PHONE, EMAIL etc.): TODAY S DATE: INDICATE WHO IS COMPLETING THIS FORM: Defendant Family Member of Defendant (Relationship : ) Friend of Defendant Other:
Community Legal Information Association of PEI, Inc. Sexual Assault As an adult in Canada, you have the right to choose when or if you engage in sexual activity. Sexual activity without your consent is
A Victim s Guide to Understanding the Criminal Justice System The Bartholomew County Prosecutor s Office Victim Assistance Program Prosecutor: William Nash 234 Washington Street Columbus, IN 47201 Telephone:
Digital Forensics Dr. Vic Fay-Wolfe Department of Computer Science University of Rhode Island Topics What is Digital Forensics? Cases Digital Forensics Practice Algorithms and Computer Sci Digital Forensics
Breakfast Meeting: Securing your Secured Data Digital Forensics, Fraud and Forensic Advancements 9 April 2013 Facilitator: Dr. Sheau-Dong Lang, Coordinator Master of Science in Digital Forensics University
The Legal Argument 1 firstname.lastname@example.org Abstract This paper addresses digital forensic analysis tools and their use in a legal setting. To enter scientific evidence into a United States court, a
Criminal Investigation CRJ141 Matthew McCarty Chapter 1 Criminal Investigation: An Overview CSI Effect The exaggerated depiction of how television forensic science operates, creating a phenomenon in which
To Catch a Thief: Computer Forensics in the Classroom Anna Carlin email@example.com Steven S. Curl firstname.lastname@example.org Daniel Manson email@example.com Computer Information Systems Department California
EC-Council Ethical Hacking and Countermeasures Description This class will immerse the students into an interactive environment where they will be shown how to scan, test, hack and secure their own systems.
CÔNG TY CỔ PHẦN TRƯỜNG CNTT TÂN ĐỨC TAN DUC INFORMATION TECHNOLOGY SCHOOL JSC LEARN MORE WITH LESS! Computer Hacking Forensic Investigator v8 Course Description: EC-Council releases the most advanced Computer
Stages in a Capital Case from http://deathpenaltyinfo.msu.edu/ Note that not every case goes through all of the steps outlined here. Some states have different procedures. I. Pre-Trial Crimes that would
Victims of Crime Act PURPOSE Recognizing the state's concern for victims of crime, it is the purpose of the Victims of Crime Act [31-26-1 NMSA 1978] to assure that: A. the full impact of a crime is brought
Certified Digital Forensics Examiner Course Name: CDFE V6.0 Duration: Language: 5 days English Format: Instructor-led (Lecture and Lab) Prerequisite: Experience in using a computer Student Materials: Student
Digital Forensics & e-discovery Services U.S. Security Associates Digital Forensics & e-discovery Services 21st century fraud investigations require expert digital forensics skills to deal with the complexities
Certified Digital Forensics Examiner Course Name: CDFE V6.0 Duration: Language: 5 days English Format: Instructor-led (Lecture and Lab) Prerequisite: Experience in using a computer Student Materials: Student
Digital Forensics & e-discovery Services Andrews International Digital Forensics & e-discovery Services 21st century fraud investigations require expert digital forensics skills to deal with the complexities
The Rights of Crime Victims in Texas 1 Housekeeping Please turn off cell phones and pagers or place in a silent mode. Questions can be answered in presentations or during break. 2 Constitutional Rights
NAVIGATING THE CRIMINAL AND CIVIL PROCESS IN CHILD ABUSE AND NEGLECT CASES LORI FLUEGEL ASSISTANT PROSECUTING ATTORNEY JACKSON COUNTY OBJECTIVES UNDERSTANDING OF THE CRIMINAL AND CIVIL PROCESS OF CHILD
BDO CONSULTING FORENSIC TECHNOLOGY SERVICES MARCH 2013 AGENDA Introduction About BDO Consulting Computer Forensics & E-Discovery Practice Current Trends Case Studies Q&A Page 2 Michael Barba Managing Director,
Sensitive Incident Investigations. Digital Risk Management. Forensics Testing. 2009 Innovation Award Winner Austin Chamber of Commerce 2010 Innovation Award Finalist Austin Chamber of Commerce Only private
What is computer forensics? The preservation, recovery, analysis and reporting of digital artifacts including information stored on computers, storage media (such as a hard disk or CD-ROM), an electronic
The Criminal Justice System The Police I. The Police a. More than 725,000 police across the country b. Local, state and national levels c. Protect, maintain peace & order, investigate, arrest, and book
Computer Forensics Processing Checklist Pueblo High-Tech Crimes Unit Cmdr. Dave Pettinari Pueblo County Sheriff's Office firstname.lastname@example.org The purpose of this document is to provide computer forensic technicians
Use Case SOLVING VIOLENT CRIMES WITH A UNIFIED WORKFLOW In a Violent Home Invasion Investigation, the UFED Series Seamlessly Unifies Workflows from Field to Lab A series of violent home invasions has everyone
The Witness and the Justice System in Alberta Introduction This booklet provides basic information about appearing as a witness in the courts of Alberta. It is designed to explain your role as a witness,
REPRESENTING THE ACCUSED COP KILLER (Lessons from the Trenches) STATE OF ALABAMA VS. MARIO DION WOODWARD 03-CC-2007-1388-TMH (Mont. Co. Cir. Court) I. PUBLICITY: Joseph P. Van Heest, Esq., Richard K. Keith,
IN THE SUPREME COURT OF THE STATE OF DELAWARE ORLANDO INGRAM, No. 460, 2014 Defendant Below, Appellant, Court Below: Superior Court of the State of Delaware in v. and for Kent County STATE OF DELAWARE,
System Overview ~~~~~ Presented by: Darcie McElwee SYSTEM OVERVIEW OBJECTIVES Upon conclusion of this module the participant will be able to: Describe the overall structure, case flow process, and roles
GETTING THROUGH THE CRIMINAL JUSTICE SYSTEM ARREST An ARREST starts the criminal justice process. It is called an arrest whether the police officer hands you a summons or puts handcuffs on you and takes
Attachment No. 2 Proposed Plain Language Revisions to Colorado Criminal Jury Instruction Chapter 1:04 and Chapter 3 The work of the Plain Language Subcommittee is set forth below. For comparison, the redrafted
WILLIAM OETTINGER PHONE (702) 292-4645 WOETTINGER@GMAIL.COM SUMMARY OF QUALIFICATIONS Veteran investigator in a traditional and computer-related environment. A leader experienced in organizing, directing,
Unit 8 (2 weeks) SECTIONS Don t do the crime if you do not want to serve the time! 1. Causes of crimes (2 Days) 2. Crime classification (2 Days) 3. Criminal defenses (2 Days) 4. Criminal justice procedures
MODEL CRIMINAL DEFENSE MENTORING PROGRAM Utah State Bar New Lawyer Training Program The following is submitted as a Model Mentoring Plan for the criminal defense practice field. It was prepared by an experienced
DNA & CRIME VICTIMS: WHAT VICTIMS NEED TO KNOW DNA & CRIME VICTIMS: What Victims Need to Know The increasing use of DNA evidence in criminal cases gives victims of crime new hope that offenders will be
Franklin County State's Attorney Victim Services FREQUENTLY ASKED QUESTIONS What type of services and information can I get through Victim Services Program? A Victim Advocate will be assigned to assist
Forensic Toolkit Sales and Promotional Summary ACCESSDATA, ON YOUR RADAR What is AccessData s Forensic Toolkit? Also known as FTK, this application enables you to perform complete and thorough computer
DataTriangle, Inc. is uniquely structured to provide you with a high quality expert as expeditiously as possible. Charles Snipes has nearly 15 years of experience with criminal investigations in the areas
Introduction to Data Forensics Jeff Flaig, Security Consultant January 15, 2014 WHAT IS COMPUTER FORENSICS Computer forensics is the process of methodically examining computer media (hard disks, diskettes,
HOW A TYPICAL CRIMINAL CASE IS PROSECUTED IN ALASKA The Office of Victims Rights receives many inquiries from victims about how a criminal case in Alaska is investigated by police and then prosecuted by
Teacher Assessment Blueprint Test Code: 5269 / Version: 01 Copyright 2010 NOCTI. All Rights Reserved. General Assessment Information Blueprint Contents General Assessment Information Written Assessment
I. Some Key Considerations In Whether To Engage An E-Discovery Vendor (Or Vendors) A. It is difficult to decide whether to retain a vendor if you don t know what your organization can do and at what cost.
Live Forensic Acquisition as Alternative to Traditional Forensic Processes Marthie Lessing* Basie von Solms Introduction The Internet and technology developments introduced a sharp increase in computer
Evidentiary Issues in Domestic Cases: An Overview Introduction A. Importance of legal representation in cases that involve domestic violence. B. History of protection order laws and implications for evidence.
Being a Witness What is a witness? A witness is a person who is required to come to court to answer questions about a case. The answers a witness gives in court are called evidence. Before giving evidence,
Victim Witness Assistance Program of Santa Clara County Kasey Halcón Director Case Study Law enforcement responds to a domestic disturbance. The officer enters the home and a woman is crying on the couch,
Sponsored by ediscovery: The New Information Management Battleground Developments in the Law and Best Practices Kahn Consulting Inc. (847) 266-0722 email@example.com Introduction The following
Law Enforcement Incident Response to Cybercrimes & Battling Current Technological Trends Corey J. Bourgeois, Computer Forensic Examiner & David Ferris, Investigator Louisiana Department of Justice HTCU
Juvenile Offenders Crime Victims Rights Law Enforcement Responsibilities Crime Victims Rights when involving a Juvenile Offender are the same as if the offender were an adult in cases of -- felony grade
the best defense Exclusively Criminal Defense Former Los Angeles Prosecutors Immediate Response 24/7 AGGRESSIVE DEFENSE IN STATE AND FEDERAL COURTS R a t e d t o p 5 % U. S. L a w F i r m AGGRESSIVE DEFENSE
STATE OF TEXAS VS JANE DOE VOIR DIRE 1. CONVERSATION - ONLY TIME YOU CAN ASK THE LAWYERS QUESTIONS 2. NO RIGHT OR WRONG ANSWER 3. DESELECTION (TO MAKE THE JURY = SIT THERE & BE QUIET) 4. SOME QUESTIONS
SUMMARY OF RULES AND STATUTES REGARDING BAIL FOR INDICTABLE OFFENSES Rule or Statute Rule3:3-1. Determination on whether to issue a Summons or Warrant Description The Rule provides that a summons shall
Authentication of Cell Phone Text Messages By Pierre Grosdidier Parties seeking to admit cell phone text messages at trial face two authentication challenges. They must show that the documents they seek
What is DOMESTIC VIOLENCE? Domestic violence is a pattern of control used by one person to exert power over another. Verbal abuse, threats, physical, and sexual abuse are the methods used to maintain power
Digital Forensics Case Study Using metadata to prove a case Challenge: Forensically collect and investigate digital files for a complex employment case with noncompete covenants and trade secrets at stake.
CASCADE COUNTY ATTORNEY S OFFICE PARTNER/FAMILY MEMBER ASSAULT PROSECUTION PLAN I. DEFINITIONS A. (a). Partner/Family Member Assault, 45-5-206 MCA, means the following, if committed against a partner or
Cyber Security Training & Consulting Certified Digital COURSE OVERVIEW 5 Days 40 CPE Credits $3,000 Digital is the investigation and recovery of data contained in digital devices. This data is often the
Special Topics Goals and Objectives 1. Forensic Psychiatric Evaluation To be capable of performing a competent comprehensive forensic psychiatric evaluation whether it is a civil dispute or criminal matter.
Massachusetts Major City Chiefs Best Practices in Eyewitness Identification and the Recording of Suspect Interviews September 2010 Introduction In December 2009 the Boston Bar Association published Getting
Overview of Computer Forensics Don Mason, Associate Director National Center for Justice and the Rule of Law University of Mississippi School of Law [These materials are based on 4.3.1-4.3.3 in the National
Computer Forensics and What Is, and Is Not, There on Your Client s Computer Rick Lavaty, Computer Systems Administrator, District of Arizona Eddy Archibeque, Computer Systems Administrator, District of
VI. Preparing for Successful Prosecution Prosecutors at all levels share law enforcement s challenges in successfully bringing often complex identity crime cases to closure. Key challenges cited by members
Computer Forensics: More Places to Look Social Networking & Cell Phone Evidence John R. Mallery Managing Consultant Introduction Wikipedia lists more than 175 social network sites Risks Productivity Issues
Getting Physical with the Digital Investigation Process Brian Carrier Eugene H. Spafford Center for Education and Research in Information Assurance and Security CERIAS Purdue University Abstract In this
Forensic Photographic Comparison Analysis Richard W. Vorder Bruegge, Ph.D. Examiner of Questioned Photographic Evidence FBI Operational Technology Division Forensic Audio, Video and Image Analysis Unit
1 THE COURT: You have been selected and sworn to determine the facts and render a verdict in the case of the Commonwealth / 1 of Pennsylvania versus Robert Greene, who is charged with one count of robbery,
Lawyer Referral and Information Service 301 Battery Street, Third Floor San Francisco, CA 94111 Telephone: (415) 477-2374 Fax: (415) 477-2389 URL: www.sfbar.org APPLICATION FOR JUVENILE DELINQUENCY LAW