You have been asked to assist a law enforcement team serving a search warrant re

Question

You have been asked to assist a law enforcement team serving a search warrant related to a child pornography investigation. You are the digital forensic expert for the team, and, as such, have been assigned the task of identifying and collecting the digital evidence at the search location. A. What steps should you take before the search? B. For what types of evidence should you be alert when searching the residence? C. What types of items would you seize?

This is for a Digital forensics in the criminal justice system class.

Explanation / Answer

A) We would not need a search warrant when a person with proper authority gives consent to conduct the search (e.g., the company CEO gives permission to search company servers for company data). Exigent circumstances could come into play in a digital evidence case when (for example) the owner of a computer likely containing digital evidence knows of the investigation and could delete the evidence from his storage devices before a warrant could be obtained. However, while the storage devices could most likely be seized without a warrant to prevent data destruction, this exigent circumstance is not a valid reason to conduct a forensic analysis of the storage media and a warrant should be obtained immediately.
B) Evidence to be collected are-Laptops , Mobiles and other storage devices.There are other tools that are available and should be part of your toolbox. Once you have properly identified and collected digital evidence, the next step is to analyze it. It does not really matter if you are performing analysis as part of a criminal investigation or as part of a corporate investigation; you should always follow the same protocols. An emphasis in this course is on helping you understand why using an analysis protocol is important. Remember, you should NEVER, EVER work on original evidence, if it can be avoided by any means; instead, use a forensic image. When you work on the image, you pick the tools you will use. Again, it does not matter which tool you actually use, as long as the tool is accepted by the forensic community, and you are able to testify to the tool’s validity, as well as the process you used in your examination.
During your analysis, you should document every step you take and all of your findings. Some tools have a report function that works well to capture both the identified data and the date/time of your various analyses. However, this should always be supplemented with your own notes and documentation.
C) Items to sieze are-Harddisks, CD's,External Storage.

Related Questions

Navigate

• Browse (All)
• Browse Y
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.