Digital Forensics for Legal Professionals : Understanding Digital Evidence From the Warrant to the Courtroom

Digital Forensics for Legal Professionals provides you with a guide to digital technology forensics in plain English. In the authors’ years of experience in working with attorneys as digital forensics experts, common questions arise again and again: “What do I ask for?” “Is the evidence relevant?” “What does this item in the forensic report mean?” “What should I ask the other expert?” “What should I ask you?” “Can you explain that to a jury?” This book answers many of those questions in clear language that is understandable by non-technical people. With many illustrations and diagrams that will be usable in court, they explain technical concepts such as unallocated space, forensic copies, timeline artifacts and metadata in simple terms that make these concepts accessible to both attorneys and juries. The authors also explain how to determine what evidence to ask for, evidence might be that could be discoverable, and the methods for getting to it including relevant subpoena and motion language. Additionally, this book provides an overview of the current state of digital forensics, the right way to select a qualified expert, what to expect from a qualified expert and how to properly use experts before and during trial. Includes a companion Web site with: courtroom illustrations, and examples of discovery motions Provides examples of direct and cross examination questions for digital evidence Contains a reference of definitions of digital forensic terms, relevant case law, and resources for the attorney Cover......Page 1 Front Matter......Page 2 ISBN: 9781597496438......Page 3 Copyright ......Page 4 Intended Audience......Page 20 Section I: Overview of Digital Forensics......Page 21 Section II: Experts......Page 22 Section III: Motions and Discovery......Page 23 Section IV: Common Types of Digital Evidence......Page 25 Acknowledgments......Page 28 Dedication......Page 29 About the Authors......Page 30 About the Tech Editors......Page 32 1.1 What is Digital Forensics?......Page 35 1.2 What is Digital Evidence?......Page 36 1.3 How Digital Evidence is Created And Stored......Page 37 Summary......Page 41 2.1 Digital Forensics......Page 43 2.1.3 Analysis......Page 44 2.2 A Little Computer History......Page 45 2.3 A Brief History of Computer Forensics......Page 46 2.4 Computer Forensics Becomes Digital Forensics......Page 47 Summary......Page 48 3.1 The Subdisciplines......Page 49 3.2.1 Incident response......Page 50 3.2.3 GPS forensics......Page 51 3.2.5 Social media forensics......Page 52 3.2.7 Digital camera forensics......Page 53 3.2.10 Game console forensics......Page 54 Summary......Page 55 4.1 Who Establishes Best Practices?......Page 57 4.3.1 Volatile data and live forensics......Page 58 4.3.2 Preservation best practices......Page 59 4.3.3 Acquisition best practices......Page 60 4.4 What Really Happens in Many Cases......Page 63 Summary......Page 64 Introduction......Page 65 5.1 What Makes a Tool Forensically Sound?......Page 66 5.2 Who Performs Tool Testing?......Page 67 5.4 Classes of Forensics tools......Page 68 References......Page 70 6.1 Mitigation......Page 73 6.3 Trial Preparation......Page 74 6.4.1 A civil case example......Page 75 6.4.2 Criminal trial example......Page 80 Summary......Page 84 7.1 Why Hire a Digital Forensics Expert?......Page 87 7.2 When to Hire a Digital Forensics Expert......Page 89 Summary......Page 90 8.1 The Computer Expert......Page 91 8.2 The Digital Forensics Expert......Page 93 8.3 A Side-by-Side Comparison......Page 95 8.4.1 What does it mean to “investigate”?......Page 96 Summary......Page 98 9.1 What is an Expert?......Page 99 9.2 Locating and Selecting an Expert......Page 101 9.2.3 What type of case do you have?......Page 102 9.2.4.1 Prequalification questions......Page 103 9.2.6 How can you tell what is a reasonable fee quote?......Page 104 9.3 Certifications......Page 105 9.4 Training, Education, and Experience......Page 106 9.5 The Right Forensic Tools......Page 107 References......Page 108 10.1 General Expectations......Page 109 10.2.1 Sample protocol for evidence collection by a third or opposing party......Page 110 10.4 Court Preparation......Page 113 10.5 Expert Advice......Page 114 Summary......Page 115 11.1 Standards......Page 117 11.2 Training and Experience......Page 118 11.4 Ethics......Page 119 11.5 The Approach to an Examination......Page 120 References......Page 121 12.1.1 Verifiable experience and criminal records......Page 123 12.1.4 Appearance matters......Page 124 Summary......Page 125 13.1 Qualifying an Expert......Page 127 13.1.3 Certifications......Page 128 13.1.6 Education......Page 129 13.2.1 Sample qualification questions......Page 130 Reference......Page 131 14.1 Discovery Motions in Civil and Criminal Cases......Page 135 14.1.1.2 Common challenges in civil cases......Page 136 Summary......Page 137 15.1 Sources of Digital Evidence......Page 139 15.2.1 Discovery motion specifics......Page 140 Summary......Page 143 Introduction......Page 145 16.2 Electronic Discovery in Particular......Page 146 16.4 Getting to the Particulars......Page 147 16.4.4 Where might electronic evidence be stored?......Page 148 16.4.5 Who has control of the electronic evidence you need to collect?......Page 149 16.5 Getting the Electronic Evidence......Page 150 Summary......Page 152 References......Page 153 17.1 An Example of a Simple Consent to Search Agreement......Page 155 17.2 Example of a Simple Order for Expedited Discovery......Page 156 17.3 Example of an Order for Expedited Discovery and Temporary Restraining Order......Page 157 Summary......Page 159 18.1 Common Issues with Video Evidence......Page 161 18.1.2.2 File formats and video programs......Page 162 18.3 Example Discovery Language for Video Evidence......Page 164 Summary......Page 165 19.1 Common Issues with Audio Evidence......Page 167 19.1.3 Audio metadata......Page 168 19.2 Example Discovery Language for Audio Evidence......Page 169 Summary......Page 170 20.1 Legal Issues in Social Media Discovery......Page 171 20.3.1 Sample language to include for Facebook......Page 172 20.4.1 Google blogger example......Page 173 20.5 Online E-Mail Accounts......Page 174 References......Page 175 21.1 The Adam Walsh Child Protection and Safety Act of 2006......Page 177 21.2.2 The second round of discovery......Page 179 References......Page 181 22.1 Internet Service Provider Records or IP Addresses......Page 183 22.1.1.1 Using the ping command......Page 184 22.1.2 Motion language once you know the IP address......Page 186 22.2 Example Language for Web-Based E-Mail Addresses......Page 187 Summary......Page 188 23.1 GPS Tracking Evidence Overview......Page 189 23.1.1 Categories of potential GPS tracking evidence......Page 190 23.2.1 Language for getting a GPS device for examination......Page 191 23.2.2 Language for getting information from a manufacturer about a device......Page 192 Summary......Page 193 24.1 Discovery Issues in Cellular Evidence......Page 195 24.2 Example Language for Call Detail Records......Page 196 Summary......Page 197 25.1 Justifying Extraordinary Expenses......Page 199 25.2 Example Language for an Ex Parte Motion for Expert Funds......Page 201 Summary......Page 202 26.1 Hash Values......Page 205 26.2 How Hash Values are Used in Digital Forensics......Page 206 26.2.1 Using hash values to find hidden files......Page 207 26.2.4 The dangers of court testimony without verification......Page 208 Summary......Page 209 27.1 The Purpose of Metadata......Page 211 27.2.2.2 Browser metadata......Page 212 27.2.3 Document metadata......Page 213 27.2.4 Picture metadata......Page 215 Summary......Page 218 28.1 Thumbnails and the Thumbnail Cache......Page 219 28.2 How Thumbnails and the Thumbnail Cache Work......Page 220 28.2.1 When are these thumbs.db cache files created?......Page 221 28.2.3 Thumbs.db and networked drives......Page 222 28.3 Thumbnails and the Thumbnail Cache as Evidence......Page 223 Reference......Page 226 29.1 How Data is Stored on a Hard Drive......Page 227 29.1.1 Hard drive data storage structure......Page 229 29.2 Deleted File Recovery......Page 231 29.2.1.1 Simple file recovery using forensic software......Page 232 29.2.2.1 File carving......Page 233 29.3.1 Physical destruction......Page 236 Summary......Page 237 Introduction......Page 239 30.2 Fundamental Issues in Forensic Analysis of Timeline......Page 240 30.3 Created, Modified, Accessed......Page 241 Summary......Page 243 31.1 What is Web Caching?......Page 245 31.2 How Internet Browser (Web) Caching Works......Page 246 31.3 Internet (Web) Caching As Evidence......Page 247 Summary......Page 250 32.1 The Purpose of Link Files, How They are Created, and How They Work......Page 251 32.3 Link Files as Evidence......Page 253 32.3.1 Using link files to show that a file was accessed by the user......Page 254 32.3.4 Connecting a deleted file on a computer to a USB device using link file evidence......Page 255 Summary......Page 256 33.1 An Overview of the Cellular Phone System......Page 257 33.2 How Cell Phones Work......Page 261 33.2.1 Anatomy of a Cell Phone Call......Page 262 33.3 Call Detail Records......Page 263 33.4 Call Detail Records as Evidence of Cell Phone Location......Page 264 33.4.1 A Cell Tower Location Example......Page 265 33.5 Enhanced 911 Wireless Location Services......Page 266 33.6 The E911 System Overview......Page 267 Reference......Page 269 34.1 E-mail as Evidence......Page 271 34.2.1 Server-based storage......Page 272 34.2.2 User-based E-mail Storage......Page 273 34.3 Web Mail......Page 275 Reference......Page 276 35.1 Common Forms of Social Networking (Social Media)......Page 277 35.2 Evidence Out in the Open......Page 278 35.4 The Allure of Anonymity......Page 279 35.4.1 Hobby or obsession?......Page 280 35.5.1 Connecting evidence from a device to social media evidence......Page 281 Summary......Page 282 References......Page 283 36.2 How it Works......Page 285 36.2.2 Using a file-sharing program......Page 287 36.3 Privacy and Security Issues with Peer-to-Peer File Sharing......Page 289 36.4.1 Investigating file-sharing networks......Page 290 Reference......Page 293 Introduction......Page 295 37.1 The Fragile Nature of Cellular Evidence......Page 296 37.2 Forensic Acquisition Methods for Cellular Phones......Page 297 37.2.3 Manual examinations......Page 298 37.4 Cell Phone Backup Files......Page 300 37.5 Advanced Cell Phone Data Analytics......Page 301 37.6 The Future of Cell Phone Forensics......Page 302 Summary......Page 303 References......Page 304 38.1.1 Documentation......Page 305 38.1.2 Knowing how your tools work......Page 306 38.2 Using Video and Photo Evidence in Cases......Page 307 38.2.1 Enhancing an image or video......Page 311 38.2.2 Determining the authenticity of a video or image......Page 314 Summary......Page 318 39.1 Databases in Everyday Life......Page 319 39.2.1 What is a database management system?......Page 320 39.2.2 Modern databases......Page 321 39.3 Database Files as Evidence......Page 323 39.5 Data as Evidence......Page 324 Summary......Page 325 40.1 Accounting and Money Management Programs......Page 327 40.3.1 Small business accounting software......Page 328 40.4 Getting the Evidence......Page 329 40.5 Types of Evidence from Financial Software......Page 330 40.7 Other Sources of Financial Evidence......Page 331 Summary......Page 332 41.1 The Culture of Massively Multiplayer Online Role Playing Games (MMORPGs)......Page 333 41.2.1.1 Client-side timeline evidence......Page 336 41.2.2 Content evidence......Page 338 Summary......Page 339 References......Page 340 42.1 An Overview of Global Positioning Systems......Page 341 42.2 An Overview of the Navstar Global Positioning System......Page 342 42.3.1 How geolocation works using GPS......Page 343 42.4 Types of GPS Evidence......Page 344 42.4.2 Track points and track logs......Page 345 42.5.1 Preservation of GPS data......Page 346 42.5.3 Service-based data collection......Page 347 42.6.2 Map errors......Page 348 Summary......Page 350 References......Page 351 Index ......Page 353 Digital Forensics for Legal Professionals is a complete non-technical guide for legal professionals and students to understand digital forensics. In the authors'years of experience in working with attorneys as digital forensics experts, common questions arise again and again:'What do I ask for?''Is the evidence relevant?''What does this item in the forensic report mean?''What should I ask the other expert?''What should I ask you?''Can you explain that to a jury?'This book answers many of those questions in clear language that is understandable by non-technical people. With many illustrations and diagrams that will be usable in court, it explains technical concepts such as unallocated space, forensic copies, timeline artifacts and metadata in simple terms that make these concepts accessible to both attorneys and juries. The book also explains how to determine what evidence to ask for, evidence that might be discoverable, and furthermore, it provides an overview of the current state of digital forensics, the right way to select a qualified expert, what to expect from that expert, and how to properly use experts before and during trial. With this book, readers will clearly understand different types of digital evidence and examples of direct and cross examination questions. It includes a reference of definitions of digital forensic terms, relevant case law, and resources. This book will be a valuable resource for attorneys, judges, paralegals, and digital forensic professionals. Provides examples of direct and cross examination questions for digital evidence Contains a reference of definitions of digital forensic terms, relevant case law, and resources for the attorney Digital Forensics for Legal Professionals provides you with a guide to digital technology forensics in plain English. In the authors' years of experience in working with attorneys as digital forensics experts, common questions arise again and again: "What do I ask for?" "Is the evidence relevant?" "What does this item in the forensic report mean?" "What should I ask the other expert?" "What should I ask you?" "Can you explain that to a jury?" This book answers many of those questions in clear language that is understandable by non-technical people. With many illustrations and diagrams that will be usable in court, they explain technical concepts such as unallocated space, forensic copies, timeline artifacts and metadata in simple terms that make these concepts accessible to both attorneys and juries. The authors also explain how to determine what evidence to ask for, evidence might be that could be discoverable, and the methods for getting to it including relevant subpoena and motion language. Additionally, this book provides an overview of the current state of digital forensics, the right way to select a qualified expert, what to expect from a qualified expert and how to properly use experts before and during trial. Includes a companion Web site with: courtroom illustrations, and examples of discovery motions Provides examples of direct and cross examination questions for digital evidence Contains a reference of definitions of digital forensic terms, relevant case law, and resources for the attorney __Digital Forensics for Legal Professionals__ is a complete non-technical guide for legal professionals and students to understand digital forensics. In the authors’ years of experience in working with attorneys as digital forensics experts, common questions arise again and again: "What do I ask for?" "Is the evidence relevant?" "What does this item in the forensic report mean?" "What should I ask the other expert?" "What should I ask you?" "Can you explain that to a jury?" This book answers many of those questions in clear language that is understandable by non-technical people. With many illustrations and diagrams that will be usable in court, it explains technical concepts such as unallocated space, forensic copies, timeline artifacts and metadata in simple terms that make these concepts accessible to both attorneys and juries. The book also explains how to determine what evidence to ask for, evidence that might be discoverable, and furthermore, it provides an overview of the current state of digital forensics, the right way to select a qualified expert, what to expect from that expert, and how to properly use experts before and during trial. With this book, readers will clearly understand different types of digital evidence and examples of direct and cross examination questions. It includes a reference of definitions of digital forensic terms, relevant case law, and resources. This book will be a valuable resource for attorneys, judges, paralegals, and digital forensic professionals. Digital Forensics for Legal Professionals provides you with a guide to digital technology forensics in plain English. In the authors#x80;#x99; years of experience in working with attorneys as digital forensics experts, common questions arise again and again: "#x80;#x9C;Is the evidence relevant?", "What does this item in the forensic report mean?", "What should I ask the other expert?", "#x80;#x9C;What should I ask you?", #x80;#x9C;"Can you explain that to a jury?". This book answers many of those questions in clear language that is understandable by non-technical people. With many illustrations and diagrams that will be usable in court, they explain technical concepts such as unallocated space, forensic copies, timeline artifacts and metadata in simple terms that make these concepts accessible to both attorneys and juries.The authors also explain how to determine what evidence to ask for, evidence might be that could be discoverable, and the methods for getting to it including relevant subpoena and motion language. Additionally, this book provides an overview of the current state of digital forensics, the right way to select a qualified expert, what to expect from a qualified expert and how to properly use experts before and during trial