Posts Tagged ‘computer forensics’

Legal Issues with Online Investigations: Some background

Friday, January 15th, 2010

As Executive Director and Senior Counsel of the National Law Center for Children and Families, Richard Whidden is most familiar with laws and precedents related to child pornography—but stresses that investigators of other crimes can take away important information, too. “Much of the case law on electronic evidence comes from child porn cases because those are what prosecutors take on,” Whidden says.

During his webinar, “Legal Issues with Online Investigation,” on Thursday, January 21, Whidden will be discussing a sampling of cases from 2009 that had to do with Internet and computer forensics. One of the primary cases, however, has to do not with child pornography but instead with steroids.

Specifically, U.S. v. Comprehensive Drug Testing, Inc. describes forensic procedures relative to search and seizure of electronically stored evidence. Although it applies to the 9th Circuit Court of Appeals’ jurisdiction, it’s likely that other courts will look to the decision when dealing with their own issues of electronic evidence.

The case also illustrates how the process of e-discovery has evolved over the past 10 years. Typically this is difficult to discuss. As Whidden says, “You could have entire symposiums on how the law has changed over the last 10 years, before you even break out the crystal ball on how it will change over the next 10.”

Notably, law changes according to the technology. “We’ve gone from pornographic images of children, to streaming video of abuse taking place,” says Whidden. “Modes of transmission change. Cell phone technology is much more prevalent now, and will continue to evolve.”

Whidden will cover other legal issues, such as the definition of “possession” of child pornography, procedures related to computer related evidence, search and seizure issues, and the difference between state and federal prosecutions. He will not discuss civil cases, only criminal cases because of the higher burden of proof.

Christa M. Miller is Vere Software’s marketing/public relations consultant. She specializes in law enforcement and public safety and can be reached at christa at christammiller dot com.

Tracing IP Addresses: Some Background

Wednesday, October 14th, 2009
Tools like traceroute show the many data packet paths across the Internet.

Tools like traceroute show the many data packet paths across the Internet.

Everyone uses the Internet, says Gary Kessler, instructor of upcoming “Tracing IP Addresses” webinar—but few people understand how it actually works. And while investigators don’t need to know how the telephone system works to get a warrant for phone records or even wiretapping, the Internet is far more complex–but far more accessible to the investigator.

“Computer forensics starts ‘under the hood’,” he explains. The investigator must know about file allocation tables, storage space on a hard drive or other digital device, and so forth, before being able to use the appropriate tool to recover evidence.

And because the Internet figures into so many forensic examinations—those involving child pornography, cyber bullying and harassment, etc.—it is one of the working parts “under the hood.” “No longer are there standalone computers,” says Kessler, “so conducting online investigations involves the application of some forensic principles.”

Tying digital evidence to individuals

These include both legal and technical aspects. “Investigators need to be able to understand the networking clues left on the computer,” says Kessler, “such as where to look, and how the clues can mislead. For example, the email header doesn’t prove who sent the email, but it can indicate where the email came from.”

In fact, he adds, everything in digital forensics is about finding patterns of behavior. “When taken together, those patterns can lead a reasonable person to what a suspect did,” says Kessler. “Digital forensics provides exculpatory or incriminating information which might take an investigation in a direction it may not otherwise have gone.”

In the case of IP tracing, this can even include geolocation. “An IP address can provide a general location from where an individual accessed email, for example,” says Kessler. “In one homicide investigation, this was key when the suspect denied an email account was his. Not only was the account established as his, but the IP addresses also showed the account being accessed from locations which coincided with his business trip calendar.”

Seeing evidence from every angle

Kessler says there are few misunderstandings about IP address tracing, but that investigators don’t always correctly interpret the evidence. “As an example, a traceroute showing data packets going from Point A to Point B will show a different set of addresses than the packets going back from Point B to Point A,” he explains, “which could be interpreted as a completely different route. The investigator has to know how to interpret the information, which is simply the same route being reported in a different way.”

The takeaways from Kessler’s webinar: how IP addresses relate back to online activities, along with tools that show how addresses relate to Web domains, how the domains relate to individuals, and how IP addresses relate to geographical locations.

In addition, Kessler will cover how criminals use the same tools. “An investigator uses the tools in a criminal case, but a hacker uses them to discover vulnerabilities,” he explains. So in all, while IP address tracing may seem trivial, it is important in any case with a networking component.

Learn more: register for the Tracing IP Addresses webinar today!

Christa M. Miller is Vere Software’s marketing/public relations consultant. She specializes in law enforcement and public safety and can be reached at christa at christammiller dot com.

Image: curiouslee via Flickr