Documente Academic
Documente Profesional
Documente Cultură
Presented by: Marcus Lawson J.D. President Josiah Roloff ENCE Vice President Global CompuSearch LLC Spokane WA (main office) 509-443-9293 Portland OR 503-542-7448 Sacramento CA 916-760-7362 Palm Springs (San Diego) 760-459-2122
Overview:
Digital evidence is
- Hard drives - Floppy Diskettes - GPS devices - Smart phones - Scanners/copiers/printers - DVDs/CDs - Flash cards/thumb drives - Mobile devices - Gaming devices - Cameras/Camcorders
Its not me! Im being set up! Who is responsible???? Timelines of use (1) how they are done (2) what they reveal
Tools that are validated versus those that are not (Casey Anthony) Examiner qualifications and opinion vs. factual testimony Documentation of findings by the examiner
The answers to the questions should be the same regardless of who is asking them
Case Types
Homicide
Motive: Girlfriends, boyfriends and secret lovers? Motive: Creepy paraphilias? Planning: Buying scuba belts on Ebay? Planning: Studying tide currents in the bay? Timing: Your cell phone will rat you out every time! Case Example : OR vs. Kim
Case Strategies
Fraud
Planning
Methodology
Records/Emails Co-conspirators? United States vs. Havens
Case Strategies
Child Pornography
1. Is it of a child?
2. Is it pornographic?
Web surfing File sharing Possession vs. Receipt vs. Distribution
The Order
What is to be provided by the government (forensic copy) Where the media will be examined and stored (in state) That no contraband will be copied or removed from the forensic image The process to be followed when the case is over
Case Strategies
The Kitchen Sink
Arson : (computer research) Robbery : (recovered CCTV) Vehicular Homicide : (GPS) DUI : (breathalyzer source code) Rape : (communications before or after)
[14] We find it particularly significant that the IP addresses from which the qem and foel websites were created were traced to internet subscribers hundreds of miles away from the Chisms home in Nine Mile Falls, Washington. We have explained that a computer that is connected to the internet can be uniquely identified by its IP number, much like a land-line phone can be uniquely identified by its phone number. See Forrester, 512 F.3d at 510 n.5. Moreover, we have repeatedly recognized the utility of using IP address information to investigate child pornography offenders. CHISM v. WASHINGTON STATE
The affidavit submitted by Marcus Lawson, the president of a computer forensic company that examined Todd Chisms computers similarly admonishes: [T]o have any success as an Internet criminal, regardless of whether one was a thief, a hacker or a child pornography collector, it would be incumbent to use other peoples identities to do so. . . . It is primarily for this reason that relying only on information provided by the user of a credit card that is associated with criminal activity is inherently unreliable. CHISM v. WASHINGTON STATE
Computers communicate on the Internet because of certain protocols. These protocols allow information to be broken down into small packets, transmitted to the computer you choose and then reassembled as the file you intended to send.
IP addresses are globally unique numbers that allow each computer connected to the Internet to have it's own specific address (just like your residence) and really is the only way IP networks around the world can talk with each other without everything becoming a jumbled mess.
File Sharing cases (should have more than one incident) WWW based cases (subscribers and/or server log files of IPs) Credit Card use by itself should not be relied upon (the account information used will typically be correct)
Static vs. Dynamic IP Addresses The date of IP connection to the subject address must coincide with the dates documented for the offense
A search of the American Registry for Internet Numbers (ARIN) online database indicated that IP address 99.68.128.56 is registered to AT&T Internet Services. Results from an administrative subpoena sent to AT&T Internet Services for the date and time the files were downloaded revealed that, at that day and time, the IP address was assigned to the account registered to (the defendants mother), 0000 Summer Wind Drive, Brecksville, Ohio 44141.
Offense
IP number captured
Computer Forensics
If you believe a case might need forensic assistance: STOP all use of the device(s) - Preservation request - Subpoenas sent asap Create forensic copies of all electronic devices - An inexpensive insurance Contact an expert to assist in determining how they can be most helpful
Computer Forensics
Spokane (Main) Office : 509-443-9293 Portland Office : 503-542-7448 Sacramento Office : 916-760-7362 Palm Springs Office : 760-459-2122 www.GCSforensics.com