Case Portfolio Analysis - Essay Example

Case Portfolio List of potential digital evidence and explanation i. A removable flash drive/disk: This drive can be used as evidence to show any data that was stored in it by Mr. Didit. If this data was shared between several users, then a forensic study of the same can also reveal the destinations of the data with regard to the computers which it was used on. ii. The computer keyboard: This devise is used in typing and keying in computer commands. As such it can be easy to read the fingerprints of the last user forensically. This evidence can be preserved by taking a forensic imaging of the keys. It can also be preserved by totally being stored in a tamper proof material so as to avoid it from being contaminated in any way. iii. Compact Disk: This disk similar to the first evidence could have been used to store data which might have appertained to the pending case. This disk can also be preserved in a tamper proof evidence material/bag while awaiting transportation to the law enforcement agency or pending analysis. iv. The Hard Disk Drive: This material is always used to store all the information in a computer system. As the primary storage source, this evidence could reveal most of the data required in determining this case. In storing this, the data in the drive can be copied to another independent one for precautionary reasons. The disk should also be stored in a tamper proof material awaiting analysis or transfer to the law enforcement agency. v. The telephone: Mr. Didit might have used this phone for his communications and as such this item would be major evidence in the case. The call history should be tapped and stored in a safe and permanent place. Obtaining the call logs will reveal the information he was communicating and the recipients of the same and whether in his communications he talked of child pornography at all. The internal memory of the phone should be able to reveal all the evidence pertaining to this case if there is any made. vi. The computers: Since it is the computers that were mainly used in the major communications, these computers in the office provide crucial evidence as to the validity of the case. Together with their components, they should be analyzed to determine the information in their internal memories and as well be kept safely without being moved by unauthorized personalities. I secured the computers and components and transported the same to the law enforcement authority. vii. The computer mouse: This is used to input specific commands especially when accessing file. The fingerprints of the user can be traced on it which can then be correlated to determine the timing when these commands were sent and by whom. It should also be stored in a tamper proof evidence material/bag. List of non-digital evidence. i. The Newspaper sheet on the floor: In this sheet, evidence relating to published facts about Mr. Didit’s actions and dealings while at widget Corporation could be revealed. ii. The notebook on the desk: Mr. Didit might have written down some of the transactions he had which could then be used to act as evidence in deciding this case. iii. The brochure on the desk: This might contain crucial information about the company and any correspondences which Mr. Didit might have made. The brochure yellow in color might also contain pictures that are pornographic in nature which could serve as evidence against him. Evidence Collection Document EVIDENCE / PROPERTY CUSTODY DOCUMENT The proponent agency for this document is OHMR-PM CONTROL NUMBER 0154-bx MP REPORT CROSS-REFERENCE NUMBER RECEIVING AGENCY Provost Marshals Office LOCATION Ft. Meade, MD 20755 NAME, GRADE AND TITLE OF PERSON FROM WHOM RECEIVED OWNER OTHER Crime Scene ADDRESS (Includes ZIP Code) 3111 Express way, Bowie MD. 20715 LOCATION FROM WHERE OBTAINED Room #8 Bldg. T-3254-L Ft. Mede, Md 20755 REASON OBTAINED Evidence TIME / DATE OBTAINED 1455-1605 March 20, 2013 ITEM NO. QUANTITY DESCRIPTION OF ARTICLES (Include model, serial number, conditions, and any unusual marks or scratches) 1. 2. 3. 1 1 1 Hard disk drive -Toshiba Corporation, S/N 408SA00NA KV3 EC.A, Made in Japan, rectangular in shape color type is silver. Appears to be in very good condition. This drive could contain primary information about the case against Mr. Didit. I will transport this alongside other evidences to a safe in the Company awaiting the Police to take them over. The removable flash drive- This drive is black in color with a string handle. The model is a Transcend model. It is a 4GB drive with a number D33931 on its reverse side. Compact Disk- This is a recordable multi speed disk. It is a 2X~52X Multi speed 80MIN/700 MB. It is from the German Technology and Machinery. It has a marker pen writing on it as “Mine” but, when opened the folders inside reveal pornographic content. Other disks of similar types found on his desk were also taken into custody as evidence. CHAIN OF CUSTODY ITEM NO. DATE RELEASED BY RECEIVED BY PURPOSE OF CHANGE OF CUSTODY 1 22/01/2013 SIGNATURE Dennis Scott SIGNATURE Thomas Branch Seized into evidence NAME, GRADE, TITLE Dennis Scott, Officer NAME. GRADE, TITLE Thomas Branch, Sgt. 2 22/01/2013 SIGNATURE Dennis Scott SIGNATURE Thomas Branch Seized into evidence NAME, GRADE, TITLE Dennis Scott, Officer. NAME. GRADE, TITLE Thomas Branch, Sgt.. 1 03/03/2013 SIGNATURE Thomas Branch SIGNATURE Leslie Marshall Released into evidence NAME, GRADE, TITLE Thomas Branch, Sgt. NAME. GRADE, TITLE Leslie Marshall, LT. 2 03/03/2013 SIGNATURE Thomas Branch SIGNATURE Leslie Marshall Released into evidence NAME, GRADE, TITLE Thomas Branch, Sgt. NAME. GRADE, TITLE Leslie Marshall, LT. 1 & 2 03/04/2013 NAME, GRADE, TITLE Leslie Marshall, LT. NAME. GRADE, TITLE PMO Investigations Released to court for preliminary hearing SIGNATURE Leslie Marshall SIGNATURE PMO investigations Locations outside Mr. Didit’s office i. Widget Corporation server room- At this place, I may be able to find relational data regarding the flow of information over the internet. ii. Widget Corporation’s technical specialist office. iii. The office of Mr. Iam Helpful who is the Human Resource specialist, who also note the behavior in Mr. Didit. List of forensic analysis/examination tools to be used i. Manual review of the materials. ii. Reviewing of the suspect registry for any suspect information iii. Extracting pictures for review and performing searches related to the crime. Summary of court testimony A. The search at Mr. Didit’s office was procedurally conducted in accordance to the requirements of the court. With the help of one Mr. Iam Helpful, I was able to track Mr. Didit’s office. I got permission from the management of Widget Corporation to access his office. I was also armed with a search warrant from the courts that showed that I was authorized to carry out the search for evidence in his office. B. A hash value is a forensic analysis term that is used to refer to the results of a computation (hash algorithm) performed on a sequence of written text, an electronic folder or the entire hard disk drive contents in the determination of the validity of certain information obtained from the evidence collected. The end result is also referred to as a checksum, hashes or hash code. Specifically, these hash values are used to recognize, categorize and filter out any duplicate files i.e. from emails, attachments, and loose files that were obtained from an Electronically Stored Information (ESI) Collection (Chet, 2002). Consequently, the harsh value can also be used to verify that a forensic image or clone was captured effectively. Each of the algorithms of hashing use a totally different kind of specific number of bytes and are designed to produce specific results regardless of the length of the data amount the hash algorithm has been fed with. In the judicial or court arena, the use of this term can signify the manner in which the court assigns unique and specific numbers to the several files or groups of files that it has as evidence for a particular case before it. The most commonly used algorithms are MD5 and SHA. There is an extremely minimal chance that the numerical values generated by these algorithms will be the same even in data that may seem quite similar (Brian, 2002). The general importance of hashing of electronic evidence using hash values is to guarantee their authenticity. Besides this, they are used to determine the integrity of the digital messages or fingerprints, encrypt data and identify any duplication of any files and thus delete the same. Currently, hash values are being adopted by courts as a means of identifying their files (Daniel, 2012). My personal blog. Several reasons come into play when I blog, particularly in the field of digital forensics. My recent case investigations is about the child pornography case in which one Mr. Didit is accused of practicing the same at his office premises in Widget Corporation. I have personally taken up the case and collected several evidences to be presented in court which will clearly show that the accused personally participated in the alleged case. Among my list of evidences are materials I retrieved from his office in which most of them were digital in nature. These will be analyzed by specialists and presented before the court. The take up of this investigation has enhanced my knowledge on analysis and handling of digital forensics. Particularly, I have been able to present evidence that is not adulterated in any way before this honorable court (Daniel, 2012). I wish to note that in this whole collection, preservation and analysis of data process, I was not partial in anyway and as such should not be perceived as a police hack who chose to only report what would help law enforcement and my companys bottom-line in this case. References Brian Carrier. (2002). Defining Digital Forensic Examination and Analysis Tools. In Digital Research Workshop II. Available at: http://www.dfrws.org. Chet Hosmer. (2002). Proving the Integrity of Digital Evidence with Time. International Journal of Digital Evidence, 1(1). Spring . Daniel, L., & Daniel, L. (2012). Digital forensics for legal professionals understanding digital evidence from the warrant to the courtroom. Waltham, MA: Syngress. Read More