SlideShare una empresa de Scribd logo

Evidence Seizure Sandyb

•
•
CTIN
CTIN
TecnologíaSalud y medicina
1 de 65
Criminal Justice Training Center ,[object Object],[object Object]
High Tech Evidence Collection and Seizure ,[object Object],[object Object]
Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object]
Identification ,[object Object],[object Object],[object Object]
Identification – General Concepts ,[object Object],[object Object],[object Object],[object Object]
Identification – General Concepts You can take everything, take only what is subject to search warrant or you can take only data. But…
Identification – General Concepts ,[object Object],[object Object],[object Object]
Identification – General Concepts ,[object Object],[object Object]
Identification – Types of Evidence ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Identification – Types of Evidence ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Identification – Types of Evidence ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Identification – Where to Look for It ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Identification – Where to Look For It ,[object Object],[object Object],[object Object],[object Object],[object Object]
Identification – Where to Look For It ,[object Object],[object Object]
Sample Evidence – Tower Computer Case
Sample Evidence - Monitor, Keyboard, and Mouse
Sample Evidence - Computer Media/Storage
Sample Evidence - Computer Media/Storage USB pocket disk 32MB IBM Microdrive 1GB, 500/340 MB
Sample Evidence - Computer Media/Storage “ Thumb Drives” up to 128MB “Disk-on-Key” unit
Sample Evidence - Card Readers USB Pocket DigiDrive. Reads multiple media sources, smart cards etc..
Sample Evidence - Magnetic Readers Mini-Mag Magstripe reader (PMR 102)
Sample Evidence - Computer peripherals
Sample Evidence - Flat Plate Scanner
Sample Evidence - Computer Cases
Sample Evidence - Computer Cases
Sample Evidence Area Sometimes they can never be separated from their computer.
Preservation and Collection ,[object Object],[object Object],[object Object]
Preservation ,[object Object],[object Object]
Preservation ,[object Object],[object Object],[object Object]
Preservation ,[object Object],[object Object],[object Object]
Preservation – Fragility of Evidence ,[object Object],[object Object]
Preservation – Fragility of Evidence ,[object Object],[object Object],[object Object],[object Object]
Preservation – Fragility of Evidence ,[object Object],[object Object]
Preservation – Hacker systems When you have a case involving a computer as the object or means of committing a crime, remember that a program running in memory might be the evidence of your crime.
Preservation – Special Environments ,[object Object],[object Object],[object Object]
Preservation – Basic Rules ,[object Object],[object Object]
Preservation – Basic Rules ,[object Object],[object Object],[object Object]
Preservation – Evaluating Conditions ,[object Object],[object Object],[object Object]
Preservation – Evaluating Conditions ,[object Object],[object Object],[object Object]
Preservation – Evaluating Conditions ,[object Object],[object Object]
Preservation – Evaluating Conditions ,[object Object],[object Object],[object Object]
Preservation – Urban Legend? The possible presence of degaussing (magnets) equipment placed in the crime scene by the suspect. Evidence being lost due the presence of large degaussing hardware hidden in a doorway and operated by a wall switch. Hmm,…not likely.
Collection – Chronological Worksheet ,[object Object],[object Object],[object Object]
Collection – Chronological Worksheet ,[object Object],[object Object],[object Object]
Collection - Photographing ,[object Object],[object Object],[object Object]
Collection - Photographing ,[object Object],[object Object]
It is the small stuff that can create problems sometimes…
Collection - Photographing ,[object Object],[object Object]
Someone wanted this one dead…
Collection ,[object Object],[object Object]
Collection If you are seizing more than one computer system first number the computers and then tag the cables and hardware using the computer number.
Collection - Transport ,[object Object],[object Object]
Collection - Transport ,[object Object],[object Object]
Collection - Transport ,[object Object],[object Object]
Collection - Transport ,[object Object],[object Object]
Collection – Golden Rules ,[object Object],[object Object],[object Object],[object Object]
What is ‘Chain of Evidence’? ,[object Object],[object Object]
Maintaining the Chain of Evidence ,[object Object],[object Object],[object Object]
Presenting the Chain of Evidence ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]
Presenting the Chain of Evidence ,[object Object],[object Object],[object Object],[object Object]
Presenting the Chain of Evidence ,[object Object],[object Object],[object Object],[object Object]
Evidence Storage Guidelines ,[object Object],[object Object],[object Object],[object Object],[object Object]
Storage Containers ,[object Object],[object Object],[object Object],[object Object],[object Object]
Summary ,[object Object],[object Object],[object Object]
 

Recomendados

Criminal Investigative Team
Criminal Investigative TeamCriminal Investigative Team
Criminal Investigative TeamCTIN
 
Evidence Seizure Level One
Evidence Seizure Level OneEvidence Seizure Level One
Evidence Seizure Level OneCTIN
 
Investigative Tools and Equipments for Cyber Crime by Raghu Khimani
Investigative Tools and Equipments for Cyber Crime by Raghu KhimaniInvestigative Tools and Equipments for Cyber Crime by Raghu Khimani
Investigative Tools and Equipments for Cyber Crime by Raghu KhimaniDr Raghu Khimani
 
Threats to data and information security
Threats to data and information securityThreats to data and information security
Threats to data and information securityJohn LEE
 
Is Your Data Literally Walking Out the Door-presentation
Is Your Data Literally Walking Out the Door-presentationIs Your Data Literally Walking Out the Door-presentation
Is Your Data Literally Walking Out the Door-presentationMike Saunders
 
The Adam - A process model for digital forensic practice
The Adam - A process model for digital forensic practiceThe Adam - A process model for digital forensic practice
The Adam - A process model for digital forensic practiceDr. Richard Adams
 
Troubleshooting methods of computer peripherals
Troubleshooting methods of computer peripheralsTroubleshooting methods of computer peripherals
Troubleshooting methods of computer peripheralsDevyani Chaudhari
 
Fusing digital forensics, electronic discovery and incident response
Fusing digital forensics, electronic discovery and incident responseFusing digital forensics, electronic discovery and incident response
Fusing digital forensics, electronic discovery and incident responseDr. Richard Adams
 

Recomendados

Criminal Investigative Team
Criminal Investigative TeamCriminal Investigative Team
Criminal Investigative TeamCTIN
 
Evidence Seizure Level One
Evidence Seizure Level OneEvidence Seizure Level One
Evidence Seizure Level OneCTIN
 
Investigative Tools and Equipments for Cyber Crime by Raghu Khimani
Investigative Tools and Equipments for Cyber Crime by Raghu KhimaniInvestigative Tools and Equipments for Cyber Crime by Raghu Khimani
Investigative Tools and Equipments for Cyber Crime by Raghu KhimaniDr Raghu Khimani
 
Threats to data and information security
Threats to data and information securityThreats to data and information security
Threats to data and information securityJohn LEE
 
Is Your Data Literally Walking Out the Door-presentation
Is Your Data Literally Walking Out the Door-presentationIs Your Data Literally Walking Out the Door-presentation
Is Your Data Literally Walking Out the Door-presentationMike Saunders
 
The Adam - A process model for digital forensic practice
The Adam - A process model for digital forensic practiceThe Adam - A process model for digital forensic practice
The Adam - A process model for digital forensic practiceDr. Richard Adams
 
Troubleshooting methods of computer peripherals
Troubleshooting methods of computer peripheralsTroubleshooting methods of computer peripherals
Troubleshooting methods of computer peripheralsDevyani Chaudhari
 
Fusing digital forensics, electronic discovery and incident response
Fusing digital forensics, electronic discovery and incident responseFusing digital forensics, electronic discovery and incident response
Fusing digital forensics, electronic discovery and incident responseDr. Richard Adams
 
Gowtham kumar
Gowtham kumarGowtham kumar
Gowtham kumarvgprasad
 
Evidence Seizure Ctin Version Draft Sent To Sandy For Polishing
Evidence Seizure Ctin Version Draft Sent To Sandy For PolishingEvidence Seizure Ctin Version Draft Sent To Sandy For Polishing
Evidence Seizure Ctin Version Draft Sent To Sandy For PolishingCTIN
 
Presentation1 london
Presentation1 londonPresentation1 london
Presentation1 londonMohammed Ghareeb
 
Ghass clientpresentationver3
Ghass clientpresentationver3Ghass clientpresentationver3
Ghass clientpresentationver3Charlie Easmon
 
Computer Forensics
Computer ForensicsComputer Forensics
Computer Forensicsalrawes
 
Mini clase sobre el acoso escolar
Mini clase sobre el acoso escolarMini clase sobre el acoso escolar
Mini clase sobre el acoso escolarjoneidi francisco tatis olivo
 
Evidence Seizure
Evidence SeizureEvidence Seizure
Evidence SeizureCTIN
 
Hayvan Hakları ve Deney Hayvanları Etiği
Hayvan Hakları ve Deney Hayvanları EtiğiHayvan Hakları ve Deney Hayvanları Etiği
Hayvan Hakları ve Deney Hayvanları Etiğin(i)_ld_e(n) t_U(t)_AI_AR
 
Presentación soraida 4
Presentación soraida 4Presentación soraida 4
Presentación soraida 4dalcris03
 
Day 1 (korean culture)
Day 1 (korean culture)Day 1 (korean culture)
Day 1 (korean culture)'Justine Mae Paloma'​
 
Meetup OpenTech (Openska) - WordPress Expert en 1h !
Meetup OpenTech (Openska) - WordPress Expert en 1h !Meetup OpenTech (Openska) - WordPress Expert en 1h !
Meetup OpenTech (Openska) - WordPress Expert en 1h !Thierry PIGOT
 
Bag and Tag
Bag and TagBag and Tag
Bag and TagCTIN
 
Evidence Seizure Ctin Version Draft
Evidence Seizure Ctin Version DraftEvidence Seizure Ctin Version Draft
Evidence Seizure Ctin Version DraftCTIN
 
Cyber Crime Evidence Collection Ifsa 2009
Cyber Crime Evidence Collection Ifsa 2009Cyber Crime Evidence Collection Ifsa 2009
Cyber Crime Evidence Collection Ifsa 2009University of Southern Mississippi
 
2022-05-12 Live Forensics for Law Enforcement @UniPD
2022-05-12 Live Forensics for Law Enforcement @UniPD2022-05-12 Live Forensics for Law Enforcement @UniPD
2022-05-12 Live Forensics for Law Enforcement @UniPDDavide Gabrini
 
Analysis of digital evidence
Analysis of digital evidenceAnalysis of digital evidence
Analysis of digital evidencerakesh mishra
 
Digital Evidence by Raghu Khimani
Digital Evidence by Raghu KhimaniDigital Evidence by Raghu Khimani
Digital Evidence by Raghu KhimaniDr Raghu Khimani
 
Search & Seizure of Electronic Evidence by Pelorus Technologies
Search & Seizure of Electronic Evidence by Pelorus TechnologiesSearch & Seizure of Electronic Evidence by Pelorus Technologies
Search & Seizure of Electronic Evidence by Pelorus Technologiesurjarathi
 
Introduction To Forensic Methodologies
Introduction To Forensic MethodologiesIntroduction To Forensic Methodologies
Introduction To Forensic MethodologiesLedjit
 
CS6004 Cyber Forensics - UNIT IV
CS6004 Cyber Forensics - UNIT IVCS6004 Cyber Forensics - UNIT IV
CS6004 Cyber Forensics - UNIT IVArthyR3
 
Digital Forensics Workshop
Digital Forensics WorkshopDigital Forensics Workshop
Digital Forensics WorkshopTim Fletcher
 
Cyber forensics 02 mit-2014
Cyber forensics 02 mit-2014Cyber forensics 02 mit-2014
Cyber forensics 02 mit-2014Muzzammil Wani
 

Más contenido relacionado

Destacado

Gowtham kumar
Gowtham kumarGowtham kumar
Gowtham kumarvgprasad
 
Evidence Seizure Ctin Version Draft Sent To Sandy For Polishing
Evidence Seizure Ctin Version Draft Sent To Sandy For PolishingEvidence Seizure Ctin Version Draft Sent To Sandy For Polishing
Evidence Seizure Ctin Version Draft Sent To Sandy For PolishingCTIN
 
Ghass clientpresentationver3
Ghass clientpresentationver3Ghass clientpresentationver3
Ghass clientpresentationver3Charlie Easmon
 
Computer Forensics
Computer ForensicsComputer Forensics
Computer Forensicsalrawes
 
Evidence Seizure
Evidence SeizureEvidence Seizure
Evidence SeizureCTIN
 
Presentación soraida 4
Presentación soraida 4Presentación soraida 4
Presentación soraida 4dalcris03
 
Meetup OpenTech (Openska) - WordPress Expert en 1h !
Meetup OpenTech (Openska) - WordPress Expert en 1h !Meetup OpenTech (Openska) - WordPress Expert en 1h !
Meetup OpenTech (Openska) - WordPress Expert en 1h !Thierry PIGOT
 

Destacado (11)

Gowtham kumar
Gowtham kumarGowtham kumar
Gowtham kumar
 
Evidence Seizure Ctin Version Draft Sent To Sandy For Polishing
Evidence Seizure Ctin Version Draft Sent To Sandy For PolishingEvidence Seizure Ctin Version Draft Sent To Sandy For Polishing
Evidence Seizure Ctin Version Draft Sent To Sandy For Polishing
 
Presentation1 london
Presentation1 londonPresentation1 london
Presentation1 london
 
Ghass clientpresentationver3
Ghass clientpresentationver3Ghass clientpresentationver3
Ghass clientpresentationver3
 
Computer Forensics
Computer ForensicsComputer Forensics
Computer Forensics
 
Mini clase sobre el acoso escolar
Mini clase sobre el acoso escolarMini clase sobre el acoso escolar
Mini clase sobre el acoso escolar
 
Evidence Seizure
Evidence SeizureEvidence Seizure
Evidence Seizure
 
Hayvan Hakları ve Deney Hayvanları Etiği
Hayvan Hakları ve Deney Hayvanları EtiğiHayvan Hakları ve Deney Hayvanları Etiği
Hayvan Hakları ve Deney Hayvanları Etiği
 
Presentación soraida 4
Presentación soraida 4Presentación soraida 4
Presentación soraida 4
 
Day 1 (korean culture)
Day 1 (korean culture)Day 1 (korean culture)
Day 1 (korean culture)
 
Meetup OpenTech (Openska) - WordPress Expert en 1h !
Meetup OpenTech (Openska) - WordPress Expert en 1h !Meetup OpenTech (Openska) - WordPress Expert en 1h !
Meetup OpenTech (Openska) - WordPress Expert en 1h !
 

Similar a Evidence Seizure Sandyb

Bag and Tag
Bag and TagBag and Tag
Bag and TagCTIN
 
Evidence Seizure Ctin Version Draft
Evidence Seizure Ctin Version DraftEvidence Seizure Ctin Version Draft
Evidence Seizure Ctin Version DraftCTIN
 
2022-05-12 Live Forensics for Law Enforcement @UniPD
2022-05-12 Live Forensics for Law Enforcement @UniPD2022-05-12 Live Forensics for Law Enforcement @UniPD
2022-05-12 Live Forensics for Law Enforcement @UniPDDavide Gabrini
 
Analysis of digital evidence
Analysis of digital evidenceAnalysis of digital evidence
Analysis of digital evidencerakesh mishra
 
Digital Evidence by Raghu Khimani
Digital Evidence by Raghu KhimaniDigital Evidence by Raghu Khimani
Digital Evidence by Raghu KhimaniDr Raghu Khimani
 
Search & Seizure of Electronic Evidence by Pelorus Technologies
Search & Seizure of Electronic Evidence by Pelorus TechnologiesSearch & Seizure of Electronic Evidence by Pelorus Technologies
Search & Seizure of Electronic Evidence by Pelorus Technologiesurjarathi
 
Introduction To Forensic Methodologies
Introduction To Forensic MethodologiesIntroduction To Forensic Methodologies
Introduction To Forensic MethodologiesLedjit
 
CS6004 Cyber Forensics - UNIT IV
CS6004 Cyber Forensics - UNIT IVCS6004 Cyber Forensics - UNIT IV
CS6004 Cyber Forensics - UNIT IVArthyR3
 
Digital Forensics Workshop
Digital Forensics WorkshopDigital Forensics Workshop
Digital Forensics WorkshopTim Fletcher
 
Cyber forensics 02 mit-2014
Cyber forensics 02 mit-2014Cyber forensics 02 mit-2014
Cyber forensics 02 mit-2014Muzzammil Wani
 
BASICS OF INVESTIGATION OF CYBER CRIME CASES.pptx
BASICS OF INVESTIGATION OF CYBER CRIME CASES.pptxBASICS OF INVESTIGATION OF CYBER CRIME CASES.pptx
BASICS OF INVESTIGATION OF CYBER CRIME CASES.pptxALISHAARORA31
 
Computer forensics
Computer forensicsComputer forensics
Computer forensicsLalit Garg
 
Digital Evidence - the defence, prosecution, & the court
Digital Evidence - the defence, prosecution, & the courtDigital Evidence - the defence, prosecution, & the court
Digital Evidence - the defence, prosecution, & the courtCell Site Analysis (CSA)
 
computer forensics, involves the preservation, identification, extraction, an...
computer forensics, involves the preservation, identification, extraction, an...computer forensics, involves the preservation, identification, extraction, an...
computer forensics, involves the preservation, identification, extraction, an...pable2
 
Computer forensics powerpoint presentation
Computer forensics powerpoint presentationComputer forensics powerpoint presentation
Computer forensics powerpoint presentationSomya Johri
 
Computer forensics Slides
Computer forensics SlidesComputer forensics Slides
Computer forensics SlidesVarun Sehgal
 
Computer forensics toolkit
Computer forensics toolkitComputer forensics toolkit
Computer forensics toolkitMilap Oza
 
mobile forensic.pptx
mobile forensic.pptxmobile forensic.pptx
mobile forensic.pptxAmbuj Kumar
 

Similar a Evidence Seizure Sandyb (20)

Bag and Tag
Bag and TagBag and Tag
Bag and Tag
 
Evidence Seizure Ctin Version Draft
Evidence Seizure Ctin Version DraftEvidence Seizure Ctin Version Draft
Evidence Seizure Ctin Version Draft
 
Cyber Crime Evidence Collection Ifsa 2009
Cyber Crime Evidence Collection Ifsa 2009Cyber Crime Evidence Collection Ifsa 2009
Cyber Crime Evidence Collection Ifsa 2009
 
2022-05-12 Live Forensics for Law Enforcement @UniPD
2022-05-12 Live Forensics for Law Enforcement @UniPD2022-05-12 Live Forensics for Law Enforcement @UniPD
2022-05-12 Live Forensics for Law Enforcement @UniPD
 
Analysis of digital evidence
Analysis of digital evidenceAnalysis of digital evidence
Analysis of digital evidence
 
Digital Evidence by Raghu Khimani
Digital Evidence by Raghu KhimaniDigital Evidence by Raghu Khimani
Digital Evidence by Raghu Khimani
 
Search & Seizure of Electronic Evidence by Pelorus Technologies
Search & Seizure of Electronic Evidence by Pelorus TechnologiesSearch & Seizure of Electronic Evidence by Pelorus Technologies
Search & Seizure of Electronic Evidence by Pelorus Technologies
 
Introduction To Forensic Methodologies
Introduction To Forensic MethodologiesIntroduction To Forensic Methodologies
Introduction To Forensic Methodologies
 
CS6004 Cyber Forensics - UNIT IV
CS6004 Cyber Forensics - UNIT IVCS6004 Cyber Forensics - UNIT IV
CS6004 Cyber Forensics - UNIT IV
 
Digital Forensics Workshop
Digital Forensics WorkshopDigital Forensics Workshop
Digital Forensics Workshop
 
Cyber forensics 02 mit-2014
Cyber forensics 02 mit-2014Cyber forensics 02 mit-2014
Cyber forensics 02 mit-2014
 
BASICS OF INVESTIGATION OF CYBER CRIME CASES.pptx
BASICS OF INVESTIGATION OF CYBER CRIME CASES.pptxBASICS OF INVESTIGATION OF CYBER CRIME CASES.pptx
BASICS OF INVESTIGATION OF CYBER CRIME CASES.pptx
 
Computer forensics
Computer forensicsComputer forensics
Computer forensics
 
Digital Evidence - the defence, prosecution, & the court
Digital Evidence - the defence, prosecution, & the courtDigital Evidence - the defence, prosecution, & the court
Digital Evidence - the defence, prosecution, & the court
 
computer forensics, involves the preservation, identification, extraction, an...
computer forensics, involves the preservation, identification, extraction, an...computer forensics, involves the preservation, identification, extraction, an...
computer forensics, involves the preservation, identification, extraction, an...
 
Computer forensics powerpoint presentation
Computer forensics powerpoint presentationComputer forensics powerpoint presentation
Computer forensics powerpoint presentation
 
Computer forensics Slides
Computer forensics SlidesComputer forensics Slides
Computer forensics Slides
 
Computer forensics
Computer forensicsComputer forensics
Computer forensics
 
Computer forensics toolkit
Computer forensics toolkitComputer forensics toolkit
Computer forensics toolkit
 
mobile forensic.pptx
mobile forensic.pptxmobile forensic.pptx
mobile forensic.pptx
 

Más de CTIN

Mounting virtual hard drives
Mounting virtual hard drivesMounting virtual hard drives
Mounting virtual hard drivesCTIN
 
Open Source Forensics
Open Source ForensicsOpen Source Forensics
Open Source ForensicsCTIN
 
Encase V7 Presented by Guidance Software august 2011
Encase V7 Presented by Guidance Software august 2011Encase V7 Presented by Guidance Software august 2011
Encase V7 Presented by Guidance Software august 2011CTIN
 
Windows 7 forensics -overview-r3
Windows 7 forensics -overview-r3Windows 7 forensics -overview-r3
Windows 7 forensics -overview-r3CTIN
 
Windows 7 forensics event logs-dtl-r3
Windows 7 forensics event logs-dtl-r3Windows 7 forensics event logs-dtl-r3
Windows 7 forensics event logs-dtl-r3CTIN
 
Msra 2011 windows7 forensics-troyla
Msra 2011 windows7 forensics-troylaMsra 2011 windows7 forensics-troyla
Msra 2011 windows7 forensics-troylaCTIN
 
Windows 7 forensics thumbnail-dtl-r4
Windows 7 forensics thumbnail-dtl-r4Windows 7 forensics thumbnail-dtl-r4
Windows 7 forensics thumbnail-dtl-r4CTIN
 
Windows 7 forensics jump lists-rv3-public
Windows 7 forensics jump lists-rv3-publicWindows 7 forensics jump lists-rv3-public
Windows 7 forensics jump lists-rv3-publicCTIN
 
Time Stamp Analysis of Windows Systems
Time Stamp Analysis of Windows SystemsTime Stamp Analysis of Windows Systems
Time Stamp Analysis of Windows SystemsCTIN
 
Vista Forensics
Vista ForensicsVista Forensics
Vista ForensicsCTIN
 
Mac Forensics
Mac ForensicsMac Forensics
Mac ForensicsCTIN
 
Nra
NraNra
NraCTIN
 
Live Forensics
Live ForensicsLive Forensics
Live ForensicsCTIN
 
Translating Geek To Attorneys It Security
Translating Geek To Attorneys It SecurityTranslating Geek To Attorneys It Security
Translating Geek To Attorneys It SecurityCTIN
 
Edrm
EdrmEdrm
EdrmCTIN
 
Computer Searchs, Electronic Communication, Computer Trespass
Computer Searchs, Electronic Communication, Computer TrespassComputer Searchs, Electronic Communication, Computer Trespass
Computer Searchs, Electronic Communication, Computer TrespassCTIN
 
CyberCrime
CyberCrimeCyberCrime
CyberCrimeCTIN
 
Search Warrants
Search WarrantsSearch Warrants
Search WarrantsCTIN
 
Part6 Private Sector Concerns
Part6 Private Sector ConcernsPart6 Private Sector Concerns
Part6 Private Sector ConcernsCTIN
 
Sadfe2007
Sadfe2007Sadfe2007
Sadfe2007CTIN
 

Más de CTIN (20)

Mounting virtual hard drives
Mounting virtual hard drivesMounting virtual hard drives
Mounting virtual hard drives
 
Open Source Forensics
Open Source ForensicsOpen Source Forensics
Open Source Forensics
 
Encase V7 Presented by Guidance Software august 2011
Encase V7 Presented by Guidance Software august 2011Encase V7 Presented by Guidance Software august 2011
Encase V7 Presented by Guidance Software august 2011
 
Windows 7 forensics -overview-r3
Windows 7 forensics -overview-r3Windows 7 forensics -overview-r3
Windows 7 forensics -overview-r3
 
Windows 7 forensics event logs-dtl-r3
Windows 7 forensics event logs-dtl-r3Windows 7 forensics event logs-dtl-r3
Windows 7 forensics event logs-dtl-r3
 
Msra 2011 windows7 forensics-troyla
Msra 2011 windows7 forensics-troylaMsra 2011 windows7 forensics-troyla
Msra 2011 windows7 forensics-troyla
 
Windows 7 forensics thumbnail-dtl-r4
Windows 7 forensics thumbnail-dtl-r4Windows 7 forensics thumbnail-dtl-r4
Windows 7 forensics thumbnail-dtl-r4
 
Windows 7 forensics jump lists-rv3-public
Windows 7 forensics jump lists-rv3-publicWindows 7 forensics jump lists-rv3-public
Windows 7 forensics jump lists-rv3-public
 
Time Stamp Analysis of Windows Systems
Time Stamp Analysis of Windows SystemsTime Stamp Analysis of Windows Systems
Time Stamp Analysis of Windows Systems
 
Vista Forensics
Vista ForensicsVista Forensics
Vista Forensics
 
Mac Forensics
Mac ForensicsMac Forensics
Mac Forensics
 
Nra
NraNra
Nra
 
Live Forensics
Live ForensicsLive Forensics
Live Forensics
 
Translating Geek To Attorneys It Security
Translating Geek To Attorneys It SecurityTranslating Geek To Attorneys It Security
Translating Geek To Attorneys It Security
 
Edrm
EdrmEdrm
Edrm
 
Computer Searchs, Electronic Communication, Computer Trespass
Computer Searchs, Electronic Communication, Computer TrespassComputer Searchs, Electronic Communication, Computer Trespass
Computer Searchs, Electronic Communication, Computer Trespass
 
CyberCrime
CyberCrimeCyberCrime
CyberCrime
 
Search Warrants
Search WarrantsSearch Warrants
Search Warrants
 
Part6 Private Sector Concerns
Part6 Private Sector ConcernsPart6 Private Sector Concerns
Part6 Private Sector Concerns
 
Sadfe2007
Sadfe2007Sadfe2007
Sadfe2007
 

Último

Assure Ecommerce and Retail Operations Uptime with ThousandEyes
Assure Ecommerce and Retail Operations Uptime with ThousandEyesAssure Ecommerce and Retail Operations Uptime with ThousandEyes
Assure Ecommerce and Retail Operations Uptime with ThousandEyesThousandEyes
 
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxPasskey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxLoriGlavin3
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsSergiu Bodiu
 
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxThe Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxLoriGlavin3
 
Manual 508 Accessibility Compliance Audit
Manual 508 Accessibility Compliance AuditManual 508 Accessibility Compliance Audit
Manual 508 Accessibility Compliance AuditSkynet Technologies
 
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxDigital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxLoriGlavin3
 
Scale your database traffic with Read & Write split using MySQL Router
Scale your database traffic with Read & Write split using MySQL RouterScale your database traffic with Read & Write split using MySQL Router
Scale your database traffic with Read & Write split using MySQL RouterMydbops
 
Decarbonising Buildings: Making a net-zero built environment a reality
Decarbonising Buildings: Making a net-zero built environment a realityDecarbonising Buildings: Making a net-zero built environment a reality
Decarbonising Buildings: Making a net-zero built environment a realityIES VE
 
So einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdfSo einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdfpanagenda
 
Modern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better StrongerModern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better Strongerpanagenda
 
Data governance with Unity Catalog Presentation
Data governance with Unity Catalog PresentationData governance with Unity Catalog Presentation
Data governance with Unity Catalog PresentationKnoldus Inc.
 
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxUse of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxLoriGlavin3
 
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024BookNet Canada
 
Potential of AI (Generative AI) in Business: Learnings and Insights
Potential of AI (Generative AI) in Business: Learnings and InsightsPotential of AI (Generative AI) in Business: Learnings and Insights
Potential of AI (Generative AI) in Business: Learnings and InsightsRavi Sanghani
 
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24Mark Goldstein
 
Emixa Mendix Meetup 11 April 2024 about Mendix Native development
Emixa Mendix Meetup 11 April 2024 about Mendix Native developmentEmixa Mendix Meetup 11 April 2024 about Mendix Native development
Emixa Mendix Meetup 11 April 2024 about Mendix Native developmentPim van der Noll
 
Testing tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examplesTesting tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examplesKari Kakkonen
 
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxMerck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxLoriGlavin3
 
A Framework for Development in the AI Age
A Framework for Development in the AI AgeA Framework for Development in the AI Age
A Framework for Development in the AI AgeCprime
 
Take control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteTake control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteDianaGray10
 

Último (20)

Assure Ecommerce and Retail Operations Uptime with ThousandEyes
Assure Ecommerce and Retail Operations Uptime with ThousandEyesAssure Ecommerce and Retail Operations Uptime with ThousandEyes
Assure Ecommerce and Retail Operations Uptime with ThousandEyes
 
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxPasskey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platforms
 
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxThe Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
 
Manual 508 Accessibility Compliance Audit
Manual 508 Accessibility Compliance AuditManual 508 Accessibility Compliance Audit
Manual 508 Accessibility Compliance Audit
 
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxDigital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
 
Scale your database traffic with Read & Write split using MySQL Router
Scale your database traffic with Read & Write split using MySQL RouterScale your database traffic with Read & Write split using MySQL Router
Scale your database traffic with Read & Write split using MySQL Router
 
Decarbonising Buildings: Making a net-zero built environment a reality
Decarbonising Buildings: Making a net-zero built environment a realityDecarbonising Buildings: Making a net-zero built environment a reality
Decarbonising Buildings: Making a net-zero built environment a reality
 
So einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdfSo einfach geht modernes Roaming fuer Notes und Nomad.pdf
So einfach geht modernes Roaming fuer Notes und Nomad.pdf
 
Modern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better StrongerModern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
 
Data governance with Unity Catalog Presentation
Data governance with Unity Catalog PresentationData governance with Unity Catalog Presentation
Data governance with Unity Catalog Presentation
 
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxUse of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptx
 
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
 
Potential of AI (Generative AI) in Business: Learnings and Insights
Potential of AI (Generative AI) in Business: Learnings and InsightsPotential of AI (Generative AI) in Business: Learnings and Insights
Potential of AI (Generative AI) in Business: Learnings and Insights
 
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
Arizona Broadband Policy Past, Present, and Future Presentation 3/25/24
 
Emixa Mendix Meetup 11 April 2024 about Mendix Native development
Emixa Mendix Meetup 11 April 2024 about Mendix Native developmentEmixa Mendix Meetup 11 April 2024 about Mendix Native development
Emixa Mendix Meetup 11 April 2024 about Mendix Native development
 
Testing tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examplesTesting tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examples
 
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxMerck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
 
A Framework for Development in the AI Age
A Framework for Development in the AI AgeA Framework for Development in the AI Age
A Framework for Development in the AI Age
 
Take control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test SuiteTake control of your SAP testing with UiPath Test Suite
Take control of your SAP testing with UiPath Test Suite
 

Evidence Seizure Sandyb

  • 1.
  • 2.
  • 3.
  • 4.
  • 5.
  • 6. Identification – General Concepts You can take everything, take only what is subject to search warrant or you can take only data. But…
  • 7.
  • 8.
  • 9.
  • 10.
  • 11.
  • 12.
  • 13.
  • 14.
  • 15. Sample Evidence – Tower Computer Case
  • 16. Sample Evidence - Monitor, Keyboard, and Mouse
  • 17. Sample Evidence - Computer Media/Storage
  • 18. Sample Evidence - Computer Media/Storage USB pocket disk 32MB IBM Microdrive 1GB, 500/340 MB
  • 19. Sample Evidence - Computer Media/Storage “ Thumb Drives” up to 128MB “Disk-on-Key” unit
  • 20. Sample Evidence - Card Readers USB Pocket DigiDrive. Reads multiple media sources, smart cards etc..
  • 21. Sample Evidence - Magnetic Readers Mini-Mag Magstripe reader (PMR 102)
  • 22. Sample Evidence - Computer peripherals
  • 23. Sample Evidence - Flat Plate Scanner
  • 24. Sample Evidence - Computer Cases
  • 25. Sample Evidence - Computer Cases
  • 26. Sample Evidence Area Sometimes they can never be separated from their computer.
  • 27.
  • 28.
  • 29.
  • 30.
  • 31.
  • 32.
  • 33.
  • 34. Preservation – Hacker systems When you have a case involving a computer as the object or means of committing a crime, remember that a program running in memory might be the evidence of your crime.
  • 35.
  • 36.
  • 37.
  • 38.
  • 39.
  • 40.
  • 41.
  • 42. Preservation – Urban Legend? The possible presence of degaussing (magnets) equipment placed in the crime scene by the suspect. Evidence being lost due the presence of large degaussing hardware hidden in a doorway and operated by a wall switch. Hmm,…not likely.
  • 43.
  • 44.
  • 45.
  • 46.
  • 47. It is the small stuff that can create problems sometimes…
  • 48.
  • 49. Someone wanted this one dead…
  • 50.
  • 51. Collection If you are seizing more than one computer system first number the computers and then tag the cables and hardware using the computer number.
  • 52.
  • 53.
  • 54.
  • 55.
  • 56.
  • 57.
  • 58.
  • 59.
  • 60.
  • 61.
  • 62.
  • 63.
  • 64.
  • 65.