To secure and cataloq the evidence contained in large computer components, you can use large evidence bags, tape, tags, labels, and other products available from police supply vendors or office supply stores. When qathering products to secure your computer evidence, make sure they are safe and effective to use on computer components. Be cautious when handling any computer component to avoid damaging the component or coming into contact with static electricity,which can destroy digital data. When collecting computer evidence, make sure you use antistatic bags.

Be sure to place computer evidence in a well-padded container. Padding prevents damage to the evidence as you transport it to vour secure evidence locker, evidence room, or computer lab. Save discarded hard disk drive boxes, antistatic bags, and packing material for computer hardware when you or others acquire computer devices.

T h e f o l l o w i n g l i s t i s w h a t y o u n e e d f o r a n i n v e s t i g a t i o n i n v o l v i n g e - m a i l a b u s e :

* A n e l e c t r o n i c c o p y c f t h e o f f e n d i n g e - m a i l t h a t c o n t a i n s m e s s a g e h e a d e r d a t a ; c o n s u l t w i t h y o u r e - m a i l s e r v e r a d m i n i s t r a t o r

* I f a v a i l a b l e , e - m a i l s e r v e r l o g r e c o r d s ; c o n s u l t w i t h y o u r e - m a i l s e r v e r a d m i n i s t r a t o r t o s e e w h e t h e r t h e v a r e a v a i l a b l e

* F o r e - m a i l s v s t e m s t h a t s t o r e u s e r s ' m e s s a g e s o n a c e n t r a l s e r v e r , a c c e s s t o t h e s e r v e r ; c o n s u l t w i t h y o u r e - m a i l s e r v e r a d m i n i s t r a t o r

* F o r e - m a i l s y s t e m s  t h a t  s t o r e  u s e r s ' m e s s a g e s o n a c o m p u t e r a s a n O u t l o o k . p s t o r . o s t f i l e , f o r e x a m p l e , a c c e s s t o t h e c o m p u t e r s o t h a t y o u c a n p e r f o r m a f o r e n s i c a n a l y s i s o n it

* Y o u r p r e f e r r e d c o m p u t e r f o r e n s i c s a n a l y s i s t o o l , s u c h a s F o r e n s i c T o o l k i t o r P r o D i s c o v e r

To differentiate the training and experience law officers have, CTIN has established three levels cf law enforcement expertise: Level i-Acquiring and seizing digital evidence, normallv performed bv a street police officer.

Level 2-Managing high-tech investigations, teaching investigators what to ask for, and understanding computer terminology and what can and can't be retrieved from digital evidence. The assigned detectives usually handle the case.

Level 3-Specialist training in retrieving digital evidence, normally performed bv a data recovery or computer forensics expert, network forensics expert, or Internet fraud investiqatcr. This person might also be qualified to manage a case, depending on his or her background.

Investigators often work as a team to make computers and networks secure in an organization. The computer investigations function is one cf three in a triad that makes up computing security. In an enterprise network environment, the triad consists of the folio wing parts:

* Vulnerability assessment and risk management

* Network intrusion detection and incident response

* Computer investigations

In data recovery, vou don't necessarily need a sterile target drive when restoring the forensics image. Typically, the customer or your companv just wants the data back. The other key difference is that in data recovery, you usually know what you're trying to retrieve. In computer forensics, you might have an idea of what you're searching for, but not necessarily.

Be aware that seme companies that perform computer investigations alsc do data recovery, which is the more well-known and lucrative side cf the business.

Dr. Simson L. Garf Advanced Forensic Fc

inkel cf Basis Technology Corporation recently developed a new open-source acquisition format called _______

Before vcu can start, you need to justify to the person controlling the budget the reason a lab is needed. This justification step requires asking the following questions:

* Whattvpe of computing investigation service is needed fcr your organization? Who are the potential customers for this service, and how will it be budgeted-as an internal operation (police department or company security department, for instance)-or an external operation (a for-profit business venture)?

* How will ycu advertise your services to customers?

* What time-management techniques will you use?

51 Where will the initial and sustaining budget for business operations come from?

1> Certified Computer Crime Investigator (Basic)

2) Cert-f^ed Computer Crime Investigator (Advanced)

3) Certified Computer Forensic Technician (Basic)

4) Certified Computer Forensic Technician (Advanced)

In addition tc workstations and software, all labs should have a wide assortment of cables and spare expansion slot cards. Consider stocking your computer forensics lab with the following peripheral devices:

* 40-pin 18-inch and 36-inch IDE cables, both ATA-33 and ATA-100 or faster

* Ribbon cables for floppy disks

*: Extra SCSI cards, preferably ultra-wide

* Graphics cards, both Peripheral Component Interconnect (PCI) and Accelerated Graphics Port (AGP)

* Extra power cords

* A variety of hard drives (as many as you can afford and in as wide a variety as possible)

* At least two 2.5-inch adapters from notebook IDE hard drives tc standard IDE,.'ATA drives. SATA drives, and so on

* Computer hand tools, such as Phillips and flathead screwdrivers, a socket wrench, and a small flashlight

To update the Registry for Windows XP SP2, you need to perform three tasks. First, back up the Registry in case something fails while vou're modifying automate switching between enabling and disabling writes tc the USB device. Befcre starting these tasks, make sure your workstation is running Windows XP SP2.

it. Second, modify the Registry with the write-protection feature. Third, create two desktop icons to

Small room with true floor-to-ceiling walls Door access with a locking mechanism

Secure container, such as a safe or heavy-dutv file cabinet with a quality padlock Visitor s leg listing all people who have accessed your lab

Eefore you initiate the search and seizure of digital evidence at an incident or crime scene, you must review all the available facts, plans, and objectives with the investigation team vcu have assembled. The goal of scene processing is to collect and secure digital evidence successfully. The better prepared you are, the fewer problems you encounter when you carry out the plan tc collect data.

Keep in mind that digital evidence is volatile. Develop the skills to assess the facts quickly, make vour plan, gather the needed resources, and collect data from the incident or crime scene. In some computing investigations, responding slowly might result in the loss of important evidence for the case.

On Windows and DOS computer systems, the ________ stores information about partitions on a disk and their locations, size, and other important items.

Master Boot Record

The following list describes some available open-source encryption tools:

* TrueCrypt (ww.rruecrypr.org) creates a virtual encrypted volume-a file mounted as though it were a disk drive. Data is encrypted automatically and in real time.

* CrossCrypt (www.scnerrer.cr/crypr/) also creates a virtual encrypted volume and provides filedisk, a command-line utility with options for creating, mounting, dismounting, and encrypting volumes,

* FreeOTFE (cn-the-fly encryption, www. freeotte,org),, like other open-source encryption tools, creates a virtual disk that can encrypt data with several popular algorithms, FreeOTFE can be used in Windows 2000 and XP as well as with PDAs.

Current whole disk encryption tools offer the following features that computer forensics examiners should be aware of:

* Prebcct authentication, such as a single sign-cn password, fingerprint scan, or token (USE thumb drive device)"

* Full or partial disk encryption with secure hibernation, such as activating a password-protected screen saver

* Advanced encryption algorithms, such as AES and IDEA

* Kev management function that uses a challenge-and-response method to reset passwords or passphrases

* A Trusted Flatfcrm Module (TPM) microchip to generate encryption keys and authenticate login

clusters

^

Following is a list of disk drive components:

* Geometry-Gecmetrv refers to a disk's structure of platters, tracks, and sectors.

* Head-The head is the device that reads and writes data to a drive. There's one head per platter.

* Traces-Tracks are concentric circles on a disk platter where data is located..

* Cylinders-A cylinder is a column of tracks on two or more disk platters. Tvpically, each platter has two surfaces: top and bottom. 5: Ssctars-i sector is a section on a track, usually made up of 512 bytes.

When a subject's computer starts, vou must make sure it boots to a forensic floppy disk or CD, because booting to the hard disk overwrites and changes evidentiary data. To do this, vcu access the CMOS setup bv monitoring the subject's computer during the initial bootstrap process tc identify the correct key or keys to use. The bootstrap process is contained in ROM and tells the computer how to proceed. As the computer starts, the screen usually displays the key or keys, such as the Delete key, you press to open the CMOS setup screen. You can also try unhooking the keyboard to force the system to tell you what keys to use. The key you press to access CMOS depends on the computer's BIOS.

If necessary, vou can change the boot sequence so that the OS accesses the CD/DVD drive cr a floppy drive (if available1! before any other boot device. Each BIOS vendor's screen is different, but you can refer tc the vendor's documentation or Web site for instructions on changing the boot sequence

S u p p o s e t h a t d u r i n g a n e x a m i n a t i o n , y o u f i n d a d u l t a n d c h i l d p o r n o g r a p h y . F u r t h e r e x a m i n a t i o n o f t h e s u b j e c t ' s h a r d d i s k r e v e a l s t h a t t h e e m p l o y e e h a s b e e n c o l l e c t i n g c h i l d p o r n o g r a p h y in s e p a r a t e f o l d e r s o n h i s w o r k s t a t i o n ' s h a r d d i s k . I n t h e U n i t e d S t a t e s ,

p o s s e s s i n g c h i l d p o r n o g r a p h y is a c r i m e u n d e r f e d e r a l a n d s t a t e c r i m i n a l s t a t u t e s .

Y o u s u r v e y t h e r e m a i n i n g c o n t e n t o f t h e s u b j e c t ' s d i s k a n d f i n d t h a t h e ' s a l e a d e n g i n e e r f o r t h e t e a m d e v e l o p i n g v c u r c o m p a n y ' s l a t e s t h i g h - t e c h b i c v c l e . H e h a s p l a c e d t h e c h i l d p o r n o g r a p h y i m a g e s i n a s u b f o l d e r w h e r e t h e b i c y c l e p l a n s a r e s t o r e d . B v d o i n g s o , h e h a s

c o m m i n g l e d c o n t r a b a n d w i t h c o m p a n y ' s c o m p e t i t i v e l y s e n s i t i v e d e s i g n p l a n s f o r t h e n e w h i g h - t e c h b i c y c l e . Y o u r d i s c o v e r y p o s e s t w o p r o b l e m s a b o u t h o w t o d e a l w i t h t h i s c o n t r a b a n d e v i d e n c e . F i r s t , y o u m u s t r e p o r t t h e c r i m e t c t h e p o l i c e . M a n y s t a t e s r e q u i r e r e p o r t i ng

e v i d e n c e o f s e x u a l e x p l o i t a t i o n c f c h i l d r e n . T h e s e c o n d p r o b l e m is t h a t y o u m u s t a l s o p r o t e c t s e n s i t i v e c o m p a n y i n f o r m a t i o n . L e t t i n g t h e h i g h - t e c h b i c v c l e i n f o r m a t i o n b e c o m e p a r t c f t h e c r i m i n a l e v i d e n c e m i g h t m a k e i t p u b l i c r e c o r d , a n d t h e d e s i g n w o r k w i l l t h e n be

a v a i l a b l e t o c o m p e t i t o r s . Y o u r f i r s t s t e p is t o n o t i f y y o u r c o r p o r a t e a t t o r n e y t o g e t d i r e c t i o n s o n h e w t o d e a l w i t h t h e c o m m i n g l e d c o n t r a b a n d d a t a a n d s e n s i t i v e d e s i g n p l a n s.

A n e m p l o y e e s u s p e c t e d o f i n d u s t r i a l e s p i o n a g e c a n r e q u i r e t h e m o s t w o r k . A s m a l l c a m e r a m i g h t n e e d t o b e s e t u p t o m o n i t o r h i s c r h e r p h y s i c a l a c t i v i t i e s i n t h e o f f i c e . Y o u m i g h t n e e d t o p l a n t a s o f t w a r e o r h a r d w a r e k e y l o g g e r , a n d y c u n e e d t o e n g a g e t h e

s e r v i c e s o f t h e n e t w o r k a d m i n i s t r a t o r t o m o n i t o r I n t e r n e t a n d n e t w o r k a c t i v i t i e s . I n t h i s s i t u a t i o n , y o u m i g h t w a n t t o r e m o t e l y i m a g e t h e e m p l o y e e ' s d r i v e a n d t h e n u s e F T K R e g i s t r y V i e w e r t o d e t e r m i n e w h a t p e r i p h e r a l d e v i c e s h a v e b e e n a c c e s s e d

B e c a u s e  t h e r e a r e  a  n u m b e r  of  d i f f e r e n t  v e r s i o n s  o f  U N I X  a n d  L i n u x ,  t h e s e  p l a t f o r m s  a r e  r e f e r r e d  t o  a s _______

p l a t f o r m s .

TIFF;

XIF;

F o l l o w t h e s e s t e p s t c r e t r i e v e e - m a i l h e a d e r s u s i n g P i n e f o r U N I X :

1 . S t a r t P i n e b y t y p i n g p i n e a t t h e c o m m a n d p r o m p t a n d t h e n p r e s s i n g E n t e r.

2 . T y p e s t c d i s p l a y t h e s e t u p o p t i o n s .

3 . T y p e c t o c o n f i g u r e t h e e - m a i l c o n f i g u r a t i o n o p t i o n s .

4 . S c r o l l t h e l i s t o f o p t i o n s , a n d t h e n u s e t h e a r r o w k e y s t c h i g h l i g h t t h e [ ] e n a b l e - f u l l - h e a d e r o p t i o n . T h e n t y p e x t c s e l e c t t h e o p t i o n ,

5 . T y p e e t o e x i t c o n f i g u r a t i o n m o d e .

6 . W h e n a s k e d i f y o u w a n t t o s a v e o r c o m m i t t h e c h a n g e s , t y p e y . Y c u r e t u r n t o t h e P i n e m a i n o p t i o n s ,

7 . U s e t h e a r r o w k e y s t o s e l e c t a n e - m a i l m e s s a g e , a n d t h e n s e l e c t O i n t h e o p t i o n s a t t h e b o t t o m o f t h e s c r e e n .

3 . T y p e h t o o p e n t h e e - m a i l h e a d e r f o r t h i s m e s s a g e .

9 . T y p e q t o e x i t P i n e ( a n d y t o c o n f i r m , i f n e c e s s a r y ) .

Copyrightable works include the following categories:

1. literary works;

2. musical works, including any accompanying words;

3. dramatic works, including any accompanying music;

4. pantomimes and choreographic works;

5. pictorial, graphic, and sculptural works;

6. motion pictures and ether audiovisual works;

7. sound recordings; 3. architectural works.