Electronic Communications Privacy Act
(ECPA) of 1986 

The Electronic Communications Privacy Act of 1986 governs the privacy and disclosure, access, and interception of content and traffic data related to electronic communications.

Requires both parties to consent to the recording of a conversation. 

Basic subscriber information—This information includes name, address, billing information including a credit card number, telephone toll billing records, subscriber’s telephone number, type of service, and length of service. An investigator can obtain this type of information with a subpoena, court order, or search warrant.

Transactional information—This information includes websites visited, email addresses of others with whom the subscriber exchanged email, and buddy lists. An investigator can obtain this type of information with a court order or search warrant.

Content information—An investigator who has a search warrant can obtain content information from retrieved email messages and also acquire unretrieved stored emails.

Real-time access—To intercept traffic as it is sent or received, an investigator needs to obtain a wiretap order.

Law that includes a provision permitting the wiretapping of VoIP calls. 

The Communications Assistance to Law Enforcement Act of 1994 is a federal wiretap law for traditional wired telephony. It was expanded in 2004 to include wireless, voice over packets, and other forms of electronic communications, including signaling traffic and metadata.

/var/log 

This directory has many logs in it. The /var/log/daily.out contains data on all mounted volumes, including the dates they were mounted. This is very important in cases involving stolen data. You can see what devices have been attached and get data from them. This folder includes data on removable media, including serial numbers.

/var/spool/cups

In this folder, you will also find information about printed documents. If you need to know what documents have been printed from this Apple device, this folder can give you that information. This includes the name of the document printed and the user who printed it.

/Library/Receipts 

This folder contains information about system and software updates.This might be of some

interest in investigating malware crimes.

The Wireless Communications and Public Safety Act of 1999 allows for collection and use of “empty” communications, which means nonverbal and nontext communications, such as GPS information.

The USA PATRIOT Act

The USA PATRIOT Act is the primary law under which a wide variety of internet and communications information content and metadata is currently collected. Provisions exist within the PATRIOT Act to protect the identity and privacy of U.S. citizens.

Warrants are not needed when evidence is in plain sight. Courts have held that only the actual owner of a property can grant consent, or someone who has legal guardianship of the owner.  For example, a parent of a minor child can

grant consent to search the child’s living quarters and computers.

Integrated Drive Electronics (IDE) 

Because the data is stored magnetically, the drives are susceptible to magnetic interference. This can include being demagnetized. If a drive has been demagnetized, there is no way to recover the data. You should transport drives in special transit bags that reduce electrostatic interference. This reduces the chance of inadvertent loss of data.

Most SSDs use Negated AND (NAND) gate–based flash memory, which retains memory even without power. Because there are no moving parts, these drives are

usually less susceptible to physical damage than magnetic drives are. The startup time for SSDs is usually much faster than for magnetic storage drives.

First and foremost, it is one-way, not reversible. That means you cannot “unhash” something. The second characteristic is that you get a fixed-length output no matter what input is given. The third is that the algorithm must be collision resistant. A collision occurs when two different inputs to the same hashing algorithm produce the same output (called a hash or digest).

Cryptographic hashes are how many systems, including Microsoft Windows, store passwords. For example, if your password is “password”, then Windows will first hash it, producing something like this:

0BD181063899C9239016320B50D3E896693A96DF

Windows will then store that hash in the SAM (Security Accounts Manager) file in the Windows System directory.

The command prompt in Mac OS is a BASH shell

so you can execute Linux commands.

The GUID Partition Table is used primarily with computers that have an Intel-based processor. It

requires OS X v10.4 or later. Intel-based Mac OS machines can boot only from drives that use

the GUID Partition Table.

As the name suggests, these are logs of system audits. This includes things like user login. Obviously, this can be very interesting forensically. These audits are often not in a human-readable format. However, Guidance software makes an audit log parser for Mac OS

audit logs,

This folder contains swap and sleep image files. If you hibernate your Mac, this directory will

usually occupy more than 5 gigabytes of disk space. This can be a source of important forensic

data.

This folder is what syncs with iCloud. This is where you will find items that have been saved to

iCloud. It should be quite clear that this can be very interesting forensically.

In this folder, you will find a subfolder named app profile. This will contain lists of recently

opened applications as well as temporary data used by applications. Both of these can be very

interesting in a forensic examination.

This is where various users’ files are stored. It is always a good idea to check in this directory to

find out if users have saved data here that could be used as evidence.

As you probably suspect, this folder contains user preferences. This folder even maintains the

preferences of programs that have been deleted. This could be a very valuable place to get

clues about programs that have been deleted from the system.

Recall that in Windows systems, deleting actually just removes a file from the master file table

(MFT) or file allocation table (FAT) and marks those clusters as available. The file’s data is still

there and can be recovered. What happens when a file is deleted on an HFS or HFS+ volume?

Although the details are a bit different, a similar thing occurs. The references to the file are gone

and the clusters might be used and overwritten. But, depending on how soon after the deletion

you attempt to recover data, you may be able to recover some or all of the data. Even if the data

is overwritten, data may still exist in unallocated space and in index nodes. When a file is

deleted in Mac OS, it is moved to the Trash folder—much like the Recycle Bin in Windows. The

Trash is represented on the file system as a hidden folder, .Trash, on the root directory of the file

system.

Data Doctor—This product recovers all Inbox and Outbox data and all contacts data, and has

an easy-to-use interface. Most important, it has a free trial version, but there is a cost for the full

version.  [know this as a spoiler answer]

Forensics for a Windows 10 phone is done in much the same way as forensics for a Windows

10 PC or laptop is done. 

Pwnage—This utility allows you to unlock a locked iPod Touch and is available from

https://pwnage.com/. [know it as a spoiler answer]

.pst (Outlook)
.ost (Offline Outlook Storage)

.mbx or .dbx (Outlook Express)

.mbx (Eudora)

.emi (common to several email clients)

Exchange Server (.edb)

Exchange Public Folders (pub.edb)

Exchange Private Folders (priv.edb)