Welcome back to the Computer Forensics Path.
Today in Course 4, Module 2,
we're going to be talking about how to make
a preservation request to an Internet service provider,
and we're going to talk about
the rules governing consent searches.
Preservation requests.
These are requests we would make
to an Internet service provider.
The first thing you want to do is you
want to talk to the Internet service provider in
advance and find out
what information they do
collect as part of their regular business.
Because if you're looking for something that they don't
collect as part of their regular business,
you may be wasting
your time serving them with legal process.
Most service providers will talk to you.
It is good to find a point of
contact at these Internet service providers so
that you can talk to somebody
on a regular basis so you're talking to the same person.
You may make a request for them to
preserve this information for 90 days.
The law allows you 90 days,
but they will preserve the information
before you serve them
with legal process to collect the information.
If you go beyond that 90 days
you can ask for an extension.
They can only provide you information that they
already have, in their possession.
You can't request that they preserve future information.
You must have a date range,
a time range, and you must
have an IP address to go with that.
Because IP addresses are usually assigned dynamically,
IP addresses will change during time.
If I have an IP address today at, say,
01:00 PM and you go six months down the road and you
ask for information regarding that IP address,
but you don't have a date and time,
the IP address may now belong to someone else,
and you'll be getting the wrong information.
You have to make sure you have a date and time range,
and an IP address.
You also will need to provide some type
of account or ID number
when you ask for this information.
If you're talking to Facebook,
you're want to have their Facebook ID.
If you're talking to a cell phone provider,
you're going to need to have some type of phone number,
or other identifying information.
But you're going to need all that
to make up this preservation request.
Consent searches.
You probably are going to use a consent search,
if you don't have enough probable cause for a warrant,
that maybe one of the reasons
you may ask for consent search,
if you're just trying to eliminate somebody as a suspect.
If you're dealing with a victim or a witness,
you may just ask for consent to search
their electronic devices rather than
go for legal process.
The one thing you want to remember is you do want
to give them an advisement of their rights,
prior to giving your consent,
and you do want to get this consent in writing.
A verbal consent is not a good idea.
You always want to get your consent in writing,
have them sign a written consent form.
Remember, consent can be withdrawn at any time.
Then the person has to have
the ability to withdraw a consent.
You can't just take their devices back to your office,
and not answer your phone,
so that they can't withdraw a consent.
They have to have the ability to withdraw a consent.
If they do withdraw a consent,
and you haven't found anything,
you must return the property.
If they withdraw a consent and you
have found evidence of a crime,
that evidence will be admissible,
you can hold on to
that device and apply it for legal process,
a search warrant or a subpoena,
to continue searching the device.
You want to be in contact
with your prosecutor and advise them of what's going on,
and follow their advice in these situations.
In our next module,
we are going to talk about search warrants and subpoenas,
and how you write them,
and what they must include.