Welcome back to the computer forensics path,
Core 6, Module 3.
We're going to talk about recognizing digital evidence.
Digital evidence can best be described as
anything that is capable of holding data.
Of course, we're talking about computers, and tablets,
and cell phones, but we're talking
about routers, watches, cameras,
internal and external devices,
smart devices like refrigerators, televisions,
Nest, Echoes, SD cards,
thumb drives, any devices capable of holding data.
It may not be obvious.
We can see up here on the screen that we need to be
aware of hidden drives.
You can see some of these examples
of flash drives that can be hidden in jewelry,
things that look like keys,
things that look like coins, bracelets, necklaces.
We really need to be aware
that electronic media storage is getting
smaller and smaller and thus more
easy to hide these devices.
Storage items.
Now, these are very small storage items.
This is a micro SD card here in this picture.
It is a terabyte in size, a terabyte.
That's amazing, but scary too.
A micro SD card,
I'm sure everybody knows it's very small.
We could overlook a terabyte of data by
missing one micro SD card.
The other picture depicts a SanDisk thumb drive,
which is like a mini thumb drive.
This also is a very high capacity,
I believe it's 500 gigabytes.
That's crazy, that these devices can be so small yet hold
such a large amount of data and they can
be very easily missed during a search warrant.
You want to make sure you look very
carefully when you're searching your scene.
Computers too are getting smaller.
This is a picture of what they call the atom computer.
It is 1.5 inches wide.
That's how small this thing is.
It's really, really tiny
yet it actually has a quad-core processor in it.
You can see the specification up here.
It supports Windows 10 OS,
it has an HDMI graphics card,
it also has a micro SD card reader,
it has a USB 2 port,
it is 32 gigabytes of flash memory.
It's scary to think.
It has wireless capabilities and yet it's tiny.
It's not much bigger than a standard size thumb drive.
It is a fully functioning computer
capable of running Windows 10.
We do need to be aware that
these types of devices are out
there and be on the lookout for
them when we're executing our search warrants.
Wireless networks.
You definitely want to make sure that you've done
some wireless network scanning
prior to executing a search warrant.
But while you're there,
you definitely want to make sure you can account for
every Internet-capable device in that home or a business.
You do want to scan
the scene for Internet-connected devices.
Again, we want to account for every device that
is capable of connecting to the Internet.
We want to isolate these devices,
get them off the network as soon as possible.
Now there is one exception to this and this
comes into knowing what type
of case you're investigating.
If you're investigating a case that involves
a lot of Cloud storage and you're looking at, say,
a residence and you want to know
what's in their Google Drive or your case
revolves around something that is Cloud storage
or maybe social media-based.
Most users,
their home computers will
auto log into a lot of these accounts.
Now, make sure you're staying
within the scope of your warrant.
But if your warrant does
cover these types of Cloud accounts,
before you break that Internet connection,
you do want to see if you can collect some
live data from these accounts and do
some live imaging and get
information from these Cloud accounts.
That's going to be the only exception on
isolating your devices ASAP,
getting devices off the network.
Again, make sure you stay within
the scope of your legal process.
Know what you can and can't
do and if you have a question,
contact your supervisor or prosecutor.
In our next module,
we're going to talk about
the proper collection of digital evidence.
How we're going to collect this evidence
without altering it.