>> Hey everyone. Welcome back to the course.
In the last video, we talked about some of
the different types of computer crimes we might see,
some different challenges for investigators;
so things like encryption or anti-forensics,
and then also the investigative process.
In this video, we're going to talk about criminal,
civil, and administrative investigations.
Criminal investigations as the name implies.
Everyone probably already figured that this is
talking about a violation of some law.
It can be a local law,
it could be a state law or a federal law,
a province law depending on where you live,
also international law if you've been really bad.
Generally this is going to lead
to for the most part jail time,
it also could lead to fines and possibly both.
With criminal investigations you basically need
to follow some standard forensic process,
so something basically approved by
your particular jurisdiction or
the jurisdiction that you want prosecuted.
You need to make sure that they've
signed off on some type
of digital forensic or
computer forensic investigation process.
One key point is
a formal investigation report it is
required for a criminal investigation,
so you'll definitely want to keep that portion
in mind if you decide to take the CHFI exam.
That is going to be something that you may
see tested in some capacity.
For criminal investigations,
the standard of proof has to be very high.
Basically that beyond a reasonable doubt is what
we prove and the burden
of proof there is on the prosecution.
They have to prove beyond a reasonable doubt
that Joey committed that crime,
so keep that in mind.
We also have civil investigations.
This is just a dispute between two parties,
so it differs from criminal and
the aspect of it's just monetary damages.
Somebody sue somebody and then they get
X amount of dollars in return from the judge.
Now, something else to point out here is
it's not beyond a reasonable doubt,
so you only need to
basically prove the preponderance of truth.
Just a greater than 50 percent showing that, "Yes,
I'm telling the truth Your
Honor," and that way the judge rules in your favor.
A judge or a jury you can
have either one in a civil case.
Then we have administrative investigations.
Basically, these are your internal investigations
by the company or organization.
As you see I have a little logo
from Customs and Border Patrol.
Again, it may or may not be law enforcement related,
but generally it's just going to
be an internal investigation.
A lot of times these actually
turn into criminal investigations.
For example, we want to see
what documents Joey is sending out,
so we start a administrative
investigation and then we realize
that Joey has been stealing
our intellectual property so then we make it criminal.
We refer to law enforcement and we
might even to pursue a civil one at that point too.
We can go ahead and just sue
>> him for stealing that stuff.
>> As I mentioned, these are going to cover
things like policy violations,
threatening behavior; your
sexual harassment type of stuff,
and also corruption, bribery;
things like somebody getting a promotion when they
shouldn't have just because of whatever with the boss.
Just that generalized company
>> related stuff that occurs.
>> Again, a lot of times these
turn into criminal investigations.
What are some of the rules of forensic investigation?
Not in any particular order here
and not a full list by any means,
but basically we want to
limit access to the original evidence.
By that of course we want to make
duplicate copies and then look at those.
We also want to make sure that chain of custody.
That goes back to the limiting access to
the original evidence because
not everyone needs to touch this stuff,
because at at the end of the day
when we get into court we're going to have
to prove who touched it and why.
What was their legitimate reason
for interacting with the evidence?
We'll also record any changes to the evidence.
Actually some of the things we do in
forensics might alter certain data,
so we have to make sure that
we have a solid process in place to
record that type of stuff and be able
to again in a court of law say,
"Well, we had to change it
because this is how this works."
Also, setting standards
for the investigation, so saying,
"Hey, don't run in there,
pull the plug on the computer when it's on."
We want to wait so we can acquire the evidence.
Also knowing your limitations or skills.
An earlier example I mentioned a Mac system.
Maybe I don't know about it, call somebody else.
Know your limitations. Don't say I got
this because then you're going to mess
up the actual case.
Find appropriate people or agencies
that have the resources that you're lacking.
Secure storage. Actually we get the evidence.
We want to obviously store securely
so nobody can come in and mess with it.
We also have to understand the legalities.
As part of the rules of a forensic investigation,
we have to understand what's happening in
the particular jurisdiction that we're working in.
Can we actually even prosecute this thing,
or can we even investigate?
Is it a crime for us to
do certain aspects of the investigation?
Just keep that type of stuff in mind.
Then of course, industry tools.
Staying abreast of what's changing in the industry,
what are the latest tools?
How they function, how are their
beneficial depending on what we're trying to do.
Just keep all that in mind. ETI is another thing.
You'll definitely see in the official materials.
It just stands for enterprise theory of investigation.
Essentially what this does is it takes
a holistic approach to criminal investigations;
a criminal or a civil.
For example, let's just say it's a drug ring.
As an investigator, I see that well this guy over here
pushes a little bit of narcotics but not too much.
Rather than just saying,
well, this is just a onetime thing;
this is just a one drug dealer or whatever,
we actually instead develop a pattern.
We notice, "That guy is
dealing drugs but he knows this guy over here,
and that guy is dealing drugs too."
We start to piece together the organization;
that criminal organization,
and that's what this is all about.
This is helping dismantle
street gangs or higher-level crime gangs.
This is one of the tools that law enforcement
uses to try to dismantle them.
Basically it's not focusing on the one person,
it's focusing on the whole picture.
Different types of evidence.
We've got volatile evidence,
we always want to collect this before
we shut off a machine.
Keep that in mind for your examination.
Do not pull the plug on a machine,
don't do any of that stuff until you've been able
to try to at least acquire the volatile evidence.
Things like the system time,
files that are open,
process information, server or driver information,
the command history, etc.
Then non-volatile evidence,
so things that will stick
around after we cut the power at least for a bit,
so slack space, hidden space swap files,
registry settings, unused partitions, etc.
In this video we talked about several different things.
We talked about criminal,
civil and administrative investigation.
We also went over ETI and what that is,
so again, enterprise theory
of investigation and that's,
that holistic approach to do investigations
to try to take down the entire criminal organization.
In the next video, we're going to talk
about some different laws
that are pertinent as forensic investigators.