>> Hey everyone, welcome back to the course.
In the last video, we talked about
the differences between criminal,
civil, and administrative investigations.
We also talked about ETI or Enterprise Theory of
Investigation and why that's being used.
In this video, we're going to wrap up
our discussion in Module 1.
We're going to talk about the federal
>> rules of evidence.
>> We'll also talk about different laws that are
pertinent for forensic investigation,
as well as we'll finally figure out if you didn't know
already what SWGDE stands for.
The federal rules of evidence.
Now this is not an all inclusive list,
these are some of the most common
ones I think you're probably going
to see in some capacity on the exam itself.
However, you want to study
all the federal rules of evidence
just to make sure you're familiar with them.
Some of the key ones there I think you should
memorize off this list are going to be Rule 103,
the rulings on evidence,
as well as Rule 105,
limited admissibility, and
then also Rule 502, attorney-client privilege.
Again, this is not an all inclusive list
and I obviously can't tell you what's
on the exam because I may not know myself.
Again, you just want to make sure you study
the federal rules of evidence all of them.
Different laws that are pertinent for
a digital or computer forensic investigator.
The main one here are going to be Title 18,
United States Code subsection 1030,
which is the Computer Fraud and Abuse Act.
Again, we talked about a little bit earlier as far
as that be that umbrella law
that federal law enforcement agencies might grab you
on if you start hacking
systems that you don't have permission to do.
We also have Title 18,
United States Code subsection 2252A which covers
child pornography and as well as
subsection 2252B that covers misleading domains.
Now, if on the exam you happen to see
something about like 2252
and it just has one of these two listed,
it doesn't differentiate between A or B,
that's probably your answer.
If you see one of those and it says 2252,
that's probably your answer.
Again, I don't know if you're going
to see that on the exam,
but just know that if it's broken down like that,
you might just see it listed in EC council exams.
It's just like the actual subsection 2252
or 5862 or whatever the case might be.
Some other laws are FISMA, GLBA, HIPAA,
SOX, and PCI-DSS is actually standard.
FISMA, that's the Federal
Information Security Management Act.
Basically this one covers federal agencies and
requires them to have an information security plan
in place for their systems.
Here this act just requires them to
annually review it and make sure
that it's still relevant.
GLBA or the Gramm-Leach-Bliley Act.
That requires financial institutions
to protect their customer information.
Think of this one is like the banking one.
If you see this on the exam,
if you see something maybe asking you like which
one covers banking institutions,
focus on this one being the correct answer there.
HIPAA, which we cover like in the CEH material,
so the Certified Ethical Hacker material,
but basically that's just a healthcare one.
HIPAA is designed to help protect patient data,
so not just your
Social Security number or your data of birth,
but also your actual medical record.
Those surgeries you got
or the surgeries that
your grandmother got that sort of stuff.
SOX or Sarbanes-Oxley Act.
This one, if anyone remembers to Enron and
WorldCom scandals from the early 2000s,
this act was passed to help
protective investors, excuse me,
against fraudulent accounting practices in cooperation.
What those scandals that the investors didn't know
and neither did regular people like you or I,
they didn't know that
the companies like Enron
were essentially cooking the books.
SOX was put in place to make
sure there's certain controls.
Basically nowadays, executives have to
sign off on the financial reports and they can
be held criminally liable as well as
civilly liable if there's some issue with
>> those reports.
>> PCI-DSS, as I mentioned,
is a standard which is very beneficial for
smaller companies that aren't doing
the payment card industry that are looking for
just what security stuff should I put in place?
Because I heard it has a lot of good information.
Payment Card Industry Data Security Standard,
that's what it stands for,
then obviously with that name,
it's for the payment card industry,
so companies that are
processing like payment card information,
it sets certain standards that they
have to follow to secure that data.
The 4th Amendment. Basically anyone acting
under the color of government authority,
someone like your federal law enforcement or
your local law enforcement agents basically
specifies that they can't search or seize things without
a warrant from areas where
somebody has a reasonable expectation of privacy.
One thing that people mess up on a lot is they
think that because of the 4th Amendment,
their employer can't come search for stuff.
However, of course, it depends on your state,
but the 4th Amendment only covers
people acting under the color of government authority.
If law enforcement came to
your job and they wanted to search your bag,
they would need a warrant, or
they would need your permission.
Again, this is not legal advice,
so I'm not an attorney, I'm not giving legal advice.
I'll throw that disclaimer in there real quick.
But they they would need
a warrant to search your bag in most cases.
Whereas, like your boss,
if you sign a piece of paper and you
consent for your boss to search it,
your boss can look through your bag without a warrant.
Now we're going to cover warrants in
Module 2 and talk about the different ones.
But just know that the 4th Amendment
is tied into that aspect of it.
The best evidence rule.
Basically here the goal is to
prevent alteration of the digital evidence.
The best evidence is like,
"Hey, it's not altered."
We want to use that original evidence
in the actual court of law.
Now, a duplicate of the evidence is
admissible if it meets one of these criteria.
The original evidence is destroyed in
a fire or flood or other act of nature.
The original evidence is destroyed
in the normal course of business.
As investigators, as we're analyzing evidence,
we may actually destroy some of
it just because it's volatile evidence.
Then the original evidence
is in possession of a third party.
You know that child porn criminal has to her laptop,
has the information on there.
We can't necessarily get to their laptop
but they upload it to their website.
We can access their website,
we can get warrants for that and get
basically the same data but we can't get
actual access to their physical machine.
SWGDE, as we talked
about in the pre-assessment question.
For all these videos,
it's Scientific Working Group on Digital Evidence.
Several standards involved there.
They make organizations follow this well,
companies conducting forensic examinations.
You have to maintain an SLP
document, review it annually.
It has to be accepted by
the general community or the
>> general forensic community.
>> Written copies of technical procedures,
we need those as well.
Then we also would have to use
appropriate hardware and software.
We couldn't just makeup software,
it needs to be stuff that's generally accepted or
approved by the forensic industry.
Then of course, recording all activities for review
or testimony if you need
>> to present it in a court of law.
>> Forensic readiness is along
the lines if you have a business background,
along the lines of lean startup.
We want to make optimal use of our resources.
In this case, optimal use of
the digital evidence in
a potentially limited time frame
with limited investigation cost.
Again, cost being a factor
there and tying that in with like
lean startup methodology of we want to keep costs
low and be innovative on our approach.
Then incident response.
Forensics and incident response tie together.
Incident response, you figured out
something happened and now you want to
actually take a deep dive and figure
out everything that happened,
to how to get in all the stuff.
That's where the forensics would tie into it,
where we're going a deep dive in malware analysis or
taking a deep dive in that data breach
to figure out in the logs,
where exactly they got in,
what vulnerabilities we have,
how can we patch those, etc.
Again, we're not really creating
this course on incident response.
This one is more so along the lines of forensics.
However, just understand that
if you work in incident response,
you're going to be handling forensics in some capacity.
Speaking of forensics, forensic investigator
, what do they do?
They evaluate any damage.
They also identify or recover data.
We plan out what's the evidence we're looking for?
Let's go get it.
Extracting the evidence in a sound manner.
Following best practices and
along with that proper handling of the data,
creating reports off what our findings are,
and then if applicable,
testifying in court and then also staying
abreast of current technologies
and current best practices.
As new forensic tools come out, then,
we want to be on those,
learning those so we can use them on investigations.
Ethics, this common sense stuff.
We want to maintain fairness and integrity at all time.
If we have conflict of interests,
we want to make sure we address that and take
ourselves off the case.
For example, if your grandmother committed a crime,
you would not be the one investigating
that crime necessarily.
Of course we know like
federal law enforcement says, "Hey,
are you willing to do arrest your grandmother
as part of this interview process?"
But keep in mind that they wouldn't be putting you on
occasion of your grandmother because
there's a conflict of interests.
Just a couple quick post assessment question.
Which of these laws or standards protects patient data?
If you guessed answer C, HIPAA, you are correct.
Again, answer A,
Gramm-Leach-Bliley Act is regarding
>> banking institutions,
>> financial institutions to protect their customer data.
Answer B, SOX or
SarbanesâOxley Act is to
protect investors against
fraudulent corporate accounting,
and then answer D is PCI-DSS standard or
Payment Card Industry Data Security Standard
and that one covers protecting cardholder data.
Question number 2, digital
forensic investigators should never document.
Is that true or false?
Well, obviously we know that's false.
We want to document
and as we mentioned throughout the entire course,
a chain of custody document.
In this video, we talked about quite a bit of stuff.
We talked about the federal rules of evidence.
We've talked about different laws and standards,
as well as the 4th Amendment.
We also talked about things like the best evidence rule
and the Scientific Working Group on Digital Evidence.
In the next module,
we're going to jump into Module 2 of
the computer investigation process.
We're going to talk about the pre-investigation,
the investigation phase, as well
as the post-investigation phase.