>> Hey, everybody. Welcome back to the course.
In the last video, we wrapped up our module 1 lab.
We looked at a couple different image files.
Now, again, that's a fun little lab
to show your family and friends.
In this video, we're going to talk about
the different phases of investigations.
Just a quick pre-assessment question.
Securing the forensic scene would be
in the post-investigation phase.
Was that true or false?
The answer is false there.
Obviously,
>> if we're starting off and securing the scene,
>> we're not going to be already
in the post investigation phase.
We haven't even conducted our investigation yet.
Speaking of phases, we've got the pre-investigation,
the investigation, and then as we
mentioned, the post-investigation stage.
The pre-investigation phase,
this is where we're doing that initial work.
We're planning our budget for investigations,
we set up our forensic lab,
or if we worked for
a large organization or a large government body,
we may set up a lab to be able
to take on cases from other organizations.
We also plan out our data destruction.
After we're done with,
for example, the criminal case,
what do we do with the evidence?
Or a civil case, what do we do with the evidence?
How can we verify that it's actually been destroyed
>> where nobody can go in our dumpster
>> and just grab that stuff?
>> We also plan out evidence lockers.
How secure are they going to be?
Where are they going to be? How many do we need that?
Based on how much volume we plan to do.
Also our workstations, we plan out.
Most of our investigations are on Windows computers,
so it may not make sense to gen up a Mac workstation.
It may not make sense to create a workstation
that's for analyzing Mac devices
if we only get one a year.
Because in that case we might be able
to partner with another lab,
that they specialize in Mac.
Also consideration of certifications,
so not only for lab workers,
but also the lab itself.
There's different certification bodies
out there that say, well, this lab,
meets x criteria and they're qualified to
investigate these types of cases. Our Q&A.
How are we maintaining quality assurance
through the entire process?
Keeping in mind there as well the chain of custody,
and we'll talk about that
a lot throughout the entire course,
but essentially making sure we
know where the evidence came from,
who's touched it, why they've touched it,
and all the way through the entire process.
Think of it like a little treasure map of
your investigation. Also auditing.
Planning our audits as well as
understanding laws and regulations
that we have to be accountable for.
The forensic lab itself,
you probably won't see this heavily
tested in the material too much for
the CHFI exam but just know
>> at a high level of what entails a forensic lab.
>> Number 1, we want to plan
our budget and then figure out our team.
How many investigators do we need?
Do we need lab managers?
How many do we need?
Other people in the lab, how many of those do we need?
Do we need janitorial staff?
What criteria are we using to investigate
all those people to make sure they're not criminals?
Then ISO/IEC 17025, that
covers some standards for
the lab setup and forensics in general.
Some of the common things that you'll want to know,
we want floor to ceiling walls.
We don't want bushes right outside the window.
We don't want externally facing windows in the lab.
As you see pictured here, it's just some walls.
You'll see the floor to ceiling walls,
they're not the little fake walls that you
just pull out and push back again.
This is a good example of
>> what your lab could look like.
>> We also want to consider the
security containers for the evidence,
as well as making sure we have
appropriate locks on doors,
whether that's electronic or physical,
and then also making sure
our workstations are adequate size,
so roughly around 50-63 square foot
is the gold standard according to EC council,
so just keep that in mind for the exam.
Then our investigation phase.
Obviously, we want to have either consent
from somebody in a position of authority.
For example, if you're
a kid and you do a crime and then your parents say,
yeah, you can search his room,
well, that's giving the consent.
It's that person who authority,
and we'll talk about that a little more when
we go into the warrants module.
Then also of course, having a warrant.
We either have consent or have
an actual warrant that allows us to search
the particular item or items that we're looking for.
Then we have our first responder.
The first responder shows
up and they secure the evidence.
You'll want to keep in mind the first responder is
securing stuff in the investigation phase.
They show up and secure stuff and then from there,
they're photographing or documenting the scene,
how it is,
investigator arrives, and
sometimes the first responder is the investigator.
But otherwise, the investigator arrives on
the scene and they work through collecting evidence,
of course, maintaining the chain of custody,
preserving the evidence, and then
moving into the analyzing of the evidence.
As I mentioned, warrants.
We've got a couple different types,
the electronic storage device and service provider.
You'll want to know both of those for
your exam and we'll talk about those in just a moment.
The search warrant, if you're not
familiar with what it is,
basically a judge writes that out or signs it
off and that directs
law enforcement to search for a particular evidence.
That's where the Fourth Amendment comes in that
we talked about earlier in module 1,
whereas for the most part,
the judge or the investigative team would
have to specify this warrant
covers the laptop and
the desktop or that covers a house,
and so anything inside
the house is covered by this warrant.
There's got to be some specification.
You can't just basically sign off a warrant and
then go search the woods and
back of the neighbor's house
or even search the neighbor's house,
you have to have something specified.
I'll back up a second here. Electronic storage device,
basically that's the hardware components
, hardware and software.
For example, I come seize your computer,
that's where that's going to be covered.
The service provider would be
your account information like
your cable company or something,
and that way they can see billing,
they can get more in-depth
information about your browsing history.
The warrant, for example, could cover
all the records related to your account,
so they can get information from the actual server,
so they can get permission and image parts of
the servers from this actual service provider.
That way, if you think that you're going to delete
stuff and that you've cleaned up your desktop,
but the reality is
there is still information out there that can be
gathered to prosecutes you or if
it's a civil case fined against you.
Warrants not needed. A warrantless seizure.
Basically, if the destruction of evidence is
imminent and the belief
is that the item that's going to be seized or that can
potentially be seized is evidence of criminal activity.
For example, using child pornography for an example,
there was a case a while back,
I think it's been three or four years now.
But basically, the FBI was investigating this person.
They knew that the person had
their laptops set up to where,
of course, I have full disk encryption.
They also had a setup to where
if there
was so many wrong attempts or something like that,
they would wipe the hard drive,
so would wipe everything out.
They set up a distraction and you
may be familiar with this case,
I could be telling it partially wrong now,
but I'm just trying to remember the article.
But basically, they set up
a distraction and they were able to get the laptop.
Now, they had a warrant in that case.
They were able to get the user to be logged in
and then they were able to fake
a fight essentially inside of,
I think a library and then get access to the laptop.
But using that as a scenario,
we could potentially if we see that
the criminal is on their laptop,
we look over their shoulder, for example.
Let's say you're a police officer,
you look over the shoulder in a Starbucks
and you see they're watching child porn,
you can seize that device at that time.
Well, I'm not giving you legal advice.
Obviously understand the laws in your jurisdiction,
but under this definition here,
you could potentially seize
that device without a warrant
and then get something retroactive.
But again, not giving legal advice there,
but just so you can understand what
we're talking about here with a warrantless seizure.
Then the other option here is
the person with authority consent.
I mentioned something like
you're a kid, you hack computers,
you do whatever criminal
, and then your parents say, yeah,
you can search Joey's room,
you can take his computer, whatever you want to do.
Keep that in mind. There are
options around to use a warrant,
the no-knock warrants if
your state or where you live has that stuff.
Basically, those are the police
can know that somebody is a drug dealer.
They could do a no-knock warrant if there's
a feeling that knocking and saying
police with a warrant might lead to some type
of endangerment to either the individual or the police.
Generally, people that have a history of
violence against the police
or at least a documented history,
whether or not it's true,
because as we've seen in different media articles,
but anyways, digressing there a bit,
but basically the same concept.
They can go in and they can get
the evidence without shouting out,
hey, police with a warrant.
First responders, as I mentioned,
they secure the scene.
It's generally not going to be your investigator.
Sometimes it is, but generally
it's going to be somebody else.
This might be your IT personnel,
your system admin, network admin.
For example, they noticed there has been an incident,
some breach, they
come in and they take a look at stuff for you.
Post-investigation phase.
Here we analyze the evidence and everything.
We're also tapping into
social media behavior of the investigator here.
We want to act appropriately.
We don't want to be, whoa,
I just found this evidence.
I found this evidence on Donald Trump,
for example, check it out.
Obviously, number 1, you're going to go to
jail because you're an investigator and
I'm sure there are statutes that are applicable.
Then also collecting social media evidence
falls into this phase as well.
We're collecting it on the criminals as well here.
Some of the tools you can use for
the social media collection,
there's a couple of them listed here,
but there's many, many more out there, like Facebook,
forensic software, social discovery
is a pretty popular tool
that's in use: Netlytic, Navigator.
Like I said, there's a whole bunch of
different ones for social media,
and as these social media platforms block stuff,
you're able to find new ones out there as well.
In this video, we talked about
the different phases of investigation.
In the next video we're going to talk about
some best practices as well as exhibit numbering.