Hard Drive for Potential Evidence

Benjamin Pannell posted Jul 1, 2020 12:38 PM This page automatically marks posts as read as you scroll.Adjust automatic marking as read setting 1.) You are a digital forensic examiner and have been asked to examine a hard drive for potential evidence. Give examples of how the hard drive (or the data on it) could be used as (or lead to the presentation of) all four types of evidence in court; testimonial, real, documentary, and demonstrative. If you do not believe one or more of the types of evidence would be included, explain why not. Out of the four types of evidence (testimonial, real, documentary and demonstrative) I believe that 3 can be found/ used when it comes to a hard drive and 1 has the chance of being used. Real evidence is defined as being “a type of physical evidence and consists of objects that were involved in a case or actually played a part in the incident or transaction in question” (US Legal, n.d.). Seeing as the hard drive itself is a physical device that could pertains to a case, I could see this being considered real evidence. Documentary evidence is a form of evidence that can consist of records, photos, contracts, letters or other types of documents. In this example, you could use the documents that are stored on the hard drive as documentary evidence. The data stored on the hard drive is no different than if it were to have been printed off and collected from the suspects desk drawer. The medium in which it is stored is different, but the content is the same. Emails, word documents, and contracts are all examples of documentary evidence that could be retrieved from a hard drive and used in a court case. Demonstrative evidence is one that I also believe could be found on a hard drive. An abbreviated definition from dictionary.law.com says that demonstrative evidence is “actual objects, pictures, models and other devices which are supposedly intended to clarify the facts for the judge and jury” (Law.com, n.d.) the definition then goes on to state examples of what this evidence could clarify but the one I want to focus on is the last one which was “ methods used in committing an alleged crime.” (Law.com, n.d.). From this definition, we could then say that log files that are stored on the hard drive (such as command history) could be used as demonstrative evidence in cases where a computer was used to commit a crime. We could use the log files that shows the methods that were used in the crime (such as what commands were run and at what times) and correlate these events to the victim logs to create a model/presentation that basically recreates the cyber-attack. In my opinion I think that this example works but please let me know if you all think it is a little off. Testimonial evidence. This one seems like I might be reaching but I guess I can somewhat see how a hard drive could come into play but please let me know what you all think. Testimonial evidence is a statement by an individual about what they observed or experienced. If an individual observed a suspect stealing a hard drive from work and saw them store the hard drive in the trunk of their car, this person could provide their testimony about what they saw. If a hard drive was then found in the trunk it could be brought in as evidence from that testimony. References US Legal. (n.d.). Real Evidence Law and Legal Definition. Retrieved July 01, 2020, from https://definitions.uslegal.com/r/real-evidence/Law.com. (n.d.). Demonstrative evidence. Retrieved July 01, 2020, from https://dictionary.law.com/Default.aspx?selected=486 2.) You have been asked to assist a law enforcement team serving a search warrant related to a child pornography investigation. You are the digital forensic expert for the team, and, as such, have been assigned the task of identifying and collecting the digital evidence at the search location. Answer the following questions about your assignment. What steps should you take before the search to serve the search warrant? In a situation like this one if we fear that the suspect will delete the data before we could obtain a warrant to collect the storage devices, we may be able to use exigent circumstance to obtain the devices. From a research paper titled ‘Digital Evidence and the U.S. Criminal Justice System’ under the section regarding search and seizure the author writes, “Exigent circumstances, or immediate danger of destruction of evidence, can also be cause for a limited search of an electronic storage device.” (Goodison et. Al, 2015). It is important to note that a warrant must be obtained immediately following this collection. What types of evidence should you be on the alert for, when searching the residence? Any sort of storage medium where the child pornography can be stored. On these storage devices we would look for image files and video files. I would also look through any communication applications that the suspect used such as email, text and chat services to look for any evidence that they were sending the child pornography to other individuals. What types of items would you seize? Computer hard drives, phones, laptops, digital cameras, SD cards, laptops, tablets, USB drives. References Goodison, S. E., Davis, R. C., & Jackson, B. A. (2015, January 01). Digital Evidence and the U.S. Criminal Justice System: Identifying Technology and Other Needs to More Effectively Acquire and Utilize Digital Evidence. Retrieved July 1, 2020, from https://www.ncjrs.gov/pdffiles1/nij/grants/248770.pdf