Chapter 1: Understanding the Digital Forensics Profession and Investigations

Affidavit - ANSWER A notarized document, given under penalty of perjury, that investigators create to detail their findings. This document is often used to justify issuing a warrant or to deal with abuse in a corporation. It is also called a "declaration" when the document is unnotarized. Allegation - ANSWER A charge made against someone or something before proof has been found. Approved Secure Container - ANSWER A fireproof container locked by a key or combination. Attorney-Client Privilege (ACP) - ANSWER Communications between an attorney and client about legal matters is protected as confidential communications. The purpose of having confidential communications is to promote honest and open dialogue between the attorney and the client. This confidential information is not to be shared with unauthorized people. Authorized Requester - ANSWER In a private-sector environment, the person who has the right to request an investigation, such as the chief security officer or chief intelligence officer. Bit-Stream Copy - ANSWER A bit-by-bit duplicate of data on the original storage medium. This process is usually called "acquiring an image" or "making an image." Bit-Stream Image - ANSWER The file where the bit-stream copy is stored; usually referred to as an "image," "image save," or "image file." Chain of Custody - ANSWER The route evidence takes from the time the investigator obtains it until the case is closed or goes to court. Computer Technology Investigators Network (CTIN) - ANSWER A nonprofit group based in Seattle-Tacoma, WA, composed of law enforcement members, private corporation security professionals, and other security professionals whose aim is to improve the quality of high-technology investigations in the Pacific Northwest. Data Recovery - ANSWER Retrieving files that were deleted accidentally or purposefully. Digital Evidence First Responder (DEFR) - ANSWER A professional who secures digital evidence at the scene and ensures its viability while transporting it to the lab. Digital Evidence Specialist (DES) - ANSWER An expert who analyzes digital evidence and determines whether additional specialists are needed. Digital Forensics - ANSWER Applying investigative procedures for a legal purpose; involves the analysis of digital evidence as well as obtaining search warrants, maintaining a chain of custody, validating with mathematical hash functions, using validated tools, ensuring repeatability, reporting, and presenting evidence as an expert witness. Digital Investigations - ANSWER The process of conducting forensic analysis of systems suspected of containing evidence related to an incident or a crime. Evidence Bags - ANSWER Nonstatic bags used to transport removable media, hard drives, and other computer components. Evidence Custody Form - ANSWER A printed form indicating who has signed out and been in physical possession of evidence. Exculpatory Evidence - ANSWER Evidence that indicates the suspect is innocent of the crime. Exhibits - ANSWER Evidence that indicates the suspect is innocent of the crime. Forensic Workstation - ANSWER A workstation set up to allow copying forensic evidence, whether on a hard drive, USB drive, CD, or Zip disk. It usually has software preloaded and ready to use. Fourth Amendment - ANSWER Dictates that the government and its agents must have probable cause for search and seizure. Hostile Work Environment - ANSWER An environment in which employees cannot perform their assigned duties because of the actions of others. In the workplace, these actions include sending threatening or demeaning e-mail or a co-worker viewing pornographic or hate sites. Inculpatory evidence - ANSWER Evidence that indicates a suspect is guilty of the crime with which he or she is charged. Industrial Espionage - ANSWER Theft of company sensitive or proprietary company information often to sell to a competitor. International Association Of computer Investigative Specialists (IACIS) - ANSWER An organization created to provide training and software for law enforcement in the digital forensics field. Interrogation - ANSWER The process of trying to get a suspect to confess to a specific incident or crime. Interview - ANSWER A conversation conducted to collect information from a witness or suspect about specific fact related to an investigation. Line of Authority - ANSWER The order in which people or positions are notified of a problem; these people or positions have the legal right to initiate an investigation, take possession of evidence, and have access to evidence. Multi-Evidence Form - ANSWER An evidence custody form used to list all items associated with a case. Network Intrusion Detection and Incident Response - ANSWER Detecting attacks from intruders by using automated tools; also includes the manual process of monitoring network firewall logs. Professional Conduct - ANSWER Behavior expected of an employee in the workplace or other professional setting. Repeatable Findings - ANSWER Being able to obtain the same results every time from a computer forensics examination. Search and Seizure - ANSWER The legal act of acquiring evidence for an investigation. Search Warrants - ANSWER Legal documents that allow law enforcement to search an office, a home, or other locale for evidence related to an alleged crime. Single-Evidence Form - ANSWER A form that dedicates a page for each item retrieved for a case. It allows investigators to add more detail about exactly what was done to the evidence each time it was taken from the storage locker. See also evidence custody form. Verdict - ANSWER The decision returned by a jury. Vulnerability/Threat Assessment and Risk Management - ANSWER The group that determines the weakest points in a system. It covers physical security and the security of OSs and applications Warning Banner - ANSWER Text displayed on computer screens when people log on to a company computer; this text states ownership of the computer and specifies appropriate use of the machine or Internet access.