Forensic Examination of Digital Evidence: A Guide for Law ...

1 Department of JusticeOffice of Justice ProgramsNational Institute of JusticeSpecialAPR. 04 REPORTF orensic Examination of Digital evidence : A Guide for Law of JusticeOffice of Justice Programs810 Seventh Street , DC 20531 John AshcroftAttorney GeneralDeborah J. DanielsAssistant Attorney GeneralSarah V. HartDirector, National Institute of JusticeThis and other publications and products of the Departmentof Justice, Office of Justice Programs, National Institute of Justicecan be found on the World Wide Web at the following site:Office of Justice ProgramsNational Institute of Examination of Digital Evidence: A Guide for Law EnforcementAPR. 04 NCJ 199408 This document is not intended to create, does not create, and may not be relied upon tocreate any rights, substantive or procedural, enforceable at law by any party in any mattercivil or or points of view expressed in this document represent a consensus of the authorsand do not represent the official position or policies of the Department of Justice.

2 Theproducts, manufacturers, and organizations discussed in this document are presented for informational purposes only and do not constitute product approval or endorsement by of document was prepared under Interagency Agreement #1999 IJ R 094 between theNational Institute of Justice and the National Institute of Standards and Technology, Office ofLaw Enforcement National Institute of Justice is a component of the Office of Justice Programs, which alsoincludes the Bureau of Justice Assistance, the Bureau of Justice Statistics, the Office of JuvenileJustice and Delinquency Prevention, and the Office for Victims of V. HartDirectoriiiDevelopments in the world have shownhow simple it is to acquire all sorts ofinformation through the use of information can be used for a varietyof endeavors, and criminal activity is amajor one.

3 In an effort to fight this newcrime wave, law enforcement agencies,financial institutions, and investment firmsare incorporating computer forensics intotheir infrastructure. From network securitybreaches to child pornography investiga-tions, the common bridge is the demon-stration that the particular electronic mediacontained the incriminating Examination procedures andprotocols should be in place in order toshow that the electronic media containsthe incriminating assist law enforcement agencies andprosecutorial offices, a series of guidesdealing with Digital evidence has beenselected to address the complete investiga-tion process. This process expands from thecrime scene through analysis and finally intothe courtroom. The guides summarize infor-mation from a select group of practitionerswho are knowledgeable about the subjectmatter.

4 These groups are more commonlyknown as technical working Guide is the second in a Guide , Electronic Crime SceneInvestigation: A Guide for First Responders,is available through the National Institute ofJustice Web site at remaining guides in the series willaddress Using high technology to investigate. Investigating high technology crimes. Creating a Digital evidence Forensic unit. Presenting Digital evidence in the of the complex issues associatedwith Digital evidence Examination , theTechnical Working Group for the Exami-nation of Digital evidence (TWGEDE) rec-ognized that its recommendations maynot be feasible in all circumstances. Theguide s recommendations are not legalmandates or policy directives, nor do theyrepresent the onlycorrect courses ofaction.

5 Rather, the recommendations rep-resent a consensus of the diverse viewsand experiences of the technical workinggroup members who have provided valu-able insight into these important National Institute of Justice (NIJ)expects that each jurisdiction will be ableto use these recommendations to sparkdiscussions and ensure that its practicesand procedures are best suited to itsunique is our hope that, through these materi-als, more of our Nation s law enforcementpersonnel will be trained to work effective-ly with Digital evidence and maximize thereliability of that evidence to the benefit ofcriminal case extends its appreciation to the partici-pants in the TWGEDE for their dedicationto the preparation of this Guide . Theirefforts are particularly commendable giventhat they were not relieved of their existingduties with their home offices or agencieswhile they participated in the is more, it was necessary forForewordivTWGEDE members to attend numerous(and lengthy) Guide preparation meetingsthat were held at locations far removedfrom their home offices or agencies.

6 Inrecognition of this, NIJ expresses greatappreciation for the commitment made bythe home offices or agencies of TWGEDE members in suffering the periodic unavail-ability of their V. HartDirectorNational Institute of JusticevThe process of developing the Guide wasinitiated through an invitational for the Technical Working Groupfor the Examination of Digital evidence (TWGEDE) were selected initially for theirexpertise with Digital evidence and thenby their profession. The intent was toincorporate a medley of individuals withlaw enforcement, corporate, or legal affilia-tions to ensure a complete representationof the communities involved with digitalevidence. A small core of individuals was invited tocomprise the planning panel. The task ofthe planning panel was to formulate abasic outline of topics that would be con-sidered for inclusion.

7 NIJ thanks Michael P. Everitt of Service, Office of InspectorGeneral, and Michael J. Menz. Both ofthese individuals provided their invaluabletime and expertise during the Guide sreview panelSusan BallouProgram Manager, Forensic ScienceOffice of Law Enforcement StandardsNational Institute of Standards and TechnologyGaithersburg, MarylandKenneth BroderickSpecial Bureau of Alcohol, Tobacco, Firearms and ExplosivesComputer Forensics BranchSterling, VirginiaCharles J. FaulkSpecial Bureau of Alcohol, Tobacco, Firearms and ExplosivesPortland, OregonGrant GottfriedSenior SpecialistNational Center for Forensic ScienceOrlando, FloridaKim HerdCriminal Law and Technology CounselNational Association of Attorneys GeneralWashington, Mark JohnsonSergeantComputer Crimes UnitKansas City, Missouri, PoliceKansas City, MissouriMichael McCartneyInvestigatorNew York State Attorney General s OfficeCriminal Prosecution Bureau Organized Crime Task Force Buffalo, New YorkMark MenzDigital evidence ScientistFolsom, CaliforniaBill MoylanDetectiveNassau County Police DepartmentComputer Crime SectionCrimes Against Property SquadWestbury, New YorkGlenn NickAssistant Customs ServiceCyber Smuggling CenterFairfax.

8 VirginiaTechnical Working Group for theExamination of Digital EvidenceviTodd ShipleyDetective SergeantReno Police DepartmentComputer Crimes Unit Reno, NevadaAndy SiskeDefense computer Investigation Training Program Linthicum, MarylandChris StippichDigital Intelligence, , WisconsinTWGEDE membersAdditional members were then incorporat-ed into the TWGEDE to provide a full tech-nical working group. The individuals listedbelow, along with the planning panel,worked together to formulate this AbrahamAssistant State s AttorneyCook County State s Attorney s OfficeChicago, IllinoisChris G. AndristAgentColorado Bureau of InvestigationDenver, ColoradoSean BarryComputer Forensics Assistant Lab ManagerNew Technologies, , OregonBill BaughCEOS avannah Technology GroupSavannah, GeorgiaRandy BishopSpecial Agent in Department of EnergyOffice of Inspector GeneralTechnology Crime SectionWashington, BryantStaff AttorneyKnox County Sheriff s OfficeKnoxville, TennesseeDon BuchwaldProject EngineerThe Aerospace CorporationLos Angeles, CaliforniaJaime CarazoSpecial AgentUnited States Secret ServiceElectronic Crimes BranchWashington, G.

9 ChvalChief, High Tech Crimes BureauOffice of the Illinois Attorney GeneralChicago, IllinoisDorothy E. DenningProfessorComputer Science DepartmentGeorgetown UniversityWashington, DormanInspectorPostal Inspection ServiceAtlanta, GeorgiaJames DoyleSergeantDetective BureauNew York City Police DepartmentComputer Investigation and Technology UnitNew York, New YorkMichael DuncanStaff/SergeantEconomic Crime BranchTechnological Crime SectionOttawa, OntarioCanadaDoug ElrickSenior Forensic SpecialistDigital IntelligenceWaukesha, WisconsinviiMichael FinnieForensic SpecialistComputer Forensics , WashingtonToby M. FinnieDirectorHigh Tech Crime ConsortiumTacoma, WashingtonPaul T. FrenchDirector, Consulting ServicesNew Technologies, Forensics Lab ManagerGresham, OregonPat GilmoreDirectorRedSiren, , PennsylvaniaSam GuttmanPostal InspectorForensic and Technical Postal ServiceDulles, VirginiaDave HeslepSergeantMaryland State PoliceComputer Forensics LaboratoryColumbia, MarylandAl HobbsSpecial Deputy MarshalChild Exploitation Strike ForceArlington Heights Police DepartmentArlington Heights, IllinoisRobert HopperSergeantArizona Department of Public SafetyComputer Forensic UnitPhoenix, ArizonaMary HorvathProgram ManagerFBI CARTW ashington.

10 JonesProgramme ManagerNational High Tech Crime Training CentreNational Police TrainingWyboston Lakes Leisure CentreUnited KingdomRoland LascolaCyber Security SpecialistIndependent Department of EnergyWashington, LeeseLieutenantMaryland State PoliceComputer Crimes UnitColumbia, MarylandGlenn LewisKroll Global HeadquartersNew York, New YorkJason LuttgensComputer Specialist, R&DNASA Office of the Inspector GeneralComputer Crimes DivisionWashington, MaresPresidentMares and Company, LLCL awrenceville, GeorgiaRalph McNamaraAssistant Inspector General for InvestigationsNational Archives and Records AdministrationOffice of Inspector GeneralCollege Park, MarylandJoel MoskowitzInvestigatorClark County District Attorney s OfficeLas Vegas, NevadaviiiJames K. PaceSenior Special AgentChief of computer Forensics and Army Criminal Investigation LaboratoryForest Park, GeorgiaScott R.