Investigations Involving the Internet and Computer Networks

1 Department of Justice Office of Justice Programs National Institute of Justice Special JAN. 07 REPORT Investigations Involving the Internet and Computer Networks Department of Justice Office of Justice Programs 810 Seventh Street Washington, DC 20531 Alberto R. Gonzales Attorney General Regina B. Schofield Assistant Attorney General David W. Hagy Deputy Assistant Attorney General, Office of Justice Programs and Principal Deputy Director, National Institute of Justice This and other publications and products of the National Institute of Justice can be found at: National Institute of Justice Office of Justice Programs Partnerships for Safer Communities JAN. 07 Investigations Involving the Internet and Computer Networks NCJ 210798 David W.

2 Hagy Deputy Assistant Attorney General, Office of Justice Programs and Principal Deputy Director, National Institute of Justice This document is not intended to create, does not create, and may not be relied upon to create any rights, substantive or procedural, enforceable by law by any party in any matter civil or criminal. Opinions or points of view expressed in this document represent a consensus of the authors and do not necessarily reflect the official position or policies of the Department of Justice. The products, manufacturers, and organizations discussed in this document are presented for informational purposes only and do not constitute product approval or endorsement by the Department of Justice.

3 This document was prepared under Interagency Agreement #2003 IJ R 029 between the National Institute of Justice and the National Institute of standards and Technology, Office of Law enforcement standards . The National Institute of Justice is a component of the Office of Justice Programs, which also includes the Bureau of Justice Assistance, the Bureau of Justice Statistics, the Office of Juvenile Justice and Delinquency Prevention, and the Office for Victims of Crime. Photo Credits Cover: Getty Images and Photodisc Text: Photodisc, Getty Images, and Digital Stock Foreword As the use of the Internet and other Computer Networks has grown rapidly in recent years, so has the opportunity for electronic crime.

4 Unlawful activity can be committed or facilitated online. Criminals can trade and share information, mask their identity, identify and gather information on victims, and communicate with co-conspirators. Web sites, electronic mail, chat rooms, and file sharing Networks can all yield evidence in an investigation of Computer -related crime. This report was developed by the Technical Working Group for the Investigation of High Technology Crimes and is intended to be a resource for individuals responsible for Investigations Involving the Internet and other Computer Networks . It is one of a series of electronic crime investiga tion documents already published or in development by the National Institute of Justice (NIJ).

5 The guides are developed by technical working groups that consist of practitioners and subject matter experts brought together by NIJ to help law enforcement agencies and prosecutors deal with the growing volume and com plexity of electronic crime. The series of guides will discuss the inves tigation process from the first responder, to the laboratory, to the courtroom. Specifically, the guides will address: Electronic crime scene investigation by first responders. Forensic examination of digital evidence. Internet and network Investigations . Investigative uses of technology. Courtroom presentation of digital evidence. Development of a digital evidence forensic unit.

6 The recommendations presented in this guide are not mandates or policy directives and may not represent the only correct course of action. The guide is intended to be a resource for those who investigate crimes related to the Internet and other Computer Networks . It does not discuss all of the issues that may arise in these Investigations and does not attempt to cover traditional investigative procedures. NIJ extends its appreciation to the mem bers of the Technical Working Group for the Investigation of High Technology Crimes for their involvement. We commend them for the long hours of work required to prepare this report and recognize that they did this while still performing their existing duties with their home offices or agencies.

7 Their commitment of time and expertise was invaluable to the success of the project. David W. Hagy Deputy Assistant Attorney General, Office of Justice Programs and Principal Deputy Director, National Institute of Justice iii Technical Working Group for the Investigation of High Technology Crimes Planning panel Carleton Bryant Staff Attorney Knox County Sheriff s Office Knoxville, Tennessee John Davis Operations Manager Colorado Regional Computer Forensics Laboratory Lone Tree, Colorado Toby Finnie Director High Tech Crime Consortium Tacoma, Washington Alex Graves Program Specialist Federal Law enforcement training Center Brunswick, Georgia Patrick Hogan Special Agent Investigator/DE Examiner USSS Electronic Crimes Section Washington, Michael J.

8 Menz HP-IT Security Investigator Detective Sacramento High Technology Crimes Task Force Sacramento, California Sean P. Morgan White Collar Crime Program Manager American Prosecutors Research Institute Alexandria, Virginia Cynthia Murphy Detective Madison Police Department Madison, Wisconsin Tom Sadaka Of Counsel Berger Singerman Attorneys at Law Ft. Lauderdale, Florida Raemarie Schmidt Vice President Digital Intelligence, Inc. Waukesha, Wisconsin Todd Shipley Director, Systems Security and High Tech Crime Prevention training SEARCH Group, Inc. Sacramento, California Chris Stippich President Digital Intelligence, Inc. Waukesha, Wisconsin Technical Working Group members Walter E.

9 Bruehs Forensics Examiner Forensic Audio, Video and Imaging Analysis Unit Federal Bureau of Investigation Quantico, Virginia Tim Dees Regional training Coordinator Oregon Department of Public Safety standards and training Kennewick, Washington Michael W. Finnie Senior Computer Forensic Specialist Computer Forensics, Inc. Seattle, Washington v Carlton Fitzpatrick Chief, Financial Investigations Branch Federal Law enforcement training Center Department of Homeland Security Glynco, Georgia Grant Gottfried MITRE McLean, Virginia Ronald J. Green Senior Vice President Corporate Information Security Bank of America Charlotte, North Carolina Gerald Griffin Director Forensic and Technical Services Postal Inspection Service Postal Service Dulles, Virginia William Harrod Director, Investigative Response TruSecure Herndon, Virginia Dave Heslep Sergeant Maryland State Police Technical Investigation Division Columbia, Maryland Darrell Johnson Captain Knox County Sheriff s Office Knoxville, Tennessee Kevin Manson Coordinator Internet Investigations training Programs Financial Fraud Institute Federal Law enforcement training Center Glynco.

10 Georgia Michael McCartney Special Investigator New York State Attorney General s Office Buffalo, New York Bill Moylan Detective Nassau County Police Department Westbury, New York Thomas Musheno Forensic Examiner Forensic Audio, Video and Image Analysis Federal Bureau of Investigation Engineering Research Facility Quantico, Virginia Tim O Neill Hewlett-Packard Information Security Roseville, California Scott R. Patronik Chief, Division of Technology and Advancement Erie County Sheriff s Office Buffalo, New York Jim Riccardi, Jr. Electronic Crime Specialist CyberScience Lab National Law enforcement and Corrections Technology Center Northeast Rome, New York Rebecca Richardson Network Administrator Montana State University Billings Billings, Montana Alan Roth Postal Inspector Forensic and Technical Services Postal Service Dulles, Virginia Jonathan J.