Digital Evidence for the Domestic Practitioner

Transcription

1 Digital Evidence for the Domestic Practitioner Presented by: Simon Ragona III, EnCE, CCE, ACE, Director Kyle Poppenwimer, CCE, ACE, Senior Digital Forensic Examiner T&M Protection Resources, LLC 230 Park Avenue, Suite 440 New York, NY 10169

2 Why Be Concerned with Digital Evidence? 1. PRACTICAL Pervasive and important in every litigated matter especially Matrimonial Cases 2. ETHICAL Duty of competence Duty to stay abreast of emerging technology 3. LEGAL NYS Court Rules require consideration of ESI 2

3 PRACTICAL - The Volume of Data Over 95% of information in the world created or stored digitally Change is Qualitative as well as Quantitative , Texting and Social Media have replaced telephone as primary mode of communication resulting in a record of the SUBSTANCE of the communication often being available as evidence! 3

4 The Digital Data Explosion 280 EXABYTES of data created, stored or replicated digitally in K Petabytes in 2013 (1PB = 1 Million GB) Estimated to increase to 1 ZETTABYTE by

5 So How Big is a ZETTABYTE? 1 ZETTABYTE = (approx.) 1.1 BILLION TERABYTES ONE TERABYTE CAN STORE: One Hundred Million Pages of TEXT 17,000 Hours of Digital Music 310,000 Digital Photos 1000 hours (about 42 Days) of Digital Video 5

6 The Numbers in Context U.S. Library of Congress Contains 158 million items on 838 miles of shelves All of which = 3000 TERABYTES 6

7 THE DIGITAL DATA EXPLOSION The Digital Information Created In 2015 alone will be 366,666 times the current information in the Library of Congress 7

8 PRACTICAL: The Staggering Volume of ESI This is NOT the volume of Digital Data out there in the world already it is merely the volume of Digital Information ( ESI ) being created in a SINGLE YEAR! The Volume of Digital Data in the World is Exponentially GREATER!! 8

9 Why Be Concerned with Digital Evidence? All This Information is Potential evidence! Where to Find it How to Get it How to get it in (as evidence) How NOT to GET IT How to Challenge it 9

10 Key Terminology & Concepts Electronic, Digital & ESI Electronic: Devices that operate by controlling the flow of electronically charged particles - Devices are Electronic not Digital but they may store digital information Digital: Information which is stored using numerical values to represent the information - Information can be Digital it cannot be Electronic Electronically Stored Information ( ESI ) is the terminology adopted by Federal and New York State Courts to refer to digital evidence 10

11 META DATA Created by the computer system to provide additional information about user created files Date Created, Accessed, Modified Author, Machine Name, Version Number Dates and times that are difficult (but NOT impossible) to alter 11

12 Microsoft Word Metadata 12

13 Microsoft Word Metadata 13

14 Microsoft Word Metadata 14

15 Key Terminology & Concepts Native Format Format in which ESI was originally created and stored Critical for proper forensic evaluation of ESI or even simple evaluation based on Metadata Examples: Digital Video Files (.avi;.mpeg;.mov) Digital Audio (.wav;,mp3;.aiff) Digital Photos (.jpg;.gif) Documents (.doc;.docx;.wpd;.pdf) 15

16 FOUNDATIONS OF ADMISSIBILITY Forensically Sound = Admissible Properly Collected + Digitally Authenticated + Appropriate Chain of Custody Digital Information on a Hard Disk or other Media is difficult to destroy or eliminate entirely, but is EASILY tampered with or corrupted! 16

17 PROPERLY COLLECTED Imaging & Cloning Clone = Physical (working) duplicate of the original media Image or Bit Stream Image = single data file (or group of sequential files) containing a bit for bit copy of the entire sequence of digital information on a hard disk or other storage medium Both forensically sound But Not the Same. MUST SPECIFY IN ORDERS / STIPULATIONS 17

18 Digital Authentication Hashing Use of a Cryptographic Algorithm to calculate unique value for HDD, FILE, or DATA VOLUME More unique than DNA Profile Accepted Hash Methods: Md-5 Algorithm Hash SHA-1 Hash Insist that all collected / preserved ESI be HASHED! 18

19 RECOVERY OF DELETED DATA OS is built for speed; erasing requires overwriting = time and resource intensive Deletion = Removal of Markers from Index not actual erasure of data from the drive DELETED DOES NOT MEAN ERASED 19

20 WHEN DOES DELETED = ERASED? WHEN DELETED DATA IS OVERWRITTEN THEN IT IS ERASED and NO LONGER RECOVERABLE BY ANY COMMERCIALLY AVAILABLE FORENSIC MEANS! Overwriting occurs through: Ordinary Continued Use of Device MAJOR Preservation Issue ESI deleted prior to a provable duty to preserve may be overwritten and become unrecoverable through normal, continued use of the device in question! Wiping (Overwriting On Purpose ) Can t get back what s been wiped (i.e. overwritten) but we CAN prove what s been done! = SPOILATION SANCTIONS 20

21 Sources of Evidence Electronic Communications: IM (Instant Messaging) Forums, Bulletin Boards, Blogs Social Networking Sites TEXT Messages (SMS) Skype / Facetime (streaming video/ audio) 21

22 Obtaining Communications Evidence Content vs. Account Information ECPA Only applies to Providers! Spoofing & the Importance of HEADERS Web Mail vs. Resident / Client Based FIND OUT Affects where copies may exist Affects potential recovery Affects ability to subpoena Affects Retention 22

23 HEADERS The IMPORTANT Part of the 23

24 Sources of Evidence WEB BASED Recovery From Devices Varies by Device and User Retention Policies vary but much longer than SMS (SEE CHART) Preservation Letter (SEE CHART) Need Court Order / Authorization 24

25 WHERE TO SEND PRESERVATION LETTERS & LEGAL PROCESS 25

26 WHO STORES WHAT, FOR HOW LONG? 26

27 S: Foundation for Admissibility Once you we have an How do you get it admitted as Evidence? Similar to other Documents but Subject to Special Challenges Challenges to authenticity based on ease of spoofing are commonplace! Notice to Admit Sponsoring Witness who sent or received MAY be sufficient Forensic Testimony to Authenticate will support admissibility and add to weight! 27

28 Evidence from Social Networking Sites Screen Shots / Photos Pro: Simple, effective, admissible same foundation as a photograph Con: Assumes access to pages; ignores history Content = electronic communication under ECPA Best practice = Preserve available ESI, Send preservation letter, Seek court order / authorization 28

29 Communications Evidence SMS SMS Data (Text Messages) Short Messages (up to 160 characters) Device vs. Carrier as a Source Carrier Retention of SMS Very Short or Non Existent (See Below) Active SMS Data Readily Retrievable from a Device Recovery of DELETED SMS data from Device - more difficult and affected by many variables BEST PRACTICE to ENSURE ADMISSIBILITY: Content from the Sending / Receiving Device Forensically Corroboration by Carrier s Bill 29

30 Communications Evidence Text Messages: Carriers that DO NOT Store SMS Data: AT&T Sprint / Nextel T-Mobile Cricket Boost Mobile 30

31 Communications Evidence SMS Data (Text Messages): Carriers NOT listed above (i.e. Verizon) do log SMS Data: BUT FOR VERY SHORT TIME: Usually 3 to 7 days If user deletes will delete on server in 24 hours or less SMS Content Covered By ECPA SEND Preservation Letter IMMEDIATELY by FAX and Mail 31

32 Sources of Evidence Mobile Devices iphones, Androids, Blackberry Tens of Millions active in U.S. Robust Operating Systems with database structures = tons of data available for recovery Tens of Thousands of Applications Available Skype Social Networking Apps Spoofing Apps to mask voice / caller ID GPS Navigation 32

33 Sources of Evidence Mobile Devices Mobile Device Data beyond / SMS: Photos taken with camera EXIF data (GPS coordinates where photo taken) Google Maps searches / routes Skype / Facetime calls produce NO third party record but proof of calls exists within the device Raw GPS Data to prove where phone has been Call Histories Calendars / Address Books (with photos!) 33

34 Sources of Evidence Mobile Device Mobile Device Backup Files Backup files generated by computer software such as Apple itunes or Blackberry Desktop Manager Store a great wealth of data including SMS, MMS, Photos, Call Logs, Contacts, Calendar, etc. Computer systems should ALWAYS be searched for mobile device backup files. 34

35 Sources of Evidence Mobile Backups -Audio Files -Applications -Bluetooth Devices -Calendar -Call Log -Chat -Contacts -Photographs -Multimedia Messages -Notes -Text Messages -User Dictionary -Videos -Voic -Web Bookmarks -Web History -Wireless Networks 35

36 Sources of Evidence Direct / Indirect Primary / Direct Evidence: (Created by the user) s Word Documents, Spreadsheets etc. Native Format Critical but still not ENOUGH! Secondary / Indirect Evidence (Created by System or Application) Internet Temporary Files Application Temporary Files System Logs Registry Files Need system / drive to analyze beyond the four corners and beyond the Meta Data! 36

37 Sources of Evidence Meta Data Analysis Meta Data dates and times ( MAC dates) based on Windows internal clock. This can be manipulated. Manipulation leaves extrinsic evidence, but you must have access to (or an image of) the system that created the ESI to prove that! 37

38 Sources of Evidence Meta Data THE MOST IMPORTANT THING TO KNOW ABOUT META DATA: WITHOUT AN ITEM IN ITS NATIVE FORMAT, RELEVANT META DATA IS NOT AVAILABLE! WITHOUT THE SYSTEM THAT CREATED THE ESI; indirect and potentially critical evidence is unavailable, including the ability to validate accuracy of Metadata 38

39 Collection and Preservation The hard disk / internal memory inside a Desktop, Laptop, Server, Tablet or Smartphone is the most common and most productive source of Digital Evidence (ESI) 40 GB HDD can hold the equivalent of 3.5 million pages of printed data 1 TB HDD = 25 Times or 87.5 million pages 39

40 Sources of Evidence Removable Media: Evidence of use is often, but not always, left on system in Registry Files or elsewhere 40

41 Sources of Evidence THE CLOUD Multiple Devices Accessing a Central Repository of Data the concept is not new the term is Cloud Computing is a Misnomer the DATA is not in a cloud, it is on A HARD DRIVE SOMEWHERE JUST NOT IN THE SUBJECT S PHYSICAL POSSESSION. We need to identify where the drive(s) are and / or how they are accessed. To do this we need the user s system 41

42 Sources of Evidence Video Security Systems (Homes & Businesses) Electronic Access Control Systems GPS Devices: Vehicle Based Portable Incorporated into Cell Phones 42

43 Digital Evidence What Forensic Analysis can show that Non Forensic Review of Electronic Documents / s may not: The best reason to fight for the genuine article Deleted Items Changed or Altered Items Hidden or Encrypted Items Fragments of Files Altered Dates and Times (meta data) User Logs / System Information Existence of third party backups and / or cloud based files Use of Removable Media 43

44 Use in Court Admissibility of ESI requires proof of: Proper Collection and Preservation Chain of Custody Authentication - Digital Verification or Hashing 44

45 Challenges Questions to Sponsoring Witness: Collection and Preservation Methods Logs, screenshots (or photos) of all forensic processes Written Standard Operating Procedures Qualifications of ALL Persons Collecting, Handling, Analyzing NOT just the person in Court! 45

46 Challenges Hardware / Software Utilized: VALIDATED? Log of Validation / Testing Custom Apps specific challenges LAB Conditions: Security / Access Control? LOGS of Entry? 46

47 Challenges THE TOUGHEST QUESTION. WHO WAS AT THE KEYBOARD? Tendency to over emphasize forensic proof of WHAT HAPPENED It is very difficult for forensic investigation / digital evidence to prove WHO was at the KEYBOARD - 47

48 Self Help Recovery vs. Interception Surreptitious Retrieval of ESI MAY be OK outside of formal discovery (e.g. Byrne v. Byrne Scenario) BUT interception of electronic communications absent consent is criminal and results are inadmissible by statute Wrongful Interception of data in transit may be criminal and inadmissble in a court of law. 48

49 Case Study 49

50 Meet John and Jane 50

51 John utilizes icloud to sync his data to each of his Apple devices. 51

52 Meet John s girlfriend Jamie. 52

53 Jamie Sexting John 53

54 Jane using John s Macbook

55 What John Forgot

56 A Very Angry Jane

57 For More Information Contact: Simon Ragona III, EnCE, CCE, ACE Kyle Poppenwimer, CCE, ACE T&M Protection Resources, LLC (908)