2 SEARCH, The National Consortium for Justice Information and Statistics

Transcription

1 SEARCH Non-profit providing training and technical assistance to law enforcement throughout the country Must-Have Technology Tools for Investigating Crimes Against Women 2015 Conference on Crimes Against Women Mar , 2015 Dallas, TX Presented by SEARCH 1 High-Tech Crime Training Technical Assistance High-Tech Crime Investigations Law enforcement training courses around the U.S. The Investigation of Computer Crime Online Investigations: Tools, Tips, and Techniques Core Skills for the Investigations of Mobile Devices Windows Forensic Environment for On-Scene Triage Network Investigations Peer-to-Peer Investigations Free technical assistance to federal, tribal, state and local LE me directly (or any other SEARCH staff) Use the website: View full course schedule: Podcasts and Whitepapers Modular Training Podcasts Available from the SEARCH website: Also available on itunes goo.gl/eecgt9 Or search for High Tech Crime Investigation Whitepapers High-Tech Crime Publications Modular Training/Conference Training Computer Crime/Digital Evidence Wireless Networks Mobile Device Data Recovery Social Media Investigations Legal Procedures and Practices

2 Who We Are Who We Are Elizabeth Tow High-Tech Crime Training Specialist Lauren Wagner High-Tech Crime Training Specialist 6 7 Who We Are Who We Are Justin Fitzsimmons Program Manager High-Tech Crime Training Services justin@search.org Timothy Lott Director High-Tech Crime Training Services tim@search.org 8 9 The SEARCH ISP List The SEARCH ISP List SEARCH runs the ISP List Collection of legal contacts for law enforcement service of subpoena, court orders, and search warrants Originally created by James Nerlinger, Jr. SEARCH now maintains Updated by investigators in the field Easy options to find the listing you need Drop-down listing Begin typing name of contact

3 The SEARCH ISP List SEARCH Investigative Toolbar SEARCH Investigative Toolbar/.mht is an aggregation of investigative bookmarks Recent changes to the hosting site has made it unstable SEARCH created a.mht file until a new hosting site/standalone host is developed SEARCH created the Investigative Toolbar in The SEARCH Toolbar.mht File The SEARCH Toolbar.mht File The SEARCHToolbarLinks.mht file is an archived web page HTML document that includes a collection of external hyperlinks The hyperlinks can be used as an aid to law enforcement Opened with a web browser interface Firefox Requires the installation of an add-on - UnMHT Internet Explorer Opens natively Chrome Requires the installation of an Extension -ietab Once you ve installed any needed add-ons, click the SEARCHToolbarLinks.mht file, located at Firefox The SEARCH Toolbar.mht File To open the SEARCH Investigative.mht file in Firefox: Right-click on the file SEARCHToolbarLinks.mht file Open with > Firefox The SEARCH Toolbar Links.mht file opened in a browser window

4 Portable Apps Portable Applications Can be run from USB thumb drive on any Windows computer Little evidence of use left on computer hard drive Forensic evidence typically located on thumb drive Portable Apps Portable Apps Can be an investigative tool If you have no access to an undercover computer If you have to use multiple computers as part of your job If you have no other tools available to capture evidence, portable apps can be used as a non-forensic tool If you work with victims If you conduct probation/parole checks There is a full portable apps suite OR you can download programs individually Portable Apps Portable Apps Contents When you download a portable app, these are just the program files the programs are not installed yet You have to run the program files and install the programs individually The thumb drives provided already have the apps installed and configured If you want to add a new app to this thumb drive you will need to run the program files and install the programs individually Audacity: audio editor and recorder ClamWin: antivirus CommandPrompt: link to a customizable command prompt Firefox: web browser FoxitReader: PDF reader

5 Portable Apps Contents Portable Apps Contents IrfanView: photo and image editor Eraser: erase data from hard drive KVIrc: full-featured IRC chat client Pidgin: chat with AOL, MSN and Yahoo users Skype: instant messaging, video chat and phone calls VLC: media player that plays most audio and video formats Lightscreen: screenshot tool OpenOffice: word processor, spreadsheet, presentations with Microsoft compatibility Lightscreen Portable Lightscreen Portable Screen capture tool with multiple output options Fullscreen capture Area capture Pick window Options Assign directory Change filename IrfanView Portable Firefox Portable IrfanView is an image viewing and manipulation program IrfanView will also allow you to view Exif data on images Allows user to run Firefox from USB thumb drive Can personalize browser and use on various computers Saves browsing history, cache & passwords to the thumb drive Does NOT leave any trace of browsing history on computer

6 Firefox Add-ons Investigative add-ons Status-4-Evar Live IP Address IP Address and Domain Information Screengrab (fix version) Linky PrintPDF Thumbnail Zoom Plus Facepaste IE Tab 2 Download Flash and Video UnMHT Firefox Add-ons Firefox Firefox Add-ons Open source Internet browser developed by Mozilla Useful for investigations Add-ons offer extended functionality Investigative add-ons Status-4-Evar Screengrab (fix version) Thumbnail Zoom Plus Facepaste Download Flash and Video UnMHT Firefox Add-ons Firefox Add-ons To download Add-ons, select Tools, then Add-ons A new tab with your current Extensions will open This is where you view your current Extensions

7 Sidenote Updating Firefox Add-ons Firefox Add-ons Select the gear drop-down menu Select Check for Updates Select Get Add-ons Firefox Add-ons Firefox Add-ons In the top right corner, type in the add-on you are searching for in the Search all add-ons box and press Enter Choose the desired add-on and select Install Once add-on is downloaded, select Restart now Status-4-Evar Screengrab (fix version) Allows Firefox Add-on icons to be visible in updated Firefox browser window Status Bar is visible through a right-click at the top of the browser window Saves a webpage as an image Icon is on the top right of the page Left-click on the icon to save or copy Complete Page/Frame Visible Portion Selection Designate location for picture to be saved

8 Thumbnail Zoom Plus Thumbnail Zoom Plus Shows and allows you to save a full size image when you hover over a thumbnail Left-click on icon to toggle on/off all sites Left-click on arrow next to icon at the bottom right of page to see supported sites Also allows toggling on/off of specific sites Hover over thumbnails for full images Right-click to Save Enlarged Images As Facepaste Facepaste Downloads Facebook albums Must be logged in to Facebook Go into Photos page Select Albums Right-click anywhere on Albums page and select Download this Facebook album(s) Downloads Facebook albums Select album/albums Determine Save photos to destination Determine Output file naming Always include Facebook ID Facepaste Flash and Video Download Downloads Facebook albums Download progress will be viewable Once complete, select Close Saves Facebook videos Select video from Facebook Click the browser icon at the top right in the page window

9 Flash and Video Download UnMHT Saves Facebook videos Under Videos to Download, select the chosen video Save video After saving, video will play with VLC View MHT format file web pages Icon is at top right of screen Used to open SEARCH Toolbar.MHT file Picture Information Exchangeable Image File Format: Exif Data embedded in photographs The data are embedded by the device taking the picture Photo Viewing Exif may contain: Make/model of device Serial number of device taking the picture Creation time and date GPS coordinates where photo was taken Exif Information IrfanView EXIF is retained when a photo is ed EXIF is retained when a photo is transferred via Direct Connect EXIF is retained when a photo is uploaded from a phone/camera to the cloud EXIF is stripped when sent via MMS EXIF is retained when sent via imessage EXIF is stripped from social media websites, however it is retained and accessible via search warrant IrfanView is a free graphic file viewer

10 IrfanView Plugins IrfanView You have to install IrfanView along with the IrfanView Plugins/AddOns To open a file with IrfanView File>Open Navigate to the folder containing the image you wish to open, click on the image file to set the focus, then click Open Viewing Exif Viewing Exif To view the image information Select Image>Information or Click the I with the blue circle around it Viewing Exif Viewing Exif To view Exif data If Exif data are present, the EXIF info* tab will be highlighted Click the EXIF info* tab Exif Info window will show GPS latitude and longitude, if available Click Show in Google Maps Keyboard shortcut Ctrl +E

11 VLC VLC VLC Right-click on video and select Open with Click VLC Audacity Audacity Making a Recording with Audacity audacity.sourceforge.net Restart computer and close all programs that auto-start Plug in headset and allow drivers to install Start Audacity Record 5 seconds of silence to build background noise profile

12 Record conversation Save the raw file Making a Recording with Audacity (cont.) Edit the Audacity Recording Using Audacity Open the raw audio file (.aup) in Audacity Listen to the project to establish a baseline Edit out disfluencies and other mistakes Highlight area to be removed Ctrl + K to delete Edit the Audacity Recording Using Audacity (cont.) Edit the Audacity Recording Using Audacity (cont.) Remove background noise Highlight silence from beginning of the recording Effect > Noise Removal > Get Noise Profile Ctrl + A to select all Effect > Noise Removal > Preview Adjust sliders until best sound is produced Click OK Edit the Audacity Recording Using Audacity (cont.) Exercise Save the edited audio project File > Save Project As Export the edited audio project as MP3 File > Export Select location and name file Save type as MP3 Enter desired metadata Click OK Write a short script introducing yourself Record your script using Audacity Edit your recording Save as MP3 to your desktop

13 BlueStacks BlueStacks BlueStacks app player can be downloaded at App player is free to download To use the app player you either need to download apps from a BlueStacks sponsor or pay $2/month If you choose to download apps from the BlueStacks sponsor, make sure to go in and delete these apps before using for investigation After you install BlueStacks you will need to register with a Google account BlueStacks must be run as an administrator BlueStacks BlueStacks Social Safety Patrol socialsafetypatrol.com Additional High-Tech Crime Resources

14 Social Safety Patrol Stalking Resource Center goo.gl/2j55yu NCMEC NCMEC SHIFT Shiftwellness.org Questions

15 Thank you