Title: 2. Preparing for Computer Investigations
Course: IN 2005 Digital Forensics > Section: Module 1: Chapter 1 - Computer Forensics and Investigations as a Profession

Understanding Law Enforcements Agency Investigations
1. In a criminal case, a suspect is tried for a criminal offense such as burglary, murder or molestation.  Computers and networks are only tools that can be used to commit crimes.

1. Many states have added specific language to criminal codes to define crimes involving computers.

1. The legal processes depend on local custom, legislative standards and rules of evidence.  Criminal case follows three stages: the complaint, the investigation and the prosecution. Use Figure 1-7 to illustrate your explanation.

1. A criminal case begins when someone finds evidence of an illegal act.  The complainant makes an allegation, an accusation or supposition of fact.

1. Next, a police officer interviews the complainant and writes a report about the crime.  The police blotter provides a record of clues to crimes that have been committed previously.  An investigator delegates, collects, and processes the information related to the complaint.

1. After you build a case, the information is turned over to the prosecutor.

1. Define affidavit as a sworn statement of support of facts about or evidence of a crime submitted to a judge to request a search warrant.  Use Figure 1-8 to illustrate your explanation.  The affidavit must be notarized under sworn oath.

1. A judge must approve and sign a search warrant before you can use it to collect evidence.

Understanding Corporate Investigations

1. Private or corporate investigations involve private companies and lawyers who address company policy violations and litigation disputes.

1. Corporate computer crimes can involve:
  - E-mail harassment
  - Falsification of data
  - Gender and age discrimination
  - Embezzlement
  - Sabotage
  - Industrial espionage

1. One way to avoid litigation is to publish and maintain policies that employees find easy to read and follow. Published company policies provide a line of authority for a business to conduct internal investigations.

1. Well-defined policies give computer investigators and forensic examiners the authority to conduct an investigation.

1. Another way to avoid litigations is to display warning banners.  A warning banner usually appears when a computer starts or connects to the company intranet, network or virtual private network.  It informs end users that the organization reserves the right to inspect computer systems and network traffic at will.  A warning banner establishes the right to conduct an investigation.  Use Figure 1-9 to illustrate your explanation.

1. An authorized requester has the power to conduct investigations and this policy should be defined by executive management.

1. The groups that should have direct authority to request computer investigations, including:
  - Corporate Security Investigations
  - Corporate Ethics Office
  - Corporate Equal Employment Opportunity Office
  - Internal Auditing
  - The general counsel or Legal Department

1. The most common type of situations that require conducting security investigations in a corporate environment, including:
  - Abuse or misuse of corporate assets
  - E-mail abuse
  - Internet abuse

1. You should be sure to distinguish between a company’s abuse problems and potential criminal problems.

1. Corporations often follow the silver-platter doctrine, which is what happens when a civilian or corporate investigative agent delivers evidence to a law enforcement officer.

1. Many company policies distinguish between personal and company computer property.  One area that’s difficult to distinguish involves PDAs, cell phones and personal notebook computers.  The safe policy is to not allow any personally owned devices to be connected to company-owned resources, thereby limiting the possibility of commingling personal and company data.