Title: 2. Collecting Evidence in Private-Sector Incident Scenes
Course: IN 2005 Digital Forensics > Section: Module 5: Chapter 5 - Processing Crime and Incident Scenes

Collecting Evidence in Private-Sector Incident Scenes

1. Private-sector organizations include businesses and government agencies that aren’t involved in law enforcement.
2. These agencies must comply with state public disclosure and federal Freedom of Information Act (FOIA) laws and make certain documents available as public records. The FOIA allows citizens to request copies of public documents created by federal agencies.
3. A special category of private-sector businesses includes ISPs and other communication companies. ISPs can investigate computer abuse committed by their employees, but not by customers, except for activities that are deemed to create an emergency situation.
4. Investigating and controlling computer incident scenes in the corporate environment is much easier than in the criminal environment because the incident scene is often a workplace.
5. Typically, businesses have inventory databases of computer hardware and software, which help identify the computer forensics tools needed to analyze a policy violation and the best way to conduct the analysis.
6. In addition, a corporate policy statement about misuse of computing assets allows corporate investigators to conduct covert surveillance with little or no cause, and allows them to access company systems without a warrant.
7. Companies should display a warning banner or publish a policy stating that they reserve the right to inspect computing assets at will.
8. Corporate investigators should know under what circumstances they can examine an employee’s computer. Every organization must also have a well-defined process describing when an investigation can be initiated.
9. If a corporate investigator finds that an employee is committing or has committed a crime, the employer can file a criminal complaint with the police.
10. Employers are usually interested in enforcing company policy, not seeking out and prosecuting employees. Corporate investigators are, therefore, primarily concerned with protecting company assets.
11. Actions to follow if you discover evidence of a crime during a company policy investigation, including:
  - Determine whether the incident meets the elements of criminal law
  - Inform management of the incident
  - Stop your investigation to make sure you don’t violate Fourth Amendment restrictions on obtaining evidence
  - Work with the corporate attorney to write an affidavit confirming your findings