Table of Contents for

System Forensics, Investigation, and Response, 3rd Edition

Some laws do make changes to the process of seizing evidence. Laws can alter the requirements for a warrant, exceptions to warrant requirements, and issues of consent to search.

The most obvious change to U.S. law in reference to forensics in recent years has been the USA Patriot Act. The Patriot Act was designed to combat terrorism. It was not created with computer crime as its focus; however, it has affected computer crime. For example, prior to the Patriot Act, Internet service providers were very limited in what they could share with law enforcement without warrants or subpoenas. Now, they can choose to notify law enforcement if they reasonably believe that they have found evidence of an imminent crime that would endanger lives.

Section 816 of the Patriot Act, titled “Development and Support of Cybersecurity Forensic Capabilities,” calls for the U.S. Attorney General to establish regional computer forensics laboratories. This led to the creation of the Electronic Crimes Task Force with computer forensics labs in many major cities. This task force also includes members of local law enforcement.

Private forensic labs are becoming more common. These laboratories handle forensic examinations for private companies, for attorneys, and sometimes for law enforcement agencies. More and more forensic investigations are being conducted in private labs. This has become routine in other areas of forensics, such as DNA testing.

In the case of civil litigation, it is usually necessary to hire private forensic labs to process evidence. Private labs can gather evidence, analyze it, and produce reports regarding their findings. This data might be used in civil litigation or simply to ascertain the cause of an incident.

Defense attorneys often want their own lab to examine evidence in order to challenge the findings of the state’s lab. The goal may be to confirm or deny what the prosecution has presented or to find some flaw in the methodology utilized by the prosecution. In some cases, the defense is simply seeking grounds for a reasonable doubt that the defendant committed the crime. For example, if the defendant is accused of sending a virus to a victim, and if that virus, along with virus creation utilities, is found on his or her computer, it may seem a hopeless case. However, if the defense can show that other people had access to the computer, or even that other users logged on around the time the virus was sent, this provides reasonable doubt.

It is becoming increasingly common for smaller police departments to outsource their computer forensics to private labs. It is often cost effective. In smaller towns and cities, the cost of equipping the police department with a full computer forensics lab and adequately trained staff may simply be outside their budgets. In those cases, it is more cost effective to outsource computer forensics examinations.

Clearly, the cloud presents international legal issues for forensic examiners, but there are other issues as well. What happens when a case is transnational in nature? Cases of bank fraud, identity theft, and money laundering frequently cross national boundaries. Consider an identity theft scheme where a server in Malaysia is used to steal identities while the perpetrator uses his or her laptop in Spain to take money from the victim’s accounts. If the victim lives in a third country, such as the United States, this crime involves three different national jurisdictions.

You might think that in such cases the only answer is to be aware of the laws in each country and ensure they are all obeyed. However, that is rarely necessary. Usually, taking the national laws that are most restrictive to your investigation and following them will satisfy the legal requirements of the less-restrictive jurisdictions.

Techniques are always evolving. Because the Daubert standard requires that scientific evidence presented in court be generally accepted in the relevant scientific field, new techniques need to be verified before being used in court. This means it is unlikely that a new tool will be released and immediately utilized in court. However, as time passes and the new tool has been tested, often in academic settings, it gains wide acceptance in the field and finds its way into court.

For this reason, it is important that a forensic investigator be aware of changes in technology and have at least a basic familiarity with emerging technologies and techniques. Even if they are not yet being used in court, they could be soon.