Exam 11: Live Acquisitions and Network Forensics

Correct Answer:

Verified

Forensics investigators should access the victim's computer or mobile device to recover the evidence on it. Using the victim's e-mail client, find and copy any potential evidence. It might be necessary to log on to the e-mail service and access any protected or encrypted files or folders. With a corporate investigation, be sure policies are in place for this action. For a criminal investigation, you need warrants to access or get copies of files on a server. When dealing with a stalker, if you can't actually sit down at the victim's computer, you might have to guide the victim on the phone to open and print a copy of an offending message, including the header. The header contains unique identifying numbers, such as the IP address of the server that sent the message. This information helps you trace the e-mail to the suspect.

Correct Answer:

Verified

Part of the challenge in using social media information is that the data is spread over many servers, providers, and users, often requiring techniques used for "big data analytics". Additionally, social media networks can involve multiple jurisdictions that might even cross national boundaries, and social media vendors may prohibit access to their servers. Access to this information requires a warrant or subpoena. Services such as those offered by Facebook, MySpace, and other OSNs usually have legal staff that evaluate requests. Twitter, however, opposes government requests and cites the U.S. Fourth Amendment to refuse all requests.