Criminal Investigation Procedures Flashcards

A cybersecurity investigator discovers that an attacker used a botnet to launch a DDoS attack from infected machines owned by innocent third parties. What legal challenge does this create?

Answer: Victim machines may also be classified as crime scenes requiring separate warrants

Infected victim machines that were used to commit the attack become evidence sources, potentially requiring separate legal process (e.g., warrants or consent) to examine each one.

What is a 'preservation letter' (or evidence preservation request) used for in cybercrime investigations?

Answer: Requiring a provider to retain specific data while legal process is obtained

Under 18 U.S.C. § 2703(f), law enforcement can request that a service provider preserve specific records while full legal process (subpoena or warrant) is being obtained.

During a network intrusion investigation, which artifact would BEST help establish the timeline of attacker activity on a Windows system?

Answer: Windows Event Log entries

Windows Event Logs record system, security, and application events with timestamps, making them the primary artifact for establishing attacker activity timelines.

An employee is suspected of stealing trade secrets via email. The company's IT team wants to capture the employee's emails without a warrant. Under what condition is this legally permissible?

Answer: Only if the employee has been notified of monitoring in the acceptable use policy

Employers may monitor company communications systems without a warrant if employees have been given prior notice (e.g., through an acceptable use policy) that monitoring may occur.

What is the significance of hashing evidence files (e.g., MD5 or SHA-256) in a digital forensic investigation?

Answer: It verifies that the evidence has not been altered

Cryptographic hash values serve as digital fingerprints; identical hashes confirm that the forensic copy is bit-for-bit identical to the original and has not been tampered with.

Under the Mutual Legal Assistance Treaty (MLAT) process, what is the primary purpose of these international agreements?

Answer: Enable cross-border sharing of evidence and law enforcement cooperation

MLATs are bilateral or multilateral treaties that allow countries to request and share evidence and assistance in criminal investigations across international borders.

An investigator recovers deleted files from a suspect's SSD drive. What technical factor makes SSD forensics more challenging than traditional HDD forensics?

Answer: TRIM command may have permanently erased deleted data

The TRIM command, when enabled on SSDs, instructs the drive to proactively erase blocks marked as deleted, potentially destroying recoverable evidence before imaging can occur.