Ninth Circuit Reconsidering Laptop Border Search Case

The Ninth Circuit Court of Appeals heard oral argument last week en bancin United States v. Cotterman. A Ninth Circuit panel ruled in favor of the Government in 2011 reported at 637 F.3d 1068 (2011). The facts involved a search of a laptop at a border: the search began at the border and ended two days later at a government forensic laboratory located 170 miles away from the border. The panel of the Ninth Circuit upheld the warrantless search as a proper border search. NACDL and the Electronic Frontier Foundation both authored amicus briefs for reconsideration with the full court. The argument (available here) was heard last week and an opinion should be forthcoming. The argument presented en banc entailed that suspicionless, indefinite seizure of an individual’s laptop at the border raises constitutional concerns, and the suspicionless forensic search was outside the scope of a permissible investigatory detention and is abhorrent to the Fourth Amendment.

Tor: Why Anonymity Matters

Tor is free software and an open network that helps you defend against a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security known as traffic analysis

Tor protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, and it prevents the sites you visit from learning your physical location. Tor works with many of your existing applications, including web browsers, instant messaging clients, remote login, and other applications based on the TCP protocol. 

Electronic Crime Scene Investigation

The National Institute of Justice has a number of publications that are handy for the criminal investigator. One particularly helpful publication is the guide pictured above: "Electronic Crime Scene Investigation: A Guide for First Responders." The Guide sets out guidelines that should be followed by law enforcement and other investigators to protect, recognize, collect, and preserve electronic evidence at the scene. The guide can help one review whether law enforcement followed correct protocol in gathering data from a crime scene. It also provides tips for anyone, properly trained, to collect electronic evidence without corrupting the evidence. When in doubt, always have a mirror image prepared of computers or other media to preserve its original condition when seized.

National White Collar Crime Center

Need to brush up on your cell phone data collection? preserve electronic data for court presentation? collecting and analyzing data for financial crime case? A good source of training and information is the National White Collar Crime Center. They offer on-line courses that look to be offered to law enforcement and defense investigators alike.

Computer Forensics: A Legal Primer

Here is a link to an excellent post by a law professor and a follow up post from a Ex Forensis: Forensic File Formats – A Primer for Attorneys">computer forensic expert that contains a primer of all the terms that are important when dealing with computers as evidence on a case. The article discusses as background the case of State v. Dingman, 149 Wash.App. 648, 202 P.3d 388 (Washington Court of Appeals 2009), in which one of the defendant's claims was that neither he nor the expert hired by the defense had access to the Encase program in order to conduct forensic analysis. The Washington Court of Appeals held that the trial court “erred by requiring that the State provide only an EnCase mirror image of Dingman’s hard drives to the defense. The Court vacated the conviction and remanded for a new trial.

Here is an excerpt from the Primer, written by Larry Daniel, a computer forensic expert available for hire as a defense expert:

Here are the different kinds of formats you can expect to see in cases and how to deal with them.

1. Encase format or as it is also known, Expert Witness format or E01 format. Encase by Guidance Software, Inc.
1. This is the “native” format for creating copies of digital evidence when the copies are made using Encase Forensic software. The file extension for these files begin with .e01 and are numbered .e02, .e03 and so on.
2. FTK format. FTK, which stands for Forensic Tool Kit, is a forensic software by Access Data Corporation. It is the second most popular forensic software in use by law enforcement in the US.
3. DD aka RAW format. DD format can be created by several different programs and hardware devices used to create forensic copies of hard drives and other digital media. It is an open source format and is commonly created using the Linux dd command.

FBI's "lnvestigative Kiosks" Allow Quick Data Extraction from Cell Phones

From Evidence Technology Magazine:

It seems that every day, manufacturers add features to the garden-variety cell phone that make these mobile devices increasingly valuable as items of evidence. Text messages, call logs, e-mails, photographs, videos-all of this data and more can be found on many cell phones today.

To help local, state, and federal law enforcement deal with an increased demand in analyzing cell-phone data, the FBI has been launching Cell Phone Investigative Kiosks (CPIKs) in FBI Field Offices and Regional Computer Forensics Laboratory (RCFL) locations across the country. The CPIK allows users to extract data from a cell phone, put it into a report, and burn the report onto a CD or DVD in as little as 30 minutes.

Kiosk users only need to have some familiarity with computers and are required to take a one-time only, hour-long training course. Assistance with the kiosks is also available on site at CPIK locations.

Each CPIK has two components: 1) a cell phone examination system that contains software and the necessary cables to download data; and 2) a photographic system that enables a user to take pictures of a cell phone's screen.

Users of the CPIK are able to:

• Copy data from a cell phone to a computer hard drive
  
• Examine data in a report format on the computer screen
  
• Copy the report onto a portable device (such as a CD or DVD)
  
• Copy the photographs onto a portable device (such as a CD or DVD)

While the CPIK is intended to be a preview tool-not equivalent to a full-scale cell-phone examination such as that performed by a certified examiner-any evidence produced using the tool is admissible in a court of law.

Non-FBI personnel may access the kiosks at their local RCFL. For CPIKs located at an FBI Field Office, non-FBI personnel must have an FBI escort at all times. To locate a CPIK near you and to learn more about the program, go to: www.rcfl.gov

New Report from Sentencing Commission

The United States Sentencing Commission released a report, available here, that provides a history of the child pornography guidelines. The Sentencing Commission report is the first step in the Commission's ongoing examination of the child pornography guidelines. The report gives an overview of the child pornography guidelines over the last twenty-two years including the nine revisions to the Guidelines prompted by Congressional action. The report also notes that the Commission is engaging in a study because:

Sentencing courts have also expressed comment on the perceived severity of the child pornography guidelines through increased below-guidelines variance and downward departure rates. Consistent with the Commission’s duties to review and revise the guidelines, and the Supreme Court’s direction, the Commission has established a review of the child pornography guidelines as a priority for the amendment cycle ending May 1, 2010. This report is the first step in the Commission’s work on this priority.

Find yourself wondering where to get started in a CP case? Here is a good overview for starters. Most CP cases require trained forensic analysis because with these cases, the devil is in the details.

How the Internet Works

Dealing with computer crimes including the transfer of contraband files or dealing with interstate communications? Looking at how a particular email or file was transferred in cyberspace? Here is a handy little article on "How the Internet Infrastructure Works". It includes explanation on routers, servers, internet protocol, email, uniform Resource Locators (URL) and more.

FBI Investigated Coder for Public Publishing

From WIRED (full article here)

When 22-year-old programmer Aaron Swartz decided last fall to help an open-government activist amass a public and free copy of millions of federal court records, he did not expect he’d end up with an FBI agent trying to stake out his house.

But that’s what happened, as Swartz found out this week when he got his FBI file through a Freedom of Information Act request. A partially-redacted FBI report shows the feds mounted a serious investigation of Swartz for helping put public documents onto the public web .

The FBI ran Swartz through a full range of government databases starting in February, and drove by his home, after the U.S. court system told the feds he’d pilfered approximately 18 million pages of documents worth $1.5 million dollars. That’s how much the public records would have cost through the federal judiciary’s pay-walled PACER record system, which charges eight cents a page for most legal filings.

CCleaner

CCleaner is a freeware system optimization, privacy and cleaning tool. It removes unused files from your system - allowing Windows to run faster and freeing up valuable hard disk space. It also cleans traces of your online activities such as your Internet history. Additionally it contains a fully featured registry cleaner. Download CCleaner here.

Flash Cookies Are Tracking You

From PCMAG.com:

A paper by researchers at the University of California, Berkeley brings to light the problem of cookies in Adobe's Flash and their under-appreciated widespread use.

The problem begins with the fact that large numbers of users delete their browser HTTP cookies periodically, making it difficult for web sites, mainly commerce sites, to accurately track the number of unique visitors. Flash cookies have filled this data gap for many sites.

Flash cookies are similar to HTTP cookies in that they store data locally for a site for that user. This could be as simple as a unique ID to let the site track which user has connected. Flash cookies, also known as "local shared objects," have advantages over HTTP cookies: they can be much larger, they have no expiration date by default, and they are shared among different browsers in the system. Of course,

The concern, of course, is that Flash cookies can be used to track users in ways that aren't appreciated and that users won't know. In fact, some top 100 sites use the Flash cookies to repopulate HTTP cookies that the user deleted.

You can control cookies in Flash, both on a per-site basis and globally. For a site, right click on the flash object and select Settings and then the folder tab. Read the Flash Player help for more on this.

The Global Storage Settings panel can be accessed on its own help page. There you can tell Flash you don't want any sites to be able to store local content at all. You can also see which sites have cookies on you.

Full article here.

You may be surprised at how many sites use flash cookies for tracking you. You can manage them here.

Interesting Case out of the 9th Circuit on Rules for Computer Searches

En banc, the 9th Circuit, in an opinion by Kozinski, issues a major ruling on how the government is to go about obtaining and executing warrants for computer searches.

http://www.ca9.uscourts.gov/datastore/opinions/2009/08/26/05-10067eb.pdf

IN RE: SEARCH WARRANTS EXECUTED ON APRIL 8, 2004 AT CDT, INC., In Re, No. 05-55354 ý D.C. No. SEAL 1, CV-04-02887-FMC Plaintiff-Appellant, OPINION v. SEAL 2, Defendant-Appellee.

Argued and Submitted December 18, 2008—Pasadena, California Filed August 26, 2009 Before: Alex Kozinski, Chief Judge,

Here's Kozinski's summary of the new rules:

We accept the reality that such over-seizing is an inherent part of the electronic search process and proceed on the assumption that, when it comes to the seizure of electronic records, this will be far more common than in the days of paper records. This calls for greater vigilance on the part of judicial officers in striking the right balance between the government’s interest in law enforcement and the right of individuals to be free from unreasonable searches and seizures. The process of segregating electronic data that is seizable from that which is not must not become a vehicle for the government to gain access to data which it has no probable cause to collect. In general, we adopt Tamura’s solution to the problem of necessary over-seizing of evidence: When the government wishes to obtain a warrant to examine a computer hard drive or electronic storage medium in searching for certain incriminating files, or when a search for evidence could result in the seizure of a computer, see, e.g., United States v. Giberson, 527 F.3d 882 (9th Cir. 2008), magistrate judges must be vigilant in observing the guidance we have set out throughout our opinion, which can be summed up as follows:

1. Magistrates should insist that the government waive reliance upon the
plain view doctrine in digital evidence cases. See p. 11876 supra.

2. Segregation and redaction must be either done by specialized personnel or
an independent third party. See pp. 11880-81 supra. If the segregation is to
be done by government computer personnel, it must agree in the warrant
application that the computer personnel will not disclose to the
investigators any information other than that which is the target of the
warrant.

3. Warrants and subpoenas must disclose the actual risks of destruction of
information as well as prior efforts to seize that information in other
judicial fora. See pp. 11877-78, 11886-87 supra.

4. The government’s search protocol must be designed to uncover only the
information for which it has probable cause, and only that information may
be examined by the case agents. See pp. 11878, 11880-81 supra.

5. The government must destroy or, if the recipient may lawfully possess it,
return non-responsive data, keeping the issuing magistrate informed about
when it has done so and what it has kept. See p. 11881-82 supra.

Search Warrants and Digital Evidence

From DFI News:

In a recent case scenario, an adult female victim indicated to the police that she had just been sexually assaulted by an adult male subject in his apartment. She stated that the subject forcibly removed her clothing and photographed the sexual assault. A rape kit was collected from the victim along with her clothing. Investigators obtained a search warrant for the subject’s premises and it was executed later that day. The warrant identified the location to be searched, the subject’s apartment, and the property to be seized: the clothing the subject was wearing at the time of the allegation, sheets from the bedroom, and cameras. The apartment was also to be processed for latent fingerprints and potential trace evidence. At the scene, the subject was arrested and advised of his rights. He indicated that no assault occurred and that he and the alleged victim had consensual sex. He further stated that when the alleged victim asked for fifty dollars before leaving, he refused to pay her the money. He claimed an argument pursued and that the alleged victim stated she was going to get him for not paying her the fifty dollars.

Investigators seized clothing, sheets, a digital camera, and processed the apartment for latent fingerprints. In the bedroom, investigators observed an operating laptop computer displaying a picture of the subject and alleged victim engaged in a sexual act. Although the computer was not listed in the warrant, it was seized by the investigators. All the evidence was submitted to a forensic laboratory for analysis. Due to backlogs in the laboratory, the analysis took six weeks to complete. The results were as follows:


(1) The subject’s DNA was identified on swabs from the rape kit.

(2) Fibers consistent with those from the victim’s blouse were found on the subject’s jeans.

(3) Cotton threads on one of the straps on the victim’s bra appeared to be torn.

(4) Two aluminum foil packets containing cocaine were discovered in one pocket of the subject’s jeans.

(5) Dried stains found on the sheets contained a mixture of DNA from the subject and the victim.

(6) Latent fingerprints found in the bedroom were identified as being those of the victim.

(7) Sweepings from the sheets contained fibers which were consistent with those from the victim’s jeans, blouse, and bra.

(8) The digital camera’s memory card contained several pictures of the subject and victim engaged in sexual acts.

(9) No additional pictures of the victim were found on the laptop computer’s hard drive. However, hundreds of other pornographic pictures and movies were found, many of which appeared to depict underage children.

After reviewing the forensic results, investigators additionally charged the subject with possession of a controlled substance and possession of child pornography.

Full article here.

New Tool could Help Computer Forensics Move off the Disk and into Memory

From Government Computer News:

By examining traces of memory resident on a computer, researchers can find evidence of malicious activity.

Tools such as Metasploit’s meterpreter for the automated delivery of stealthy payloads are making it more difficult for researchers to find out after the fact exactly what happened to an exploited computer.

Meterpreter can let an attacker upload malware files to a computer that do not touch the disk, which is where traditional forensics tools look to find evidence of malicious activity.

“Meterpreter breaks all disk forensics,” said Peter Silberman, an engineer at Mandiant Inc. So researchers now are looking into memory for evidence of wrongdoing. “This is a new frontier in forensics analysis.”

Silberman and Stephen Davis, a Mandiant security consultant, demonstrated a new memory analysis tool Wednesday at the Black Hat Briefings security conference. By examining traces of memory that can remain resident on a computer for surprisingly long times, they can find evidence of malicious activity that is not visible elsewhere.

“What this allows us to do is to determine what meterpreter did while it was resident on the system,” Davis said.

The tool, which works with Mandiant’s Memoryze memory analysis software, is not yet a full production product. “It’s a proof-of-concept that hopefully other people will latch onto,” Davis said. The first target of the tool is Metasploit because that is the de facto standard for creating exploits against security vulnerabilities in computers.

Full article here.