ETX 20 Lecture Notes - Deconstruction, Special Master, Digital Forensics
11 Mar 2014
School
Department
Course
Professor
Document Summary
Tradiaitonal forensics: recover information from the media, computers, cell phone, vehicles, cloud. New: deconstruction of apps/programs to understand data sets being collected. Imaging the hard drive/media (very important to replicate it: make a copy/extracting data (much harder than making a copy, esp cell phones. Two different issues (validating the data) (how we got them not an issue) What should you review the warrant for: property/items to be searched for, problems/issues with the warrant, search limitations. What is the ten day rule: a search warrant shall be executed and returned within 10 days after date of issuance, review of the seized property is not guaranteed. If it is not done within 6 months generally, but that can be stretched. Which is better: imaging or taking: making an imace copy on site, preferred by courts, not by da"s. Do not write in search methodologies because it will impair the ability to search. Write that you want no limitations of the search.
