±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 34071
New Yesterday: 1 Visitors: 143

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

Procedure for CP evidence?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3 ... 10, 11, 12  Next 
  

Procedure for CP evidence?

Post Posted: Fri Feb 09, 2007 6:20 pm

I think I have some CP images in a case I'm working on. I've been in touch with the po-po and will be providing them with a CD of the images in a face-to-face meeting. So how does this work?

Let's say they determine that the images are indeed CP. Do they then take my DD image disk as well as seize the original computer? How do I then provide evidence for the original case which has nothing to do with CP?

Maybe I should get a honkin big external drive and export everything EXCEPT the suspect images to it?

Inquiring minds want to know...
_________________
Jerry Nicholson, Owner
Mlink.com
www.mlink.com 

OldDawg
Senior Member
 
 
  

Re: Procedure for CP evidence?

Post Posted: Fri Feb 09, 2007 8:21 pm

I'm in a corporate consulting position and I find CP, it's stop, drop, and roll. Stop the examination, drop everything, and roll all data back to the client, with a strong suggestion that they contact local law enforcement.  

keydet89
Senior Member
 
 
  

Re: Procedure for CP evidence?

Post Posted: Sat Feb 10, 2007 3:58 am

How the incident or case proceeds will really depend upon the local LE and the amount/quanity of content, likelyhood of distribution and if any Federal agency become's involved.

I have not been involved with any activity of this nature as a consultant in the private sector.

However, several of my college instructors in Forensics are active members of "Child Exploitation Task Forces". From our discussions they will take whatever you offer them and if they need more, they will ask or get a search warrant! They can ask you without alerting anyone, since you have an image of the hard drive. I would guess that after they have verified the CP, they will issue a search warrant for the original drive.

I would contact my lawyer as a CYA! Just to insure that you know exactly what your legal obligation are concerning local or state regulations and to insure that you are not violating any NDA or other contractual restrictions.

NJ court held that corporations/business are responsible for investigating and reporting CP incidents (victims parents used the corporation that employed the person with CP). A lot of schools and universities are required by state law to report things of this nature.

As a hired consultant for a company or entity, does your state consider your consulting services independent of the company activities, or are you considered a restricted agent of the company?

These are some of the questions I'm going to revisit with my lawyer -- real soon!

Thanks for posting! Things that I thought were cut and dry became awful fuzzy when I stated running this to ground!
_________________
Give a man a fish and he can eat today. Teach the man how to fish and he will be able to eat his whole life. 

az_gcfa
Senior Member
 
 
  

Re: Procedure for CP evidence?

Post Posted: Sat Feb 10, 2007 7:39 am

az_gcfa's advice to take legal advice is undoubtedly sound, there are a number of issues which need to be considered as soon as you suspect that CP has been detected and from a legal perspective there may be things that you are obliged to do and things you are strictly forbidden from doing. As important are your own views about your moral obligations in this kind of situation (it is sometimes forgotten that CP is evidence of a serious crime, regardless of how it came to be on the device in question). Finally, private sector workers need to consider the commercial implications of their actions or inactions (note: I am certainly NOT suggesting that commercial interests take any kind of precedence over legal or moral obligations - far from it - simply that is wise to be aware of any likely impact).

OldDawg, I note you talk about creating a CD with the images. I'm not familiar with the relevant legislation in your location but I would strongly advise you to take legal advice before creating any further copies of the material in question.

Jamie
_________________
Jamie Morris
Forensic Focus
Web: www.forensicfocus.com
Twitter: twitter.com/ForensicFocus
Facebook: www.facebook.com/forensicfocus 

jamie
Site Admin
 
 
  

Re: Procedure for CP evidence?

Post Posted: Sat Feb 10, 2007 1:10 pm

Just an FYI...my response was based on already having contacted corporate counsel and received my manager's advice.

If I have to analyze a drive that is suspected to have CP on it, I will perform as much analysis as I can without looking at images...identifying the locations of image or movie files, etc...all without looking at the image in Gallery mode.

Speaking of impact...if I were to take an image and go straight to the police with it, there would be significant impact...my employer could be sued, I may be sued, and I most definitely will be fired.

Harlan  

keydet89
Senior Member
 
 
  

Re: Procedure for CP evidence?

Post Posted: Sat Feb 10, 2007 4:04 pm

In my one and only experience with CP, we called the corporate atty, who called the FBI. They came and seized the suspect laptop, the external drive that contained the image of the laptop and the CD I burned my report to (which contained CP images).

I was able to keep my forensic workstation only by running an eraser program (DOD 7 pass) on the report files and free space. This was done under the supervision of the FBI agent.  

psu89
Senior Member
 
 
  

Re: Procedure for CP evidence?

Post Posted: Sat Feb 10, 2007 4:08 pm

FWIW;
In my contract with my clients, in my Confifentiality clause, it states that in the event of CP appearing during my exam, the confidentiality claused is waived without notification to the client and LE will be contacted and ALL client materials turned over to them.

This is because I had this happen once. The Feds I dealt with made it clear that if II had returned items to the client, I would have been charged with coveyance of CP. So wise thing for me is to have it in the contract upfront.

Bill
_________________
Replicants are like any other machine - they're either a benefit or a hazard. If they're a benefit, it's not my problem 

deckard
Senior Member
 
 

Page 1 of 12
Go to page 1, 2, 3 ... 10, 11, 12  Next