Best VIP Call Girls Noida Sector 40 Call Me: 8448380779
Identifying and Collecting Digital Evidence Webinar
1. Identifying and Preserving
Digital Evidence
Andrew Neal, Regional Director
TransPerfect Legal Solutions
Forensic Technology and Consulting
2. Andrew Neal, CISM, CRISC, CIFI, DABFE, ACE, AME
Andrew Neal has more than 30 years of experience working in
technology, computer security, trade security and investigations.
He holds professional certifications in forensics and security, and is
licensed as a private investigator and security consultant in
multiple states. Andrew has authored articles for several trade
publications including Inside Homeland Security and Managing
Security Today, and has presented at numerous national and
international conferences and seminars. He is an active member of
several professional and community organizations, and often
serves as an instructor or at the board level. He is also a Visiting
Assistant Professor at the University of Texas at El Paso, teaching
digital forensics for the Computer Science Department.
Andrew Neal 214-744-4200
aneal@transperfect.com
3. Agenda
• The When & Why of Digital Forensics
• Terms and Concepts
• Sources of Digital Evidence
• Keys to Digital Evidence Preservation
• Tips for Collection and Analysis
• When to Call for Help
Andrew Neal 214-744-4200
aneal@transperfect.com
4. Why Digital Forensics?
3.8 Billion Email Accounts
120 Emails per Day
2.4 Billion IM Accounts
91% Cell Phone Saturation (2013)
1.2 Billion Mobile Email Users
2 Billion PCs
Andrew Neal 214-744-4200
aneal@transperfect.com
5. Why Digital Forensics?
Today’s Evidence is Found
and Processed
in Digital Format!
Andrew Neal 214-744-4200
aneal@transperfect.com
6. Definitions
Digital Forensics
The Popular Misconceptions
• Access subject device on site.
• Search for data by using the device.
• Gigabytes of data searched in seconds.
• Forensic analysis complete in an hour.
• Only safeguard required is surgical gloves.
Andrew Neal 214-744-4200
aneal@transperfect.com
7. Definitions
Digital Forensics
The acquisition and analysis of data from a digital device or source
using tools and procedures that insure the integrity of the data and
the analysis.
• Data is verifiably protected from change.
• Analysis results are reproducible by a variety of tools.
• Context & purpose determines licensing or legal implications.
Andrew Neal 214-744-4200
aneal@transperfect.com
13. Sources of Digital Data
• Computer hard drives
• Backup media
• Portable devices
• Vehicles
• Other gadgets
Andrew Neal 214-744-4200
aneal@transperfect.com
14. Sources of Digital Data
• Webmail
• Social Media
• Chat and IM Services
• Cloud Storage
• Cloud Software Services
Andrew Neal 214-744-4200
aneal@transperfect.com
17. Key to Evidence Preservation
• Document everything
• Understand the environment
• Use protection
• Validate your tool or process
• Multiple verified copies
Andrew Neal 214-744-4200
aneal@transperfect.com
18. Collection Tips
• 4 Step Process
o Scope
o Plan
o Prepare
o Collect
• You rarely get second chances
• Slow is better than wrong
Andrew Neal 214-744-4200
aneal@transperfect.com
19. Processing and Analysis Tips
• Document everything
• Understand the environment
• Set time expectations
• You can’t prove negatives
• Fact vs. Opinion
• Who was driving?
Andrew Neal 214-744-4200
aneal@transperfect.com
22. Professional Help?
• If the work exceeds your training
• If the timeline is tight
• If the stakes are high
• If you are conflicted out
• If you are unsure of how to proceed
Andrew Neal 214-744-4200
aneal@transperfect.com
23. Steps You Can Take
• Pick a specific focus
• Purchase tools
• Get trained & practice often
• Network with other professionals
• Reach out if you need help
Andrew Neal 214-744-4200
aneal@transperfect.com
24. Thank-you for participating
If you have any questions, please feel free
to email them to:
Andrew Neal, Regional Director, TransPerfect Legal Solutions
Forensic Technology and Consulting
ANeal@TransPerfect.com
Joe Gerard, Vice President Marketing and Sales
j.gerard@i-sight.com
Andrew Neal 214-744-4200
aneal@transperfect.com
