Welcome back to the Computer Forensics Path. Today in Course 4, Module 2, we're going to be talking about how to make a preservation request to an Internet service provider, and we're going to talk about the rules governing consent searches. Preservation requests. These are requests we would make to an Internet service provider. The first thing you want to do is you want to talk to the Internet service provider in advance and find out what information they do collect as part of their regular business. Because if you're looking for something that they don't collect as part of their regular business, you may be wasting your time serving them with legal process. Most service providers will talk to you. It is good to find a point of contact at these Internet service providers so that you can talk to somebody on a regular basis so you're talking to the same person. You may make a request for them to preserve this information for 90 days. The law allows you 90 days, but they will preserve the information before you serve them with legal process to collect the information. If you go beyond that 90 days you can ask for an extension. They can only provide you information that they already have, in their possession. You can't request that they preserve future information. You must have a date range, a time range, and you must have an IP address to go with that. Because IP addresses are usually assigned dynamically, IP addresses will change during time. If I have an IP address today at, say, 01:00 PM and you go six months down the road and you ask for information regarding that IP address, but you don't have a date and time, the IP address may now belong to someone else, and you'll be getting the wrong information. You have to make sure you have a date and time range, and an IP address. You also will need to provide some type of account or ID number when you ask for this information. If you're talking to Facebook, you're want to have their Facebook ID. If you're talking to a cell phone provider, you're going to need to have some type of phone number, or other identifying information. But you're going to need all that to make up this preservation request. Consent searches. You probably are going to use a consent search, if you don't have enough probable cause for a warrant, that maybe one of the reasons you may ask for consent search, if you're just trying to eliminate somebody as a suspect. If you're dealing with a victim or a witness, you may just ask for consent to search their electronic devices rather than go for legal process. The one thing you want to remember is you do want to give them an advisement of their rights, prior to giving your consent, and you do want to get this consent in writing. A verbal consent is not a good idea. You always want to get your consent in writing, have them sign a written consent form. Remember, consent can be withdrawn at any time. Then the person has to have the ability to withdraw a consent. You can't just take their devices back to your office, and not answer your phone, so that they can't withdraw a consent. They have to have the ability to withdraw a consent. If they do withdraw a consent, and you haven't found anything, you must return the property. If they withdraw a consent and you have found evidence of a crime, that evidence will be admissible, you can hold on to that device and apply it for legal process, a search warrant or a subpoena, to continue searching the device. You want to be in contact with your prosecutor and advise them of what's going on, and follow their advice in these situations. In our next module, we are going to talk about search warrants and subpoenas, and how you write them, and what they must include.
