Welcome back to the computer forensics path, Core 6, Module 3. We're going to talk about recognizing digital evidence. Digital evidence can best be described as anything that is capable of holding data. Of course, we're talking about computers, and tablets, and cell phones, but we're talking about routers, watches, cameras, internal and external devices, smart devices like refrigerators, televisions, Nest, Echoes, SD cards, thumb drives, any devices capable of holding data. It may not be obvious. We can see up here on the screen that we need to be aware of hidden drives. You can see some of these examples of flash drives that can be hidden in jewelry, things that look like keys, things that look like coins, bracelets, necklaces. We really need to be aware that electronic media storage is getting smaller and smaller and thus more easy to hide these devices. Storage items. Now, these are very small storage items. This is a micro SD card here in this picture. It is a terabyte in size, a terabyte. That's amazing, but scary too. A micro SD card, I'm sure everybody knows it's very small. We could overlook a terabyte of data by missing one micro SD card. The other picture depicts a SanDisk thumb drive, which is like a mini thumb drive. This also is a very high capacity, I believe it's 500 gigabytes. That's crazy, that these devices can be so small yet hold such a large amount of data and they can be very easily missed during a search warrant. You want to make sure you look very carefully when you're searching your scene. Computers too are getting smaller. This is a picture of what they call the atom computer. It is 1.5 inches wide. That's how small this thing is. It's really, really tiny yet it actually has a quad-core processor in it. You can see the specification up here. It supports Windows 10 OS, it has an HDMI graphics card, it also has a micro SD card reader, it has a USB 2 port, it is 32 gigabytes of flash memory. It's scary to think. It has wireless capabilities and yet it's tiny. It's not much bigger than a standard size thumb drive. It is a fully functioning computer capable of running Windows 10. We do need to be aware that these types of devices are out there and be on the lookout for them when we're executing our search warrants. Wireless networks. You definitely want to make sure that you've done some wireless network scanning prior to executing a search warrant. But while you're there, you definitely want to make sure you can account for every Internet-capable device in that home or a business. You do want to scan the scene for Internet-connected devices. Again, we want to account for every device that is capable of connecting to the Internet. We want to isolate these devices, get them off the network as soon as possible. Now there is one exception to this and this comes into knowing what type of case you're investigating. If you're investigating a case that involves a lot of Cloud storage and you're looking at, say, a residence and you want to know what's in their Google Drive or your case revolves around something that is Cloud storage or maybe social media-based. Most users, their home computers will auto log into a lot of these accounts. Now, make sure you're staying within the scope of your warrant. But if your warrant does cover these types of Cloud accounts, before you break that Internet connection, you do want to see if you can collect some live data from these accounts and do some live imaging and get information from these Cloud accounts. That's going to be the only exception on isolating your devices ASAP, getting devices off the network. Again, make sure you stay within the scope of your legal process. Know what you can and can't do and if you have a question, contact your supervisor or prosecutor. In our next module, we're going to talk about the proper collection of digital evidence. How we're going to collect this evidence without altering it.
