First Responder Training for Investigators on Cybercrime and Electronic Evidence - offline version
-
Day #3
The third day's sessions include the following:
- Session 11 - Procedural Rules under the Budapest Convention
- Session 12 - Search and Seizure
- Session 13 - Search & Seizure Dead Box Scenario
- Session 14 - Search & Seizure Live Data Scenarios
-
1.3 Mo Powerpoint 2007 presentation
By the end of this session delegates will be able to:
- Explain the procedural provisions of the Budapest Convention.
- Explain the importance of conditions and safeguards and the way they can be determined.
- Identify the Budapest Cybercrime Convention Articles in national legislation.
-
7.5 Mo Powerpoint 2007 presentation
At the end of this session participants will be able to:
- Explain the proper planning and preparation of a search raid where digital evidence may be found.
- List the tools and items maybe needed for a search raid where digital evidence may be found.
- Explain how they would secure and document a crime scene where digital evidence occur.
-
12.7 Mo Powerpoint 2007 presentation
At the end of this session participants will be able to:
- Identify sources of electronic evidence based on shown scenarios.
- Describe Standard Operation Procedures for packaging, transport and storage of electronic evidence.
- Differentiate different SOPs based on the type of the device.
- Discuss techniques to check the power status of a computer system.
- Apply general seizure instructions for electronic devices.
-
5.6 Mo Powerpoint 2007 presentation
At the end of this session participants will be able to:
- Define the terms “Volatile Data“, “Transient Data“ and “Live Data Forensics“.
- Explain the value of volatile data for investigations.
- List at least four types of data that would get lost without Live Data Forensics.
- Perform measures of first response when facing a running computer system.
- Name at least four tools to acquire volatile data including Live Response and Boot-DVDs.
- Describe the challenges of encryption and the chances of Live Data Forensics in scenarios involving encryption.
- Discuss the challenges and different legal frameworks in scenarios where data is stored remotely, e.g. cloud services.
- Define the term „Cloud Computing“.
- Compare at least three cloud services.
First Responder Training for Investigators on Cybercrime and Electronic Evidence - offline version
First Responder Training for Investigators on Cybercrime and Electronic Evidence - offline version
Electronic evidence plays a part in almost any type of criminal investigation, and the role of the first responder is crucial in recognising and dealing with this type of evidence in such a way that it is admissible within the criminal justice system. The Council of Europe has developed a good practice guide for electronic evidence to support countries in developing their practices and procedures. This course is designed to:
- provide law enforcement first responders with the knowledge and skills to enable them to recognise and deal with electronic evidence in such a manner that the evidence is preserved for future examination, while retaining its integrity; and to
- identify on-line criminal assets and put in place procedures to seize and confiscate the assets.
The course provides procedural and practical information about the subject matters and concentrates on how these issues impact on the day-to-day work of the delegates.