WEBVTT

1
00:00:00.000 --> 00:00:03.540
Welcome back to the
Computer Forensics Path.

2
00:00:03.540 --> 00:00:06.900
Today in Course 4, Module 2,

3
00:00:06.900 --> 00:00:10.200
we're going to be talking
about how to make

4
00:00:10.200 --> 00:00:13.785
a preservation request to an
Internet service provider,

5
00:00:13.785 --> 00:00:15.555
and we're going to talk about

6
00:00:15.555 --> 00:00:18.795
the rules governing
consent searches.

7
00:00:18.795 --> 00:00:20.985
Preservation requests.

8
00:00:20.985 --> 00:00:22.650
These are requests we would make

9
00:00:22.650 --> 00:00:24.735
to an Internet service provider.

10
00:00:24.735 --> 00:00:27.380
The first thing you
want to do is you

11
00:00:27.380 --> 00:00:29.840
want to talk to the Internet
service provider in

12
00:00:29.840 --> 00:00:31.760
advance and find out

13
00:00:31.760 --> 00:00:33.230
what information they do

14
00:00:33.230 --> 00:00:35.945
collect as part of
their regular business.

15
00:00:35.945 --> 00:00:38.840
Because if you're looking for
something that they don't

16
00:00:38.840 --> 00:00:41.555
collect as part of
their regular business,

17
00:00:41.555 --> 00:00:43.250
you may be wasting

18
00:00:43.250 --> 00:00:46.800
your time serving them
with legal process.

19
00:00:46.930 --> 00:00:53.435
Most service providers
will talk to you.

20
00:00:53.435 --> 00:00:55.940
It is good to find a point of

21
00:00:55.940 --> 00:00:59.990
contact at these Internet
service providers so

22
00:00:59.990 --> 00:01:02.420
that you can talk to somebody

23
00:01:02.420 --> 00:01:07.530
on a regular basis so you're
talking to the same person.

24
00:01:07.570 --> 00:01:10.865
You may make a
request for them to

25
00:01:10.865 --> 00:01:13.625
preserve this
information for 90 days.

26
00:01:13.625 --> 00:01:15.769
The law allows you 90 days,

27
00:01:15.769 --> 00:01:18.050
but they will preserve
the information

28
00:01:18.050 --> 00:01:19.100
before you serve them

29
00:01:19.100 --> 00:01:23.140
with legal process to
collect the information.

30
00:01:23.140 --> 00:01:25.510
If you go beyond that 90 days

31
00:01:25.510 --> 00:01:28.250
you can ask for an extension.

32
00:01:28.370 --> 00:01:31.985
They can only provide you
information that they

33
00:01:31.985 --> 00:01:34.880
already have, in
their possession.

34
00:01:34.880 --> 00:01:40.480
You can't request that they
preserve future information.

35
00:01:40.480 --> 00:01:44.105
You must have a date range,

36
00:01:44.105 --> 00:01:46.430
a time range, and you must

37
00:01:46.430 --> 00:01:48.815
have an IP address
to go with that.

38
00:01:48.815 --> 00:01:53.065
Because IP addresses are
usually assigned dynamically,

39
00:01:53.065 --> 00:01:58.530
IP addresses will
change during time.

40
00:01:58.530 --> 00:02:04.190
If I have an IP
address today at, say,

41
00:02:04.190 --> 00:02:08.360
01:00 PM and you go six
months down the road and you

42
00:02:08.360 --> 00:02:12.500
ask for information
regarding that IP address,

43
00:02:12.500 --> 00:02:14.300
but you don't have
a date and time,

44
00:02:14.300 --> 00:02:17.210
the IP address may now
belong to someone else,

45
00:02:17.210 --> 00:02:19.310
and you'll be getting
the wrong information.

46
00:02:19.310 --> 00:02:22.235
You have to make sure you
have a date and time range,

47
00:02:22.235 --> 00:02:24.660
and an IP address.

48
00:02:25.460 --> 00:02:30.290
You also will need
to provide some type

49
00:02:30.290 --> 00:02:32.120
of account or ID number

50
00:02:32.120 --> 00:02:34.595
when you ask for
this information.

51
00:02:34.595 --> 00:02:36.830
If you're talking to Facebook,

52
00:02:36.830 --> 00:02:39.440
you're want to have
their Facebook ID.

53
00:02:39.440 --> 00:02:43.640
If you're talking to a
cell phone provider,

54
00:02:43.640 --> 00:02:46.230
you're going to need to have
some type of phone number,

55
00:02:46.230 --> 00:02:48.655
or other identifying information.

56
00:02:48.655 --> 00:02:50.745
But you're going to need all that

57
00:02:50.745 --> 00:02:56.400
to make up this
preservation request.

58
00:02:56.920 --> 00:02:59.840
Consent searches.

59
00:02:59.840 --> 00:03:03.835
You probably are going
to use a consent search,

60
00:03:03.835 --> 00:03:08.045
if you don't have enough
probable cause for a warrant,

61
00:03:08.045 --> 00:03:09.814
that maybe one of the reasons

62
00:03:09.814 --> 00:03:12.020
you may ask for consent search,

63
00:03:12.020 --> 00:03:16.560
if you're just trying to
eliminate somebody as a suspect.

64
00:03:16.560 --> 00:03:19.220
If you're dealing with
a victim or a witness,

65
00:03:19.220 --> 00:03:21.620
you may just ask for
consent to search

66
00:03:21.620 --> 00:03:23.690
their electronic
devices rather than

67
00:03:23.690 --> 00:03:27.210
go for legal process.

68
00:03:27.890 --> 00:03:31.460
The one thing you want to
remember is you do want

69
00:03:31.460 --> 00:03:34.614
to give them an advisement
of their rights,

70
00:03:34.614 --> 00:03:37.275
prior to giving your consent,

71
00:03:37.275 --> 00:03:40.290
and you do want to get
this consent in writing.

72
00:03:40.290 --> 00:03:43.725
A verbal consent is
not a good idea.

73
00:03:43.725 --> 00:03:46.510
You always want to get
your consent in writing,

74
00:03:46.510 --> 00:03:49.565
have them sign a
written consent form.

75
00:03:49.565 --> 00:03:55.360
Remember, consent can be
withdrawn at any time.

76
00:03:55.360 --> 00:03:57.220
Then the person has to have

77
00:03:57.220 --> 00:03:59.320
the ability to
withdraw a consent.

78
00:03:59.320 --> 00:04:04.495
You can't just take their
devices back to your office,

79
00:04:04.495 --> 00:04:07.115
and not answer your phone,

80
00:04:07.115 --> 00:04:09.315
so that they can't
withdraw a consent.

81
00:04:09.315 --> 00:04:12.385
They have to have the ability
to withdraw a consent.

82
00:04:12.385 --> 00:04:15.220
If they do withdraw a consent,

83
00:04:15.220 --> 00:04:17.145
and you haven't found anything,

84
00:04:17.145 --> 00:04:19.625
you must return the property.

85
00:04:19.625 --> 00:04:21.980
If they withdraw
a consent and you

86
00:04:21.980 --> 00:04:24.500
have found evidence of a crime,

87
00:04:24.500 --> 00:04:27.235
that evidence will be admissible,

88
00:04:27.235 --> 00:04:29.540
you can hold on to

89
00:04:29.540 --> 00:04:32.795
that device and apply
it for legal process,

90
00:04:32.795 --> 00:04:34.689
a search warrant or a subpoena,

91
00:04:34.689 --> 00:04:36.995
to continue searching the device.

92
00:04:36.995 --> 00:04:40.040
You want to be in contact

93
00:04:40.040 --> 00:04:43.540
with your prosecutor and advise
them of what's going on,

94
00:04:43.540 --> 00:04:47.550
and follow their advice
in these situations.

95
00:04:47.930 --> 00:04:50.219
In our next module,

96
00:04:50.219 --> 00:04:53.895
we are going to talk about
search warrants and subpoenas,

97
00:04:53.895 --> 00:04:56.150
and how you write them,

98
00:04:56.150 --> 00:04:58.920
and what they must include.