1 1 00:00:00,270 --> 00:00:01,870 Chain of Custody. 2 2 00:00:03,419 --> 00:00:04,252 Now, this is a term that came 3 3 00:00:04,252 --> 00:00:05,760 out long before we had computers 4 4 00:00:05,760 --> 00:00:07,810 and long before we had digital forensics. 5 5 00:00:08,668 --> 00:00:10,620 But the same principle is going to apply here 6 6 00:00:10,620 --> 00:00:12,240 inside digital forensics, too. 7 7 00:00:12,240 --> 00:00:14,610 Because digital forensics produces evidence for us, 8 8 00:00:14,610 --> 00:00:17,580 and evidence has to maintain a chain of custody. 9 9 00:00:17,580 --> 00:00:19,320 When I talk about a chain of custody, 10 10 00:00:19,320 --> 00:00:22,323 this is the record of evidence history from collection, 11 11 00:00:23,257 --> 00:00:25,680 to presentation in court, all the way through to disposal. 12 12 00:00:25,680 --> 00:00:26,940 Everything we do with that piece 13 13 00:00:26,940 --> 00:00:30,090 of evidence, from birth to death, has to be covered. 14 14 00:00:30,090 --> 00:00:31,200 Now, if you're like most of us, 15 15 00:00:31,200 --> 00:00:32,700 you've probably seen TV shows 16 16 00:00:32,700 --> 00:00:34,470 or movies where a police officer goes 17 17 00:00:34,470 --> 00:00:37,020 into a scene and they find the smoking gun 18 18 00:00:37,020 --> 00:00:38,610 and they want to collect that as evidence. 19 19 00:00:38,610 --> 00:00:40,170 They pick up the gun using their pants. 20 20 00:00:40,170 --> 00:00:41,370 They don't get their fingerprints on it 21 21 00:00:41,370 --> 00:00:43,620 'cause they don't want to contaminate the evidence, right? 22 22 00:00:43,620 --> 00:00:45,630 And they put it into an evidence bag. 23 23 00:00:45,630 --> 00:00:47,040 Now, on that bag, they will end 24 24 00:00:47,040 --> 00:00:49,920 up signing their name to show evidence was started 25 25 00:00:49,920 --> 00:00:50,797 at this point. 26 26 00:00:50,797 --> 00:00:54,030 "I collected this gun at this time from this place," 27 27 00:00:54,030 --> 00:00:56,517 and that's what they'll write on the bag. 28 28 00:00:56,517 --> 00:00:57,350 Well, that's the whole idea here 29 29 00:00:57,350 --> 00:00:59,123 when we start dealing with the chain of custody, 30 30 00:01:00,026 --> 00:01:01,170 and it's the same thing for us in the computer world. 31 31 00:01:01,170 --> 00:01:02,400 For instance, if you're working 32 32 00:01:02,400 --> 00:01:03,720 for law enforcement and they went 33 33 00:01:03,720 --> 00:01:06,390 into a suspect's home and collected their computer, 34 34 00:01:06,390 --> 00:01:08,160 they're going to bag it and tag it 35 35 00:01:08,160 --> 00:01:10,650 and collect that as evidence, the physical machine. 36 36 00:01:10,650 --> 00:01:12,300 And then you're going to take that hard drive 37 37 00:01:12,300 --> 00:01:15,180 and start doing the analysis of the data on the hard drive. 38 38 00:01:15,180 --> 00:01:17,610 And when you take that hard drive from the evidence 39 39 00:01:17,610 --> 00:01:20,130 you have to log that you have that hard drive now 40 40 00:01:20,130 --> 00:01:22,170 because every place that hard drive goes 41 41 00:01:22,170 --> 00:01:24,844 and every place that computer goes that was collected 42 42 00:01:24,844 --> 00:01:27,390 as evidence has to be logged as it goes from place to place. 43 43 00:01:27,390 --> 00:01:29,190 Now, if you're dealing with something sensitive, 44 44 00:01:29,190 --> 00:01:32,310 like a hard drive or some kind of a circuit board 45 45 00:01:32,310 --> 00:01:34,710 or a solid state device or something like that, 46 46 00:01:34,710 --> 00:01:36,960 you want to put it into a specialized evidence bag, 47 47 00:01:36,960 --> 00:01:39,540 not the big brown paper bag I just showed you. 48 48 00:01:39,540 --> 00:01:41,310 These specialized evidence bags are used 49 49 00:01:41,310 --> 00:01:43,440 for electronic media to ensure that they cannot 50 50 00:01:43,440 --> 00:01:46,353 be damaged or corrupted by electrostatic discharge. 51 51 00:01:47,298 --> 00:01:48,780 Now, another type of specialized bag you might see is 52 52 00:01:48,780 --> 00:01:50,370 what's called a Faraday bag. 53 53 00:01:50,370 --> 00:01:53,020 Normally, if we're taking something like a cell phone 54 54 00:01:54,441 --> 00:01:55,842 or something that has a radio chip in it, 55 55 00:01:55,842 --> 00:01:56,850 we will put it in an evidence bag and then put 56 56 00:01:56,850 --> 00:01:58,990 that evidence bag inside the Faraday bag 57 57 00:01:59,948 --> 00:02:02,460 to block any external signals from getting in. 58 58 00:02:02,460 --> 00:02:04,228 I wouldn't want somebody sending a remote wipe 59 59 00:02:04,228 --> 00:02:05,430 of their cell phone when I have their phone in custody 60 60 00:02:05,430 --> 00:02:07,200 and I haven't taken it for evidence yet. 61 61 00:02:07,200 --> 00:02:09,630 So that's the idea of a Faraday bag as well. 62 62 00:02:09,630 --> 00:02:11,190 Now, when we deal with criminal cases 63 63 00:02:11,190 --> 00:02:14,580 or internal security audits, these things can take a long 64 64 00:02:14,580 --> 00:02:18,300 long time, sometimes months or years to resolve. 65 65 00:02:18,300 --> 00:02:20,940 And the entire time this is happening, we have to hold 66 66 00:02:20,940 --> 00:02:22,860 onto this evidence and keep track of it, 67 67 00:02:22,860 --> 00:02:24,240 and we need to know where it is. 68 68 00:02:24,240 --> 00:02:26,280 So we need to make sure we identify it, we bag it, 69 69 00:02:26,280 --> 00:02:29,130 we seal it, we label it, and we know exactly where it is 70 70 00:02:29,130 --> 00:02:30,870 at all times. 71 71 00:02:30,870 --> 00:02:32,940 Now, one of the reasons I bring up this lengthy period 72 72 00:02:32,940 --> 00:02:35,550 of time is that you have to be careful to take care 73 73 00:02:35,550 --> 00:02:36,960 of the information that you're collecting 74 74 00:02:36,960 --> 00:02:38,610 and the evidence you're collecting. 75 75 00:02:38,610 --> 00:02:42,090 For example, if IFC has a bunch of backup tapes as evidence, 76 76 00:02:42,090 --> 00:02:44,760 that is magnetic media and I need to protect it 77 77 00:02:44,760 --> 00:02:48,030 to make sure it doesn't fail over time or become corrupted 78 78 00:02:48,030 --> 00:02:49,650 based on where we store it. 79 79 00:02:49,650 --> 00:02:51,510 I actually have a sad example of this 80 80 00:02:51,510 --> 00:02:53,640 of storing information incorrectly. 81 81 00:02:53,640 --> 00:02:56,850 When I was a child, my father and mother had filmed me 82 82 00:02:56,850 --> 00:02:57,683 as a baby. 83 83 00:02:57,683 --> 00:03:00,270 You know, baby videos, and they put this on VHS tapes. 84 84 00:03:00,270 --> 00:03:02,190 Well, those VHS tapes are made 85 85 00:03:02,190 --> 00:03:03,300 out of essentially the same stuff 86 86 00:03:03,300 --> 00:03:05,250 as a backup tape for a computer. 87 87 00:03:05,250 --> 00:03:06,450 They didn't store it properly. 88 88 00:03:06,450 --> 00:03:08,880 And so when we tried to watch it about 20 years later, 89 89 00:03:08,880 --> 00:03:11,670 what happened was it jammed up the VCR and ate the tape. 90 90 00:03:11,670 --> 00:03:13,830 And so we can't watch that baby footage anymore. 91 91 00:03:13,830 --> 00:03:15,600 If that happened in a court case, 92 92 00:03:15,600 --> 00:03:17,760 that case could actually get thrown out of court. 93 93 00:03:17,760 --> 00:03:21,000 And some court cases do go on 10, 15, 20 years 94 94 00:03:21,000 --> 00:03:22,470 or the person goes to jail, 95 95 00:03:22,470 --> 00:03:24,810 and they go on appeal time and time again. 96 96 00:03:24,810 --> 00:03:26,490 And it may be something that was a life sentence 97 97 00:03:26,490 --> 00:03:28,770 for instance, and now they can get out 98 98 00:03:28,770 --> 00:03:31,209 because the evidence got corrupted. 99 99 00:03:31,209 --> 00:03:32,042 So you need to make sure you're taking care 100 100 00:03:32,042 --> 00:03:34,590 of this and think about humidity and temperature 101 101 00:03:34,590 --> 00:03:37,320 and where all this stuff is going to be stored securely. 102 102 00:03:37,320 --> 00:03:38,880 Now the other problem with evidence is 103 103 00:03:38,880 --> 00:03:41,730 that it can become a lot of information, right? 104 104 00:03:41,730 --> 00:03:44,760 The amount of evidence collected can become extremely large. 105 105 00:03:44,760 --> 00:03:45,630 If you think about some 106 106 00:03:45,630 --> 00:03:48,810 of the big white collar crimes like Enron or WorldCom 107 107 00:03:48,810 --> 00:03:50,730 that happened in the early 2000s. 108 108 00:03:50,730 --> 00:03:52,585 They had boxes and boxes and boxes 109 109 00:03:52,585 --> 00:03:55,920 of paperwork and files and hard drives and everything else, 110 110 00:03:55,920 --> 00:03:58,410 and all of that has to be stored someplace. 111 111 00:03:58,410 --> 00:04:00,360 So you need to make sure you have an adequate place 112 112 00:04:00,360 --> 00:04:02,760 to do it that is safe and secure. 113 113 00:04:02,760 --> 00:04:05,460 Also, when you're dealing with large amounts of information, 114 114 00:04:05,460 --> 00:04:07,320 you need a way to organize it 115 115 00:04:07,320 --> 00:04:09,120 so you can identify what it is. 116 116 00:04:09,120 --> 00:04:11,933 If you get called up to court and they say, 117 117 00:04:11,933 --> 00:04:13,680 "Hey, I need the evidence on John Smith's trial 118 118 00:04:13,680 --> 00:04:15,030 and I need this particular piece 119 119 00:04:15,030 --> 00:04:16,860 of evidence that you collected," you now need 120 120 00:04:16,860 --> 00:04:19,110 to be able to find it in this mountain of stuff. 121 121 00:04:19,110 --> 00:04:21,600 And so one of the ways we do this is by having metadata, 122 122 00:04:21,600 --> 00:04:23,640 which is data about the data. 123 123 00:04:23,640 --> 00:04:26,250 This is a way for you to self-describe the information 124 124 00:04:26,250 --> 00:04:28,410 that's contained in it with some kind of a code 125 125 00:04:28,410 --> 00:04:29,820 or some kind of a system. 126 126 00:04:29,820 --> 00:04:31,200 Now, one of the things I like to include 127 127 00:04:31,200 --> 00:04:34,260 on all my evidence is a proper label of what it is, 128 128 00:04:34,260 --> 00:04:36,750 a short description of what is inside of it 129 129 00:04:36,750 --> 00:04:38,310 and why it's important to me, 130 130 00:04:38,310 --> 00:04:39,780 and then some kind of a date, 131 131 00:04:39,780 --> 00:04:43,020 such as year, year, year, dash month, month 132 132 00:04:43,020 --> 00:04:47,100 dash day, day, colon, hour, hour, colon, minute, minute. 133 133 00:04:47,100 --> 00:04:49,320 So, for example, when I filmed this video 134 134 00:04:49,320 --> 00:04:54,320 it was 2020 July 12th at 9:45 at night. 135 135 00:04:54,570 --> 00:04:55,800 And you can tell that based on 136 136 00:04:55,800 --> 00:04:58,216 that time, date, code that I would have. 137 137 00:04:58,216 --> 00:04:59,250 And so if I was collecting this as evidence, 138 138 00:04:59,250 --> 00:05:01,200 I would attach that time, date, code so I'd know 139 139 00:05:01,200 --> 00:05:02,790 when I collected that evidence. 140 140 00:05:02,790 --> 00:05:03,840 The final thing we need to think 141 141 00:05:03,840 --> 00:05:05,670 about when we store evidence is where are we 142 142 00:05:05,670 --> 00:05:07,890 going to store it that is safe and secure. 143 143 00:05:07,890 --> 00:05:09,570 So in addition to things like temperature 144 144 00:05:09,570 --> 00:05:11,940 and humidity and moisture and all of that, 145 145 00:05:11,940 --> 00:05:13,620 we also want to make sure it's secure 146 146 00:05:13,620 --> 00:05:15,840 from somebody trying to steal the evidence. 147 147 00:05:15,840 --> 00:05:17,880 Again, I'm sure you've seen all the movies 148 148 00:05:17,880 --> 00:05:19,110 where the bad guys go 149 149 00:05:19,110 --> 00:05:21,450 into the police station to destroy the evidence 150 150 00:05:21,450 --> 00:05:23,100 and they break into the evidence lock-up 151 151 00:05:23,100 --> 00:05:24,960 and they take the drive and they corrupt it, 152 152 00:05:24,960 --> 00:05:27,570 and now the bad guy is going to get out on the street. 153 153 00:05:27,570 --> 00:05:28,680 We don't want that to happen. 154 154 00:05:28,680 --> 00:05:30,270 So when you're dealing with law enforcement, 155 155 00:05:30,270 --> 00:05:32,400 they're going to have secure places to lock it up. 156 156 00:05:32,400 --> 00:05:34,680 If you're dealing with employees and insider threats, 157 157 00:05:34,680 --> 00:05:36,090 you need to have a secure place to lock up 158 158 00:05:36,090 --> 00:05:37,350 your information as well. 159 159 00:05:37,350 --> 00:05:39,935 So these are things you need to think about 160 160 00:05:39,935 --> 00:05:41,283 as an organization and if you're working 161 161 00:05:41,283 --> 00:05:42,300 in the forensic world where you're going to store 162 162 00:05:42,300 --> 00:05:45,150 all this information, and remember to keep a record of it 163 163 00:05:45,150 --> 00:05:48,050 from cradle to death because that's your chain of custody.