Expert: Chris Wagoner - 11/5/2007

Question
Dear Sir,

I am a student and have some questions with regard to the laws related to computer forensics.

1. What are the issues associated with gathering forensic information in conducting an enquiry in a multi-national company whose offices are located in different countries? Are the issues different in European and non-European countries?

2. Who should we go for guidance? Is it the FBA?

3. Do we have to inform the suspected individuals that we are gathering information from their PC's?

4. How does membership in the Safe Harbor program affect the data collection and transfer issues?

5. What are the issues related to the transport of physical hard drive images ... risk of loss?  What should be done to prevent such problems?

I searched everywhere on Internet and could not find any thing useful. Sir,if you are not in a position to answer the above questions, pls give me some websites that I should go find.

Thank you in advance

Chaminda Perera

Answer
Hi Chaminda,
You have asked some very good questions and I will try to answer them fully for you.

1. What are the issues associated with gathering forensic information in conducting an enquiry in a multi-national company whose offices are located in different countries? Are the issues different in European and non-European countries?

As for the locations of the offices, it really does not create a lot of problems. Computer Forensics is targeted to computer hard drives and all one has to do is be able to access or acquire the hard drives or data storage devices in question. An investigator could simply travel to each office needed to image or acquire the drives in question.

2. Who should we go for guidance? Is it the FBA?

The most used resource for guiding the searching and seizing electronic is http://www.cybercrime.gov/s&smanual2002.htm A manual put out by the United States Department of Justice.

3. Do we have to inform the suspected individuals that we are gathering information from their PC's?

The rule here is not if the computers are the property of a company or organization. If the computer is a personal PC then yes, if a company or school or other such entity, then no.

4. How does membership in the Safe Harbor program affect the data collection and transfer issues?

As far as I know, Safe Harbor is designed to set standards for data transfer between companies and individuals, not to protect people using company computers from have the computers examined when needed. You can check here for more on Safe Harbor: http://www.export.gov/safeharbor/

5. What are the issues related to the transport of physical hard drive images ... risk of loss?  What should be done to prevent such problems?

The best and most secure way of making images of suspect hard drives is on site using a drive duplicator. Image the drive and then transport both, that way if one is damaged or lost, the other is still intact. If really important, a third DVD copy (the image burned to DVD’s) could be made, then sent via a separate method of transport (international delivery service or mail) to ensure the very best chance of safe receipt of an image of the HD in question.

I hope I answered what you needed. If you have more or follow-up questions, feel free to ask more questions. I would be happy to answer them.

Here is a list of links that may help give you some information:
http://68.156.151.124/documents/swgde2006/Best_Practices_for_Computer_Forensics%...
http://www.isfs.org.hk/publications/ComputerForensics/ComputerForensics_part2.pd...

And the best resource there is for this topic, and where I got most of my training and information: http://www.usdoj.gov/criminal/cybercrime/searching.html

I would appreciate it if you would take the time to rate my answer, I appreciate the feedback. Thank you so much.