Discussion 3

 

Week 3: Discussion

The United States vs. Carey, 1998

Prologue 

Carey had been under investigation for possible sale and possession of cocaine and his residence as the center of operation. Six (6) months after the last purchase, the law enforcement officers obtained a warrant to arrest him. During the arrest, officers observed in plain view, a device for smoking marijuana in his residence and labeled the unit as marijuana in defendant’s apartment.

Plan of Action

Alerted by these items discovered in Mr. Carey’s apartment, the law enforcement officers asked Mr. Carey to consent to a search of his apartment. In clean and clear language, the law enforcement officers informed him of the intention to obtain a search warrant to search his apartment if Mr. Carey refused permission. After considerable discussion with the officers, Mr. Carey verbally consented to the search and later signed a formal written consent at the Officer’s station.

The search warrant was all-inclusive; thereby, authorized officers to search the filesystems on the computers for names, telephone numbers, ledger receipts, addresses, and vital documentary evidence about the sale and distribution of controlled substances.

Discoveries

1:1. Armed with the consent, the officers returned to Mr. Carey’s apartment the same night and discovered quantities of cocaine, marijuana, hallucinogenic mushrooms; took two computers believed to demonstrate evidence of drug dealing.

1:2. During the examination of Mr. Carey’s computer, investigators found files with sexually suggestive titles and the label ” ” that contained child pornography. 

1:3. In the process, investigators temporarily abandoned the search for evidence about the sale and distribution of controlled substances and focused on child pornography files, and Mr. Carey was charged with one count of child pornography.

 Court Proceeding

• In the appeal, Mr. Carey challenged child pornography count as inadmissible and unacceptable because the computer was taken as the result of a general, warrantless search out of his apartment
• Law enforcement officers contention was the warrant authorized them to search any filesystem on the computer that might contain data and information germane to drug crimes, cocaine, marijuana, hallucinogenic mushrooms, and asserted that child pornography came into plain view during the search. 
• The court concluded that the investigators exceeded the scope of the warrant and reversed Mr. Carey’s conviction.
• The Law enforcement officers adopted “Plain view doctrine” that must have not been extended to embrace wide-ranging search warranties from one item to another until something incriminating emerges.

Precautious

1. Digital forensic investigators must be extremely cautious and avoid breaching the fundamental principle of digital forensic investigation.
2. Digital forensic investigators inadvertently abandoned the search warrant and overstepped the authorized limit of the search warrant.  
3. Investigators engrossed in child pornography files. Notably, Mr. Carey was charged with one count of child pornography.
4. Tactlessly, Digital forensic investigators failed to obtain a new search warrant before conducting extra search on Mr. Carey’s child pornography operation.

Answer All Questions: (1:1 – 1:3)

Question 1:1. Provide a comprehensive plan of action on Mr. Carey’s count germane to drug crimes, cocaine, marijuana, hallucinogenic mushrooms.

Question 1:2. Provide a comprehensive narrative and concluding evidence on Mr. Carey’s use of the computer to compiled names, telephone numbers, ledger receipts, addresses, and vital documentary evidence on the sale and distribution of controlled substances.

Question 1:3. Describe the immediate danger of Mr. Carey’s modus operandi germane to drug crimes, cocaine, marijuana, hallucinogenic mushrooms, and child pornography in a developing rural community?

Chapter 08

©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
Investigative Reconstruction with Digital Evidence

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 8.1 Conceptual view of timeline and relational reconstructions.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 8.2 Diagram depicting intruder gaining access to accounting server.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 8.3 Offender in Europe, victim in the United States, crime scenes spread around the world on personal computers and servers (AOL in Virginia).

Chapter 06
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
Conducting Digital Investigations

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 6.1 A comparison of terminology related to digital investigation process models.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 6.2 Categories of the investigative process model (depicted as a flight of stairs) from Digital Evidence and Computer Crime, 2nd edition.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 6.3 Ó Ciardhuáin’s extended model of cybercrime investigations.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 6.4 High-level framework for FORZA model in Ieong (2006).

Chapter 07
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
Handling a Digital Crime Scene

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 7.1 Relationship between physical and digital crime scenes.

Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 7.2 Tableau hardware duplicator used to acquire evidence from hard drives.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 7.3 Photograph of a Windows mobile device with a scale showing all modes of network communication have been disabled in order to isolate the device.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 7.4 Sketch of multiple servers mounted on a rack.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 7.5 Remote forensic tool used to acquire digital evidence from a computer over the network.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 7.6 FTK Imager Lite running on a live computer to acquire an encrypted volume.

Figure 1.1
Copyright © 2011 Academic Press Inc.
©2011 Eoghan Casey. Published by Elsevier Inc. All rights reserved.
FIGURE 7.7 An overview of the decision process when preserving a computer.