Week 3 - Stages of Acquisition

Question 1

What are some other names for the Acquisition stage

Answer 1

Capturing
Seizure
Incident Response

Question 2

What is the acqusition stage?

Answer 2

Seizing the devices, hardware and data related to the investigation.

Question 3

TRUE OR FALSE: Digital investigative acquisition follows the same evidence acquisition laws related to normal non-digital evidence.

Answer 3

TRUE.

Question 4

What must be done before a device is collected for acquisition?

Answer 4

It must be deemed legally appropriate to seize for the investigation.

Question 5

What is a data object?

Answer 5

An object or piece of information that has potential data related to the investigation. It is associated with physcial items. It can come in different formats and is used as evidence.

Question 6

What is the definition of Digital evidence?

Answer 6

Information of probative value stored or transmitted in a digital form.

Question 7

What is the definition of Physical evidence?

Answer 7

Items on which data objects or evidence may be stored and/or through which data objects are transferred.

Question 8

What is the definition of Original Digital evidence?

Answer 8

Physical items and the data objects associated with these physical items collected at the time of acquisition.

Question 9

What is the definition of Duplicate Digital evidence?

Answer 9

An accurate digital reproduction of all data objects contained on an original physical item.

Question 10

What is the definition of Copy?

Answer 10

An accurate reproduction of information contained on an original physical item, independent of the original physical item.

Question 11

What principle must be followed during the acquisition of evidence?

Answer 11

It must be ensured that digital evidence is collected, preserved, examined, or transferred in a manner safeguarding the accuracy and reliability of the evidence, law enforcement and forensic organizations must establish and maintain effective quality system. Standard Operating Procedures (SOPs) must be followed.

Question 12

What does SOP stand for?

Answer 12

Standard Operating Procedure.

Question 13

What are SOPs?

Answer 13

They are quality-control guidelines that ensure the integrity of digital investigations by making sure that there are proper case records and that the investigation uses broadly accepted procedures, equipment, and materials.

Question 14

What is the 1st ACPO principle?

Answer 14

Don’t change the original data.

Question 15

What are the main stages of acquisition?

Answer 15

Assessment
Documentation
Seizure/Collection
Chain of custody
Identification
Transportation
Storage

Question 16

What is the assessment stage of acquisition?

Answer 16

The initial assessment of the scene and/or details surrounding the investigation with a specific digital frame of mind. It is the assessment of the devices associated with the scene and the context and/or states they are in. During this stage it is also important to preserve the state of the machines at the scene so they are not tampered with.

Question 17

What might you initially assess about the state of a machine?

Answer 17

Connection to a network
Power connection
Current usage of device (on or off, what programs is it running)
Its means of storage

Question 18

What is the seizure/collection stage of acquisition?

Answer 18

When the relevent devices/machine/data is collected from the scene for further investigation. It is important to record the state of the hardware when there were found (e.g. connectivity of the machine, powered on or off). You may take photographs, label them and keep records. When the items are seizure they are ‘bagged and tagged’ with appropriate labels. This stage can only happen once, so it must be done right.

Question 19

What is the chain of custody stage of acquisition?

Answer 19

The process of documenting the chain of custody and complete journey of the evidence during the investigation. This data is normally maintained in an evidence log, that includes a case number, a brief description, the signature of the individual responsible for the seizure documentation and the data and time collected.
The records will also include how it was collected, who has had possession of it, when did they get possession, when was it handed off and to who, how and where is it stored, who took it out of storage and why. It is meant to protect the integrity of the evidence so that no tampering occurs.

Question 20

When do data objects become evidence?

Answer 20

When so deemed by a law enforcement official or designated agent.