16. Laws and regulations - Evidence

Question 1

Laws and regulations - Evidence

Real Evidence

Answer 1

Tangiable and Physical Objects

• Hard disks
• USB drives
• Servers
• NOT the data

Question 2

Laws and regulations - Evidence

Direct Evidence

Answer 2

Testimony from first hand witness

• witness experienced with their 5 senses

Question 3

Laws and regulations - Evidence

Circumstantial Evidence

Answer 3

Evidence to support;
1. Circumstances for a point
2. Other evidence

• cannot be used to conclusively prove somebody did something

Question 4

Laws and regulations - Evidence

Corroborative Evidence

Answer 4

Not facts on their own
Supports facts or elements of the case

• if you have a number of circumstantial evidences that point to a conclusion, this is corroborative
• Each piece of evidence corroborates the fact that X is likely to have happened

Question 5

Laws and regulations - Evidence

Hearsay

Answer 5

Not first hand knowledge

• Log files are considered hearsay
• Logs however are admissible in a court of law

Question 6

Laws and regulations - Evidence

Best Evidence

Answer 6

1. Accurate
2. Complete
3. Relevant
4. Authentic
5. Convincing

Question 7

Laws and regulations - Evidence

Secondary Evidence

Answer 7

Common in cases involving IT
Logs and documents from systems considered secondary

Question 8

Laws and regulations - Evidence

Evidence Integrity

Answer 8

Integrity cannot be questioned

• Forensics done on copies, never originals
• Check hash of both original and copy before and after forensics
• if hashes do not match, something has changed and cannot be provided in court of law

Question 9

Laws and regulations - Evidence

Chain of Custody

Answer 9

To prove integrity of the data

• Prove that no tampering was done
  1. Who handled it
  2. When did they handle it
  3. What did they do with it
  4. Where did they handle it

Question 10

Laws and regulations - Evidence

Reasonable Searches

Answer 10

Evidence obtained legally

• 4th amendment in US contitution - protects citizens from unreasonable search and seizure
• Court will determine if evidence was obtained legally
• Employees must be aware their actions are monitored

Question 11

Laws and regulations - Evidence

Entrapment

Answer 11

Illegal and Unethical

• someone is persauded to commit a crime they had no intention of

Question 12

Laws and regulations - Evidence

Enticement

Answer 12

Legal and Ethical

• Making committing a crime more enticing
• Person has already broken the law
• Honeypots are a good example of enticement

Question 13

Honeypots and Honeynets

Answer 13

Ensure to have signup from;
1. Senior management
2. HR
3. Legal

• Honeypots and nets present both legal and practical risks