CHFI_CH1 Flashcards
Rule 105
Limited Admissibility, If the court admits evidence that is admissible against a party or for a purpose — but not against another party or for another purpose — the court, on timely request, must restrict the evidence to its proper scope and instruct the jury accordingly.”
Incident Response Flow
Step 1: Preparation for Incident Handling
Step 2: Incident Recording and Assignment
Step 3: Incident Triage
Step 4: Notification
Step 5: Containment
Sep 6: Evidence Gathering and Forensic Analysis
Step 7: Eradication
Step 8: Recovery
volatile data examples
RAM the most volatile data is discarded when the device is powered off. Also system time, logged-on user(s), open files, network information, process information, process-to-port mapping, process memory, clipboard contents, service/driver information, command history, etc.
The Electronic Communications Privacy Act
This act and the Stored Wire Electronic Communications Act are commonly referred together as the Electronic Communications Privacy Act (ECPA) of 1986, which comes under 18 U.S.C. §§ 2510-2523.
SWGDE Principle 1
In order to ensure that digital evidence is collected, preserved, examined, or transferred in a manner that safeguards the accuracy and reliability of the evidence, law enforcement and forensic organizations must establish and maintain an effective quality system.
SWDGE 1.7
Any action that has the potential to alter, damage, or destroy any aspect of original evidence must be performed by qualified persons in a forensically sound manner.
SWDGE 1.6
All activity related to the seizure, storage, examination, or transfer of digital evidence must be recorded in writing and be available for review and testimony.
SWDGE 1.5
The agency must use hardware and software that are appropriate and effective for the seizure or examination procedure.
SWDGE 1.4
The agency must maintain written copies of appropriate technical procedures.
SWDGE 1.3
States SOP’s must generally be accepted or supported by data gathered and recorded in a scientific manner.
SWDGE 1.2
Agency management must review the SOPs on an annual basis to ensure their continued suitability and effectiveness.
SWDGE 1.1
All agencies that seize and/or examine digital evidence must maintain an appropriate SOP document. All elements of an agency’s policies and procedures concerning digital evidence must be clearly set forth in this SOP document, which must be issued under the agency’s management authority.
SOC Workflow
Collection
Ingestion
Validation
Reporting
Response
Documentation
Singapore
Computer Misuse Act
Sarbanes-Oxley Act (SOX) of 2002
An act passed by U.S. Congress in 2002 to protect investors from the possibility of fraudulent accounting activities by corporations. TheSarbanes-Oxley Act (SOX) mandated strict reforms to improve financial disclosures from corporations and prevent accounting fraud.
Rule 1004
Admissibility of Other Evidence of Content: An original is not required and other evidence of the content of a writing, recording, or photograph is admissible if:
a. all the originals are lost or destroyed, and not by the proponent acting in bad faith;
b. an original cannot be obtained by any available judicial process;
c. the party against whom the original would be offered had control of the original; was at that time put on notice, by pleadings or otherwise, that the original would be a subject of proof at the trial or hearing; and fails to produce it at the trial or hearing; or
d. the writing, recording, or photograph is not closely related to a controlling issue.
Rule 1003
Admissibility of Duplicate: A duplicate is admissible to the same extent as the original unless a genuine question is raised about the original’s authenticity or the circumstances make it unfair to admit the duplicate.
Rule 1002:
Requirement of the Original: An original writing, recording, or photograph is required in order to prove its content unless these rules or a federal statute provides otherwise.
Rule 1001: Definitions that apply to this article
(a) A “writing” consists of letters, words, numbers, or their equivalent set down in any form.
(b) A “recording” consists of letters, words, numbers, or their equivalent recorded in any manner.
(c) A “photograph” means a photographic image or its equivalent stored in any form.
(d) An “original” of a writing or recording means the writing or recording itself or any counterpart intended to have the same effect by the person who executed or issued it.
(e) A “duplicate” means a counterpart produced by a mechanical, photographic, chemical, electronic, or other equivalent process or technique that accurately reproduces the original.
Rule 901
Authenticating or Identifying Evidence: In general. To satisfy the requirement of authenticating or identifying an item of evidence, the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is.
Rule 804
Exceptions to the Rule Against Hearsay-When the Declarant is Unavailable as a Witness
Rule 803
Exceptions to the Rule Against Hearsay-Regardless of Whether the Declarant is Available as a Witness: Parts 1-23
Rule 801: Definitions That Apply to This Article; Exclusions from Hearsay
“Hearsay” means a statement that
1. the declarant does not make while testifying at the current trial or hearing and
2. a party offers in evidence to prove the truth of the matter asserted in the statement.
Rule 801 Statements That Are Not Hearsay. Part 2
- An Opposing Party’s Statement. The statement is offered against an opposing party and A. was made by the party in an individual or representative capacity; B. is one the party manifested that it adopted or believed to be true;
C. was made by a person whom the party authorized to make a statement on the subject;
D. was made by the party’s agent or employee on a matter within the scope of that relationship and while it existed; or
E. was made by the party’s coconspirator during and in furtherance of the conspiracy.
The statement must be considered but does not by itself establish the declarant’s authority under (C); the existence or scope of the relationship under (D); or the existence of the conspiracy or participation in it under (E).
Rule 801 Statements That Are Not Hearsay. Part 1
- A Declarant-Witness’s Prior Statement.
A. is inconsistent with the declarant’s testimony and was given under penalty of perjury at a trial, hearing, or other proceeding or in a deposition;
B. is consistent with the declarant’s testimony and is offered:
i. to rebut an express or implied charge that the declarant recently fabricated it or acted from a recent improper influence or motive in so testifying; or
ii. to rehabilitate the declarant’s credibility as a witness when attacked on another ground; or
C. identifies a person as someone the declarant perceived earlier.
Rule 705
Disclosing the Facts or Data Underlying an Expert’s Opinion: Unless the court orders otherwise, an expert may state an opinion — and give the reasons for it — without first testifying to the underlying facts or data. But the expert may be required to disclose those facts or data on cross-examination.
Rule 701: Opinion Testimony by Lay Witnesses
If a witness is not testifying as an expert, testimony in the form of an opinion is limited to one that is:
a. rationally based on the witness’s perception;
b. helpful to clearly understanding the witness’s testimony or to determining a fact in issue; and
c. not based on scientific, technical, or other specialized knowledge within the scope of Rule 702.
Rule 614
Court’s Calling or Examining a Witness: a. Calling. The court may call a witness on its own or at a party’s request. Each party is entitled to cross-examine the witness.
b. Examining. The court may examine a witness regardless of who calls the witness.
c. Objections. A party may object to the court’s calling or examining a witness either at that time or at the next opportunity when the jury is not present.
