Highfill - 392 - Policies and Procedures - Investigative Procedures

Question 1

If an officer/detective comes into contact with any digital media device which meets ___________ standards or the device may contain evidence, they should first seek
____________ by completing a ___________, and have the form signed by the owner or the authorized agent of the device.

Answer 1

probable cause
consent to search
Consent to Search Computer(s), Computer Peripherals, & Related Audiovisual or Digital Media/Devices Form (P-0527)

Question 2

Form P-0527 should be _______________ and stored in the ___________.

Note that consent to search ______ valid if the PIN or password to the device is not provided.

Answer 2

retained as evidence
Property and Evidence Facility
is not

Question 3

Regardless of computer knowledge or technical aptitude, an officer/detective __________ search through any digital device or request a complainant, victim, or suspect to search any device acting as an agent of the Jacksonville Sheriff’s Office (JSO). Any search done in this manner could render the evidence ________ in court.

Answer 3

should not

inadmissible

Question 4

Any ___________ who searches through a digital device (scrolling through cell phone image gallery, searching computer internet history, etc.) will __________ in an Incident or Supplement Report.

Answer 4

officer/detective

document the actions taken

Question 5

If Consent to Search Form (P-0527) cannot be obtained, and there exists exigency
and/or facts are known to indicate a crime has been committed using the digital device, __________. A _________ can be obtained later to conduct an examination of the device.

Answer 5

seize the device

search warrant

Question 6

An officer/detective attempting to obtain a search warrant should consult with a ________________ to ensure that a properly structured and worded search warrant is drafted.

Answer 6

Digital Forensic Examiner

Question 7

An officer/detective should ________ inform the owner/agent of a digital device to remove or delete any item(s) from a digital device.

Answer 7

NOT

Question 8

If data, image, or digital evidence is ___________ on a computer or mobile device
screen, the officer/detective should if possible _____________ of what is in plain
view, without manipulating the digital device and consult a digital forensic examiner.

Answer 8

in plain view

take a photograph

Question 9

An officer/detective not assigned to the Computer Forensic Investigations Unit ________
guess or otherwise make __________ to enter the unknown password of a locked
device.

Answer 9

will not

blind attempts

Question 10

Blindly attempting to enter a device may ________ or ________ the device, without warning, and cause permanent evidence destruction that could have been otherwise obtained during
a forensic analysis.

Answer 10

permanently disable

wipe

Question 11

If the digital device is OFF, ____________.

Answer 11

leave it OFF

Question 12

If the digital device is ON, document _________, _______, and _______, without imputing
data into the device.

Answer 12

open screens,
time,
and dates

Question 13

If the digital device is ON, _______ or _________ into the device.
Exception:
There may be times when this cannot be avoided. If this happens, document ________
used and document ______ this step was necessary.

Answer 13

do NOT type
input anything
every step
why

Question 14

An officer/detective should NOT ______ or _______ any type of software or hardware (i.e., flash/thumb drives, external hard drives, etc.).

Answer 14

remove

install

Question 15

When collecting a desktop computer: if it is ON, _________ and simply unplug the power cord from the back of the computer.

*** However, if the computer is on and there is an articulable belief that hard drive(s) are encrypted, ____________ the computer.

Instead, consult with the on-call digital forensic examiner. Encryption may be an issue if the subject of the investigation displays computer knowledge that exceeds that of an average user.

Answer 15

leave it ON

do NOT unplug or power off

Question 16

When collecting a laptop computer: if it is ON, __________ and ____________ first,
then the power cord. Upon removal, do NOT reinsert the battery to prevent accidental
start-up. The same policy concerning encryption applies.

Answer 16

leave it ON

remove the battery

Question 17

Cellular phones and mobile devices (eReaders, tablets, GPS, etc.) should be collected in
the same manner as laptops. Remove the _________ from the device and do ____ reinsert
it. This will prevent remote wipe and GPS tracking by the device owner.

Answer 17

battery

NOT

Question 18

Cellular phones and mobile devices considering that powering off the device
may require __________ when powered back on, it is imperative to obtain the password
before turning the device off.

Answer 18

a password

Question 19

Cell phone and mobile devices: If removing the battery is ________; turn off the device and wrap it in at least ____ layers of aluminum foil. Note, however, that doing so while the device is powered on will quickly drain the battery and could cause damage due to overheating.

Answer 19

not possible

four

Question 20

To prevent evidence tampering and destruction of digital evidence, _________ search through it. Scrolling through __________, __________, and _________ can modify metadata that is vital to the investigation and cannot be unchanged.

Answer 20

do not

messages, images and other files

Question 21

If a seized/obtained device may need a password to gain entry, the _______ receiving the device shall ask the possessor/owner of the device for the ____________.

Answer 21

officer/detective

password

Question 22

An officer/detective should document the name of the individual who provided the information about a seized device even if the password is ________.

Answer 22

unknown or refused

Question 23

If a device’s password is a ________, document the pattern and have it confirmed by the possessor/owner of the device.

Answer 23

swipe pattern

Question 24

Investigations involving computers or any other related device where individuals have user profiles (user accounts), require the investigating officer/detective to obtain all of the user _______ and ________ used on the device.

Answer 24

profile names

passwords

Question 25

When computers are submitted for analysis, the case agent or detective must submit a searchable _________ to the digital forensic examiner conducting the analysis.

Answer 25

keyword list

Question 26

Forensic examinations can have extensive processing times that are subject to change without notice, and owners/agents of electronic devices should NOT be given __________ on the completion of the examination.

Answer 26

specific time frames