Where does Evidence Reside in This Environment?
What evidence sources do you see in this office environment? Here are some of the sources you may wish to consider:
1. Filing Cabinets and Boxes: The files on the shelves behind the desk may contain valuable information relating to the matter being investigated.
2. The Computer on the Desk: Not withstanding point 1, some estimates are that 90% of information is never printed. If it isn’t printed, it won’t be in a physical file, it will be in electronic form. The computer may hold business records, personal records, web browsing activity and messenger usage amongst other items of interest. It may also access a server that contains other files, including email files.
The meta-data such as login attempts, firewall access requests and other information which can assist in determining if a person was performing activities at that place at a given time.
Properly qualified digital forensics professionals should be retained in order to ensure that the digital evidence was acquired properly.
3. The Desk Phone: Digital and Internet Protocol telephone systems may contain call logs, including date and time of calls, as well as the number called or from which the call was received. Those may be valuable pieces of information. What is not pictured in the scene is the individual’s smart phone, which may contain information on calls, emails, web browsing history, text messages, chats, and more.
4. Internet of Things: We haven’t yet determined the impact that the “Internet of Things” will have on investigations. For example if the lights above the desk are “smart lights” which recognize when a person has entered the room; or if they can be turned on remotely, would that activity have an impact on a fact finding exercise?
5. Card Readers and Cameras: There is no camera pictured in the photo, but cameras are often placed at least at the entrance to buildings and parking garages, if not in the entrances to the offices themselves. In addition, badges that have been swiped to enter and exit an office could also contain records of travel which may be useful to an investigation.
These are just five items which should be considered if you or your client is conducting an investigation in an office environment. Proper judicial or administrative authority must be obtained first and then the priority should be to secure the information using properly trained individuals who have the appropriate technology and methodologies. The analysis may be done after.
If you have any questions about the potential sources of evidence identified in this picture, or require a consultation on other investigative or data analysis matters, please contact us.