Informant Vol 10 No 2 - 2013 Spring - National White Collar Crime ...

Identifying Electronic EvidenceUSB/Flash DrivesAsuspect is arrested and, while searching, you collecta cell phone, wallet, lighter and a pack of gum.Which of these items may hold digital evidence?All of them.The cell phone is an obvious answer, but a lighter anda pack of gum? Some novelty USB/flash drives are easy tospot, but others are rather clever in their disguises. Thesedevices may be getting smaller and more unusual, but thestorage capacity is growing. For example, flash drives witha terabyte of storage are available to consumers (a terabytecan hold a million one-megabyte photos).Analysts from Sophos®, a digital security company,pulled random flash drives from the Sydney commutertrain station’s lost and found. They discovered that none ofthe drives held critical data; however, they did hold personaldata like photos, employment and financial informationabout the user, their family or friends. They alsodiscovered that none of the drives were password protectedor encrypted, allowing easy access to the data.USB/flash drives can look like action figures, rubberbracelets or other fun items, but developers have also becomecreative in integrating flash drives with items of uselike pens and lighters. NW3C’s Cyber-Investigations 100:Identifying and Seizing Electronic Evidence course teachesinvestigators techniques for identifying digital storagedevices (www.nw3c.org/computer-crime/19).Below are pictures of USB/flash drives that range fromquirky to well disguised. WWW.NW3C.ORG 5