Company Parking Lot For Digital Evidence

While conducting the business check, I was alerted by Walmart Loss Prevention Officer, Marion Edwards, that a White, GMC Yukon, that was missing the front bumper was involved in an attempted theft of a coffee maker approximately two weeks prior. Edwards requested that I make contact with the vehicle, which was parked in row #7 in the Walmart parking lot. Edwards was requesting that I issues a trespass warnings to the vehicle's occupants.

The legal right is with the officers which allows them to search passenger compartments which are found in the suspect’s vehicle. If officer feels that adequate suspicion exist, they have every right to conduct limited suspect search. Vehicles can be searched by the officials without a warrant, if they have the probable cause with them as per the fourth amendment.

Once on scene I observed the described black Ford F-150 pickup truck. The truck was positioned facing westbound and in the roadway on the unit block of East Laurel Street, where Laurel Street intersects with Main Street (State Route 924). An ambulance was requested to the scene for the male operator who was unresponsive. Emergency personnel removed the male from the vehicle. During this time I attempted to identify the male. I requested the owner's information from the Pennsylvania

My transportation manager has been on the phone Saturday & Sunday trying to locate the keys. Police and Towing are pointing fingers at each other (weekend understand that staff is limited)

As is the case with any type of evidence seizure, what is fair game and what is off limits needs to be identified and set, preferably in writing before any work is done. (Nelson, Phillips, & Steuart, 2015). This ensures that the forensics team will be protected in the worst case scenario where the company could have an issue with what was taken, very similar to the protection ethical hackers require when performing a penetration test (##). Once this list is created, the team will interview the system administrators to provide any information allowed about the systems such as the equipment, system baselines, passwords that are allowed to be shared, and any special information that would need to be known before analyzing the system such as what information is logged and where would it be stored (Rowlingson, 2004). The entire purpose of this information gathering is to paint a clearer picture of the situation so a more detailed plan could be devised prior to any systems being touched.

On 05/30/2015, at approximately 1816 hours, your affiant observed a silver Chevrolet Classic occupied by two males. The vehicle circled the block in a counterclockwise manner, repeating a portion of their route. During this time I located the owner of the vehicle utilizing a search through the Pennsylvania Department of Transportation. The registration indicated the plate belonged to another vehicle and registered to Brittney Fisher, who was not an occupant in the vehicle. I activated my emergency lights initiating a vehicle stop in the 100 block of West Washington Street and while stopping the vehicle I observed the passenger making furtive movements towards the center console.

Obregon, the Tenth Circuit addressed the same issue in United States v. Roper, 918 F. 2d 885, 887-88 (10th Cir. 1990). In Roper, someone who was not an authorized driver gave the defendant permission to use the rental vehicle. Id. Here, the court held the defendant had no standing to challenge the search of the rental vehicle since the defendant “was not the owner nor was he in lawful possession or custody of the vehicle.” Id. at 888. In a similar case, United States v. Wellons, the Fourth Circuit held the defendant did not have standing to challenge the search of his rental vehicle. United States v. Wellon, 32 F.3d 117, 119–20 (4th Cir. 1994). While traveling with two other individuals the defendant was stopped by a police officer and was unable to produce a rental agreement. 
Id. The police officer then verified with Hertz that the defendant was not an authorized driver of the vehicle and as a result the police officer searched the car and located cocaine inside of some luggage. Id. at 119. The court reasoned that the defendant had no standing because he was not listed on the rental agreement and the rental agreement did not allow unauthorized drivers to use the vehicle. Id. According to the court, it did not matter whether the defendant had permission from the authorized driver to use the rental vehicle because the defendant needed the permission of the rental company. Id. at 120. Here, the court analogized an unauthorized driver of a rental car to the driver of stolen vehicle. Id. In both situations neither individual would have a reasonable expectation of privacy because neither of them have the legal right to drive the vehicle. Id. at

The hard drive on the desk would be a good third source of digital evidence to seize. Assuming this hard drive is used for additional storage (i.e. does not have an Operating System on it), it would contain data similar to that which would’ve been on the USB Flash Drive: documents, images, videos, and maybe even some software files. Documentation should be done on the make, model, serial number and type (e.g. SATA, IDE, SCSI) of hard drive. For transportation, again, place into a static shock protective bag. Remember to keep the hard drive away from anything magnetic as the platters that are inside the hard drive are magnetically charged (U.S. Department of Justice, 2008).

The office can’t search a car of individual with no reason or without proper evidence/cause.

For a police officer to search a car, he should “reasonably believe” that passengers might be carrying something. They do not need a warrant because cars are not houses. (Maryland v. Dyson, U.S Sup. Ct. 1999) (Searches and Seizures: The Limitations of the Police, n.d.)

If the police have probable cause, the car may be searched. If they don't, the driver can refuse this search. Save any documentation provided by the police during this stop, as it may be needed in the future.

Decanter’s s. 8 rights were engaged when the search occurred. According to R v Mellenthin, [1992] 3 SCR 615, “a visual inspection of the interior of the vehicle would not in itself constitute a search.” In other words, the officer was legally allowed to look into the vehicle and notice the powder on the dashboard; Mr. Decanter’s s. 8 rights were only evoked when the officer physically searched the vehicle.

When was the last time she accessed her computer? What is her background in computers, what is her skill level? I need some background on the former employee, her computer habits and activities prior to the files being found on her computer. I must collect digital evidence while keeping the data unaltered, first thing. This data will be used later in the prosecution of the case. This can be done through calculating and recording an evidence file. Next is imaging of the computer media with a write-blocking tool. I must keep the chain of custody. The computer's RAM is examined for evidence. During the examination step, verify and catalog the presence and integrity of the original evidence and any copies. An analysis is made with specialized equipment to find out exactly what's stored on the digital media. This includes a manual review of all materials found on the media, a review of the Windows registry, techniques to crack passwords and retrieve protected data, keyword searches and extraction of email and pictures for further review.

To my knowledge from interning and being employed at various law enforcement agencies, it is a crime to use company property such as gasoline to fuel personal vehicles which are not being used for work related encounters. I believe the officer who saw the officer stealing the gas should confront him. The officer whom is committing the wrongful act may concoct an excuse or lie which would think in terms of be generalism. Some may say the officer whom witnessed the theft should practice Antinomianism, who are we to judge whether the acts of others are right and wrong (basically mind your own business). I believe if the officer is stealing the gas for an emergency such as a hurricane evacuation then the act may be acceptable (situationism). I

As the InfoSec Specialist, you wouldn’t be looking for a search warrant before going into his work area. “It is important to note that