Posted: March 14th, 2017

A user could be understandably upset during the course of an investigation if racy photos or e-mail conversations between a significant other becomes exposed.

If I were directed to check an electronic device for forensic evidence there would be a series of checks that would have to be cleared prior to accessing those devices. Regardless of the device, I would have to have the proper authorization to access the devices. From law enforcement prospective, I would have to have a judge’s authorization in a form of a search warrant. I would have to follow the scope of the search warrant. If I was directed to search an employee’s computer I would have to follow the organization’s policies and also make sure that I am not violating the employee’s right to privacy. Many organizations have a User Agreement and an Acceptable Use Policy (AUP) and many of them outline that the user may be monitored and that the organization reserves the right to search the device in an investigation. Common devices that are targets of forensic evidence are computer workstations and mobile phones. Many people use both on a daily basis and access to both devices would give a very a good view into a person’s daily activities. A user’s work computer and issued cell phone would be subject to a user agreement and AUP. However, when investigating the user for a specific instance, the organization may not search certain areas of the phone. The same would go to a law enforcement officer. An example could be emails. If they are looking for a certain email detailing confidential information, there is little reason to open the user’s iTunes to look for it. There may be a reason to look in the photo application in a cell phone to see if they took a screenshot of the email. The technician conducting the investigation will have to be careful in ensuring they are staying within the scope of the investigation. A mistake could bar key evidence. There is always a reasonable expectation of privacy even when being investigated. Users utilize their personal electronics for many things. A user could be understandably upset during the course of an investigation if racy photos or e-mail conversations between a significant other becomes exposed. The investigator whether they are an employee of the government or a corporation, must follow establish procedures, policies, and laws when conducting a forensic investigation.