TASKS 1 and 2 Cybercrime Investigations
TASKS 1 and 2 Cybercrime Investigations
At the Scene
A. If digital evidence was found, what should be done to preserve its probative value?
The digital evidence and its probative value or information ( a file, a physical disk or a logical disk)
there by creating a digital fingerprint or digital DNA for that information. It is a one way algorithm and
thus it is not possible to change the digital evidence change the corresponding hash value.
At the laboratory:
B. Provide proofs that suspect digital evidence have child pornographic materials.
Section31. Duties of a Service Provider in Child Pornography cases. In line with RA9775 or the “Anti-Child
pornography Act of 2009”
Child pornography is an unlawful or prohibited acts defined and punishable by Republic Act No. 9775 or the
‘’Anti-child Pornography Act of 2009”, committed through a computer system: Provided, that the penalty to be
imposed shall be one degree higher than that provided for in Republic Act No. 9775.
F. If suspected of being upload and share via social media what should be done to preserve digital
evidences?
Section 31. Duties of a Service Provider in Child Pornography cases. In line with RA9775 or the “Anti-Child
pornography Act of 2009” an internet service provider (ISP) internet host install available technology, program
or software, such as, but not limited to, ensure that access to or transmittal of any form of pornography will be
blocked or filtered. A service provider shall immediately notify law enforcement authorities within seven (7)
days of facts and circumstances relating to any form child pornography that passes through or are being
committed in their system; Attempted to gain access to an internet address that contains any form of child
pornography. ISPs shall also preserve customer data records, specially the time, origin, and destination of
access, for purpose of investigation and prosecution by relevant authorities under section 9 and 11 of R.A. 9775.
TASKS: AS FORENSIC INVESTIGATOR, IDENTIFY THE SUSPECT AND ESTABLISH THE EXISTENCE OF
CONTRABAND:
Digital Investigation:
a. Discuss the steps and procedures on how to preserve and procure internet traffic data and activity
from an unknown internet user.
When ISP is identified, Preservation Order is sent to the ISP requiring them to preserve the
integrity of the data in their custody. - (refer to Sec. 13 of RA 10175) Preservation of Computer Data –
the integrity of traffic data and subscribe information relating to communication services provided by a
service provider shall be preserved for a minimum of six months from the date of the transaction.
Content data shall be similarly preserved for six months from the date of receipt of the order from law
enforcement authorities required its preservation.
b. b. Discuss the procedures on how to procure the personal details of an internet subscriber?
The subscriber’s identity, postal or geographic address, telephone and other access number, any assigned
network address, billing and payment information that are available on the basis of the service agreement
or arrangement; or any other available information on the basis of the service agreement or arrangement.
Physical Investigation:
a. After the procurement and preservation of internet traffic data and activity, and the personal details
of an unknown internet user. How are you going to gather additional information and details.
> traffic data or non-content data or any computer data other than the content of the communication,
including, but not limited to the communication’s origin, destination, route, time, date, size, duration, or
type of underlying service; and Without right to conduct undertaken without or in excess of authority; or
conduct not covered by established legal defenses, excuses, court orders, justifications or relevant
principles under the law.
b. How are you going to establish that the Fake account bearing the name Mr. Alden Dela Cruz is the
same person whose personal information and details has been procured?
Computer-related identity theft – the intentional acquisition, use, misuse, transfer, possession,
alteration or deletion of identifying information belonging to another, whether natural or juridical,
without right; Provide , that if no damage has yet been caused, the penalty imposable shall be one
degree lower.
Note: Discuss briefly during the presentation:
• Cite the elements- Computer-related identity theft/ Cyber-Squatting and drug trafficking
• Cite the legal provision(s) > Republic Act No. 10175 or the “Cybercrime Prevention Act of 2012”