Synthesis
Lesson 6
Incident
Response
Must Know…
Components to be
processed for digital
ForensicData
Offenses under RA
Ca waw 10175
● CIA Offenses
● Computer related
Offenses
● Content related
Offenses
• Illegal Access
• Illegal Interception
fi d e n ti a l i ty
C - on • Data Interference
I - ntegrity
- v a i l a b i lity • System
A
Offenses Interference
• Misuse of Device
• Cybersquatting
C om p u t
er Computer related Forgery
Computer related Fraud
Related Computer related to
Offense Identity Theft
s
Cybersex
Content Child
related
Pornography
offenses Cyber libel
Lesson 4:
Preservation Orders
and Processes of
Cybercrime Warrants
and Duties of Law
Enforcent Agency
Types of Cybercrime
Must Know… Warrants
WDCD
Types of Computer WICD
Data WSSECD
Subscriber WECD
Information Preservation of Computer Data
Traffic Data
Content Data Subscriber Information and Traffic Data -
minimum period of 6 months
Content Data – 6 months
For OSAEC and CSAEM – within 1 year,
extendible to another 6 months
O - Offense
R – Relevance and necessity
Contents of
I – Individual or entity names
D – Description in particular
Cybercrime E – Place where the disclosure of
computer data is to ne
Warrant Enforced
application
M – Manner or Method by which
computer data will be
disclosed
O – Other relevant information
Lesson 5 :
Digital
Investigative
Plan
Digital Forensic Digital Investigative
Planning
Models
● Kruse and Heiser Models Pre search Investigative
● Warrant Preparation
Plan
● Casey Yale Model
and Reservation
● Rodney Mckemmish
Request
Model
● Intelligence Gathering
● PNP – ACG 5 – step
● Assembling a Forensic
Model
Investigation Team
● Planning the Search
Philippine National
Police Anti – 1. Identification
Cybercrime Group 2. Acquisition
3. Examination /
5 – step Model Analysis
4. Reporting
5. Court Presentation
Planning the Search
( Incident Response Plan) Procedure
6. Execute a Warrant
7. Search the scene
[Link] a Team a Team
8. Evidence Documentation,
Leader
Collection
[Link] a Search
and Preservation
Team
9. Photographing the Incident Scene
[Link] team on the
10. Processing electronic crime
bature of the search
scene
[Link] each other a
11. Chain of custody
role
12. Marking of evidence
[Link] evidence
13. Transportation of Evidence
It's so lovely to
meet all of you!
Thank you for listening.