I recently had a chance to talk with an FBI agent who works with computer evidence. Here are some of the things I took away from the conversation. A lot of his job is fairly easy because most criminals have no idea how a computer works. I asked if he ran into any type of encryption very often and he said it was very rare. There was only one case where someone was using encryption and he said it was completely luck that they were able to catch him because he hadn’t chosen a very good password.
Now I’m not telling you this so you can go out and start a life of crime. But the things that make Mr. FBI Agent’s life easier also make the life of identity thieves a lot easier.
So what do criminals not know about computers?
What happens when you delete a file?
When you hit the delete key on your computer to make a file go away, it doesn’t actually go away. On most operating systems, it just marks the file as being in the trash and you can get it back from there. So if you empty your trash it goes away right? Nope. When a file is deleted from a hard drive, the file isn’t actually erased. The operating system just marks that part of the disk as free space, but it still contains all the data it originally contained. Overtime, that space is going to be filled up with other data, but it could remain around a very long time. It is trivial to read the data in this unallocated space.
Where do emails reside?
Normally when you send an email it resides in at least four places. It is on your computer, your mail server, the recipient’s mail server and the recipients computer. For investigators this is ideal because chances are it can be recovered from one of those places without having to do anything difficult. With cell phones and multiple computers it may reside in twice as many places.
Keep in mind that when you send an email, it might turn up as evidence in some type of court case if there is a lawsuit involving the recipient. Recent lawsuits have provided us with a much better idea of some of the inner workings of some large companies like Microsoft.
What is a cache file?
When you view a web page, the page is downloaded and “cached” or temporarily stored on your computer. However, it doesn’t instantly disappear once you are finished using the page. The FBI agent showed several examples where he was able to view emails sent via webmail and look up search history by looking at these cached files.
Using the same password is stupid.
The FBI agent gave the example of a case that he had solved by finding the cached email that came from a dating site. The email contained the password for the site. He found that same password was used for all kinds of other things and dramatically opened up what he was able to find on the computer.
He made the point that you should be very suspicious of any site that turns around and emails you your password in clear text. At the very least make sure they aren’t emailing you the same password you are using for your banking accounts.