All language subtitles for 4. Handling data

In this video, we're talking about handling data in dealing with informational overload.

Now when you're running a health investigation, someone is most likely tasking you with running that

investigation.

So if that's the case, you'll probably want to get a few things in place.

One, you want to get the contact information for whoever you need to deal with, whoever you need,

update or hand over your report to.

You also want to find out what the scope of work is.

You want to see what was considered out of scope, especially things like those investigations tend

to be very private, very confidential.

So you do want to find out what's going to be outside that scope.

And so that way you get a better idea of.

How you need to frame your your investigation and not violate anything, whether it's legal or if it's

work related or anything else.

You want to find out if there's any special considerations you need to take in taking into account for,

you want to see what the timeline is that way, you know?

How quickly you need move on this or how thoroughly you can, you're able to be on it.

You won't find out any special data retention requests.

Things like does the data have to be encrypted?

Do you need to file shredded afterwards things of that nature?

You also want to find out or actually get in writing whether to email a letter type, what not.

The entire scope of this work.

There's a few reasons for that one.

It makes it easier to actually have it in writing.

In most cases, that way, you can go back and reference it and also it helps liability on both sides.

If something goes wrong, you could point to, well, this is a scope of work that you gave me, and

I stayed within the scope.

Likewise, it works in favor of the employer or whoever's asking you from the investigation also to

make sure that you do stay in that scope of work.

So when it comes to data collection, you're going to be collecting a lot of different information during

your investigation and most likely to collect a lot of things.

These things like names, addresses, email addresses, phone numbers, social media posts, photos,

text homes, passwords, et cetera.

The amount of data you can collect can easily become overwhelming, especially when you're starting

out.

The uncertainty of what to keep and want to get rid of can also be pretty stressful.

So how do we handle this?

Well, there's a few tips in order to keep calm, and this is what I tend to do so.

When I collect information, I first make sure that it's going to be within the scope of work.

Anything and everything that may fall into that scope, I could I go ahead and collect?

Once I get that information, I break it out in different sections phone numbers, names, social media

posts, photos, whatnot.

It helps breaking that information out, it helps consolidate down, and also when you're going back

and reference in the information, it makes a little bit easier.

You're not looking at a big jumble of information and trying to sort through it.

No one's broken up into smaller sections say, Well, I need to get to the phone numbers.

Let me check the phone numbers while I have it in this container right there.

Listen names, friends, associates, whatnot.

OK, I have that in this container I can look through there in it makes indexing it a lot quicker.

And once I had my initial data, look at the scope work and determine what my next move is, if the

job is done, if I see a Twitter user does it.

I'll take a look at the the name.

Is there a name associated in there?

I'll take a look at their friends to their friends.

Have give up a location or a name.

Did they give orders or photos?

I could pull the geo location off of things like that.

So once you have your data, at least initial data and you started going through it and you review your

scope of work, you can kind of figure out what your next move is going to be and kind of splinter off

from there.

So additional data handling considerations.

You want to keep your investigation and data isolate to your virtual machine.

No, there's a few reasons for that.

Having your information isolate your virtual machine one, you can make sure your virtual machine is

clean by reverting back to the snapshot before you do your investigation to if you make a backup of

the VA.

Anything happens.

You can always you always have that backup and purity of that information.

Also, it's easier to just go and encrypt that VM or if you're.

Handing over the information information, you could make a copy of that volume through a USB drive

for your client.

You want it if you need to keep the operation secure.

Consider encrypting your data in the VM, you can do things like.

A number of data encryption options, encrypted small drive on on that.

That way, if something have served him against compromise, your computer gets stolen whatnot, that

information's encrypted.

Likewise, you could encrypt the entire VM.

I tried that a couple of times I have run into issues personally, but if if you're dealing with a lot

of stuff, you might just want to encrypt the data.

But again, if you're if you're need that extra layer security, you could always change the password

default password on your VM for Trace Labs, the one that we're using here or whatever volume that you're

using.

And I do recommend doing that anyways.

That's just an extra layer security.

Also, depending on your scope of work, you may be working with a no contact investigation.

Things like do not contact the target directly.

Do not contact Target's friends or family, but things like do not send a password reset for, say,

Facebook because it might alert the target.

You need to pay special attention to these types of requests.

And unless expressly allowed, do not share specific information about your investigation with anyone

outside of the investigation group before, during or even after.

Depending on what your investigation is, it's most likely going to be.

Things are of a sensitive nature, and it could either tip people off, it could, it could hurt.

Potentially hurt people.

You may potentially become a target.

What not you?

And it also could be a legal issue.

So my recommendation is don't share information about that investigation unless specifically are expressly

allowed.

So this was about data retention and handling data and trying not to get overloaded.

Thank you for watching.

We'll see you next VIDEO.