SlideShare une entreprise Scribd logo
1  sur  144
Télécharger pour lire hors ligne
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3841                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
Computer Hacking Forensic Investigator (CHFI)
Module XLV: Investigating Child Pornography Cases
Exam 312-49
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3842                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 News: 7 Southern California Men Arrested in Child Porn Investigation
Source: http://www.latimes.com/
52 people were suspected of possessing or producing child pornography using peer-to-peer computer
networks to exchange those graphic images and videos. These were from Los Angeles, Orange, Riverside,
San Bernardino and Ventura counties and out of them, seven Southern California men were arrested on
Tuesday following an eight-month investigation by federal, state, and local law enforcement agencies.
U.S. Atty. Thomas O'Brien at a news conference in Los Angeles said that, "The evidence is horrific”.
The charged included attorneys, a law enforcement officer, and men with previous child porn-related
convictions. If convicted of the maximum charges for possession of child pornography, each defendant
could face up to 10 years in federal prison. Those with a previous conviction could face a minimum of 10
years.
Those charged include Gary Samuel Cochran, 50, of Huntington Beach, previously convicted of child
molestation and possession of obscene materials depicting children engaged in sex acts; Evan Craig
Stephens, 36, of Upland, a registered sex offender; George Tyler Farmer, 39, of Oxnard, previously
convicted of molesting a 6-year-old child; and Eric David Lacey, 48, of Hollywood.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3843                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 News: Chinese National Arrested Over Child Porn
Source: http://www.abc.net.au/
Many of the cases are enrolled against child pornography. A man who was arriving from Hong Kong was
arrested at Cairns Airport, in far north Queensland after customs official found child porn on his laptop
computer. Later, a 30 years old Chinese national was detained and taken to the Cairns watch-house for
court proceedings before being bailed.
Kaylene Zakharoff, an acting customs’ national manager of investigations said that:
 “The man faces up to 10 years imprisonment if he/she is convicted”
 “Visitors to Australia need not be aware that Australia does have strict import controls and this
type of pornography is not accepted and we will investigate and prosecute these matters where
appropriate.”
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3844                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 News: Theft Leads to Child Porn Search
Source: http://www.argusleader.com/
According to the court’s documents, investigators have found child porn images on the system of Elk
point’s volunteer fire management. According to the search warrant documents though large numbers of
suspected child porn images were found on the system of Kavanaugh, 43, he was not charged against it.
According to an affidavit in support of the search warrant, the investigation began when Kavanaugh
reported that his computer was stolen from his Burbank home on June 27. He complained this to Sheriff
Dan Limoges, county prosecutors, and the attorney general's office about a deputy's refusal to take the
report seriously. In one of those conversations, he even said that the laptop was found later in his yard in
damaged condition and was used for several times.
On July 8, deputies retrieved the computer from the Elk Point Fire Station and examined it.
According to an affidavit, the search revealed, "Dozens of female nude images which had titles such as
high school teens and two images titled mother and young daughter natural. These two images contained
a nude woman with a preteen girl, both fully nude."
Investigators obtained a search warrant the next day but the charges have not been filed as Miller said
that, he has not received any report from the sheriff's office. He said, "It's still in the investigative stage.
It's far too early to make any statement at all."
Elk Point Mayor Isabel Trobaugh said:
 She was surprised to hear about the investigation, but she had no first-hand knowledge of it
 The volunteer fire department is separate from city government and is funded by property owners
in the fire district.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3845                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
Module Objective
Child pornography is the serious crime prevailing on the Internet. It is the harassing act against the
children where the adults are using them for their gratification. Possessing or transmitting the child porn
images or videos is considered as a crime and various organizations (law enforcement and non-profitable
organizations) are taking initiative to stop it. This module will familiarize you with:
 Child Pornography
 People’s Motives behind Child Pornography
 People involved in Child Pornography
 Role of Internet in Promoting Child Pornography
 Effects of Child Pornography on children
 Measures to Prevent Dissemination of Child Pornography
 Challenges in Controlling Child Pornography
 Steps for Investigating Child Pornography Cases
 Sources of Digital Evidence
 Techniques to Reduce the Problem of Child Pornography
 Guidelines to Avoid Pornography
 Report on Child Pornography
 Laws against Child Pornography
 Anti-Child Pornography Organizations
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3846                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
Module Flow
 
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3847                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Introduction to Child Pornography
Child Pornography is a serious crime. There are growing numbers of children who access the Internet all
over the world. Rapidly expanding computer technology and the Internet has given access to the
production and distribution of child pornography.
Child pornography is defined as “a visual depiction of any kind, including a drawing, cartoon, sculpture,
or painting, photograph, film, video, or computer-generated image or picture, whether made or produced
by electronic, mechanical, or other means, of sexually explicit conduct, where it depicts a minor engaging
in sexually explicit conduct and is obscene, or depicts an image that is, or appears to be, of a minor
engaging in graphic bestiality, sadistic or masochistic abuse, or sexual intercourse, including genital-
genital, oral-genital, anal-genital, or oral-anal, whether between persons of the same or opposite sex.”.
Source: http://www.missingkids.com
Child pornography also includes the production, distribution, and possession of pornographic material.
As children spend more and more of their time on the Internet, they are becoming increasingly prey to
child abusers/pornographers. Child pornography begins with the production of pornographic materials
such as porn images and videos. Offenders enter into correspondence with children through online
instant messaging or chat rooms. They emotionally attract the prospective victim and befriend them. After
establishing a steady relationship, they introduce children to pornography by providing images and videos
that have sexually explicit material. Not only girls and boys but also infants are becoming victim to such
offensive activities. Pornographers make use of poor children, disabled minors, and sometimes
neighborhood children for sexual exploitation.
Distribution of porn material is also a serious crime. The Internet has made the distribution of illegal
material easy. Pornographers resort to newsgroups, Internet Relay Chat, web-based groups, email,
webcams, and peer-to-peer technology to distribute pornographic material. Downloading of such images
is also considered a crime.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3848                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3849                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Survey
Source: http://www.missingkids.com/ 
Figure 44-1: The Second National Incidence Studies of Missing, Abducted, Runaway, and Thrown away
Children
Figure 44-2: The Second National Incidence Studies of Missing, Abducted, Runaway, and Thrown away
Children
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3850                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
Figure 44-3: Sex Crime Cases Survey Report
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3851                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 People’s Motive behind Child Pornography
It is observed that criminals involved in pornographic cases are unmarried, separated, divorced, or
widowed. They become involved with child pornography due to various factors. These factors could range
from mere moneymaking to sexual perversion. Children being the most vulnerable of the victims of sexual
perversion, these offenders go for child pornography. They draw children into pornographic activities by:
 Seduction
 Coercion: They force children into sexual activities or threaten them with dire consequences
 Payment: They offer monetary benefits to attract children
 Solicitation: Request them for a sexual relationship
Voyeurism is another motive behind child pornography. It includes people who derive sexual pleasure by
secretly watching the sexual activities or others in the nude.
Blackmailing is also a factor that leads some people to child pornography. The offenders lure or force
children or teenagers into offensive activities and make videos and images of them. Later, they blackmail
the victims or their parents by threatening to expose the images or videos.
Offenders sell pornographic material to make easy money. They also build their own web sites that
provide pornographic materials for money, such as downloading the pornographic images from their site.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3852                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 People Involved in Child Pornography
People involved in child pornography, known as “pornographers”, are either directly or indirectly related
to child abuse.
It involves people who enter into online relationships with children. They attract victims for sexual
activities or send the pornographic materials to children as part of the grooming process. They contact
children using online messaging or a chatroom. This is considered as direct abuse of children. A person
who physically abuses children is also considered a child pornographer. For such people, the main
intention is to satisfy their sexual curiosity. They also make pornographic images or videos for their own
satisfaction.
Production of porn material is also a serious crime. A person who produces porn images or records the
sexual activities of children is also considered a pornographer. A person who provides sources of child
pornography is also included in such an offence. Such offences are indirect abuse of children. They may
distribute pornographic materials through email, web cam, and in a chatroom.
People who intentionally download pornographic material from the Internet and save it to their computer
also fall into the category of pornographer. They may not have any intention to abuse and may not be
related to other offenders; they download it for pleasure. Parents or guardians who allow their children to
engage in pornographic activity are also considered offenders.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3853                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Role of Internet in Child Pornography
The Internet is a fast communication vehicle providing a number of online services. This growing facility
helps children and youngsters to learn. Yet, with the increase in access, there has been a rise in Internet
crimes. The Internet plays an important role in child pornography cases.
Through the Internet, it is easy to access a huge quantity of pornographic material. It provides complete
anonymity and privacy. It reduces the cost of production and distribution of such material. The offender
distributes the material easily with web services such as email, user groups, and webcams. An offender
can create his own web site and upload the porn material, so that others can easily download it. Using an
Internet facility such as a web cam, he can send real-time porn pictures or video.
The most frequent source for distributing porn material is email. Offenders can send images or videos as
attachments. Offenders can also use email for grooming or seduction purposes. Other methods of
distributing child pornography through the Internet are as follows:
Newsgroup: In a newsgroup, members may discuss their sexual interest in child and adult pornographic
material
Chatrooms: In chatrooms, offenders chat and share porn materials with each other.
The Internet is the best and most inexpensive method for transferring porn materials. The most
advantageous factor about the Internet is that the offenders can access pornographic material anytime
and anywhere. The Internet enables them to send the images or videos in any format which can be stored
easily in any digital devices such as mobile phones and PDAs.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3854                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Effects of Child Pornography on Children
Child pornography affects children physically, socially, and psychologically. It causes physical injuries to
the victims during molestation such as genital bruising and lacerations. In many cases, teenagers may be
inflicted with negative effects on growing sexuality due to inappropriate early sexual experiences. Child
pornography also gives rise to sexually transmitted diseases.
Child pornographic victims also suffer from psychological traumas such as depression, emptiness, and
schizophrenia. Girl victims may suffer from higher rates of nightmares, back pain, headaches, pelvic pain,
and other similar symptoms in her adult age. Pornography may cause sexual addiction that result in
prostitution teenage pregnancy and sexually transmitted diseases. A victim may also lose his or her
mental balance and become suicidal.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3855                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Measures to Prevent Dissemination of Child Pornography
 Computer Industry Self Regulation (Role of ISP):
An ISP (Internet Service Provider) plays an important role in reducing the problems of child
pornography. If an ISP helps to procure pornographic material over the Internet, then it becomes
easy for the police to apprehend the pornographer. Yet in some cases, an ISP stores and gives
access to child pornography sites for commercial purposes. Therefore, it is necessary for an ISP to
take some self-regulatory actions to reduce the problem of child pornography. Some of these
strategies include:
o Block the illegal sites: It is important that various ISP associations should come together and
make a decision to block the illegal sites. If any member opens it unknowingly, then he should
be told to remove that site.
o Use the filters for browsers and search engines for safe search:
ISPs can use filters on the browsers to help block sites containing words related to
pornography and use filters on the search engines so that it will not search the illegal sites or
images.
o Establish compliant sites:
Some of the ISP associations should open the complaint site or hot sites that will help people
to complain against pornography. Such an association may directly deal with the police or any
other authority.
 Legislative Regulation:
Create rules and regulations against child pornography to minimize the problem of pornography.
Make it mandatory for the ISP to inform the police about illegal sites.
Inform ISPs to verify the identities of the people who open the Internet. If they find anyone who
illegally uses others’ accounts, they should inform the police. Confirm the age of the account
holder and restrict children from opening an account without an adult’s supervision. Inform an
advertiser not to advertise such illegal sites. Inform the credit card companies not to pay money
to anyone without confirming it. If they find any transaction with a pornographer, block the credit
card transaction of that person.
 Citizen’s Committee:
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3856                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
A Citizen’s committee may also help in controlling child pornography. They may establish an
organization, which creates awareness among the public about such issues and provides them
with a forum to voice their complaints about such activities. They may provide information to
parents and teachers through their sites or publications about the problem of child pornography
and how to tackle them.
 Parental Strategies:
Parents play an important role in protecting children from child pornography. They should
restrict their children from accessing such materials. They should use filtering software and
search engines to protect their children from any indecent material.
 Law Enforcement Responses (Role of Police):
Police play a crucial role in investigating the pornographic sites. The police may use new
computer forensics tools and techniques to investigate such sites. They may scan the Internet
service and restrict the ISP to remove illegal sites. They may perform sting operations to
investigate the offenders. They may make contact through chatrooms, newsgroups, or via P2P
with offenders by disguising themselves as teenagers to investigate the offenders.
Police may also use the honey-trap sites to find offenders. These sites contain pornographic
material, but they note the IP address or the credit card number of a criminal who tries to
download the porn material from these sites.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3857                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Challenges in Controlling Child Pornography
 Large Internet traffic:
The Internet is the network of networks; it provides a fast and easy way for disseminating
information. In order to keep a check on the sites, if you block the way to open any site, then there
are many alternatives available to reach the same target. In a similar way, if you block any website
or newsgroup, then there are a number of sites and groups which replace the same. Due to this
large traffic over the Internet, it is difficult to catch the person who visits such sites.
 Unclear jurisdiction due to anonymity of offenders:
The Internet is the best tool for communication all over the world. So, criminals from any corner
of the world can send or use pornographic material. Laws differ from country to country so it adds
to the difficulty of tracking the offender. For example, in the United States a child is defined as
those who are under 18 years of age, while in Australia it is defined as those who are under
16years of age. It may happen that an offender produces the porn material in one country and
distributes it in another country. This causes a problem about who will investigate and under
which country’s law, the offender should be arrested.
 Lack of laws and regulation:
Another challenge to check child pornography is the lack of laws and regulation in different
countries. In most countries, there are no laws against child pornography, so offenders can easily
produce the porn material in such countries and distribute it through the Internet all over the
world.
 Sophistication and the use of Internet technology by offenders:
Due to sophisticated Internet technologies, it is difficult to track the offender. Offenders use
various techniques such as email, webcams, chatrooms, and newsgroups to distribute the
material. With the Internet, it is easy to access a number of pornographic materials which reduces
the cost of production and distribution of such material. It provides complete anonymity and
privacy that causes a problem during investigation.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3858                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Precautions before Investigating Child Pornography Cases
The investigators are required to take the precautions or the guidelines for evaluation and solving the
case. The precautions to be taken before investigating child pornography cases are as follows:
 Ensure the authorization to investigate the child pornography cases
 Familiarize with the local laws that are related to the child pornography
 Document each step of the investigation in detail
 Take assistance from two authorized persons
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3859                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Steps for Investigating Child Pornography
Investigators follow certain steps for investigating child pornography cases, which are as follows:
1. Search and seize all computers and media devices
2. Check the authenticated login sessions
3. Search the hard disk for pornographic material
4. Recover deleted files and folders
5. Check metadata of files and folders related to pornography
6. Check and recover browser information:
a. Browsing history
b. Download history
c. Saved form and search history
d. Cache
e. Cookies
f. Saved passwords
g. Authenticated sessions
7. Check ISP logs
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3860                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Step 1: Search and Seize All Computers and Media Devices
The user can save the information on the system or media devices such as USBs, CDs, and DVDs. Follow
these steps to search the files on these devices for evidence:
 Search the files and folders of the suspect’s system for pornographic material
 Look for the pornographic material on media devices such as USBs, CDs and DVDs, and pen
drives
 Document and seize the collected evidence carefully
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3861                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Step 2: Check Authenticated Login Sessions
Check sessions through which the user can log in to the system either through an administrator account,
standard account, or via guest account with an authentication (password):
 Check the login information as user accounts are password protected
 Check under which account the pornographic material was accessed
 Check the user, who accessed the porn material, i.e., is he an authenticated user, a guest, or an
administrator?
Figure 44-4: User Login
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3862                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Step 3: Search the Hard Disk for Pornographic Material
Search the hard disk of the suspect’s system for pornographic material.
 Hard disk search includes searching in:
o Files and folders
o Applications
o Temporary Internet files
o Recycle Bin
Tools such as SurfRecon scan the system for pornographic material (both on hard disk as well as browser
cache).
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3863                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Step 4: Recover Deleted Files and Folders
The user may delete the pornographic material from the desktop, hard disk, and even from the Recycle
Bin. To recover files and folders, even though they are deleted from the Recycle Bin:
 Use tools such as File Recover, Data recovery wizards, PC Inspector File Recovery, etc.
Figure 44-5: Data Recovery Wizards (Source: https://www.regnow.com/)
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3864                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
Figure 44-6: PC Inspector File Recovery (Source: http://www.raymond.cc/)
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3865                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Step 5: Check Metadata of Files and Folders Related to Pornography
Metadata is the information of when the file was created, modified, or deleted. File/folder creation,
modification, or deletion allows the investigator to know when the material was accessed.
 Check the metadata of files and folders that consist of pornographic material
 Check the metadata of files and folders from the Recycle Bin (as most users tend to delete the files
from the desktop or drives after accessing them)
Figure 44-7: Folder Properties Window
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3866                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Step 6: Check and Recover the Browser Information
It is easy to check the browsed information with the help of browsers such as Internet Explorer, Mozilla
Firefox, etc.
 Check and recover browser, information which includes:
o Browsing history, save form, and search history
o Download history
o Cache
o Cookies
o Offline website data
o Saved passwords
o Authenticated sessions
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3867                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Browsing History, Save Form, and Search History
To access browsing history, open Internet browser and press Ctrl+H to open the browsing history. The
steps to check the browsing history, save form, and search history are as follows:
 Check the links that were accessed to trace the child pornography link
 Search for the suspected link through the search bar
Browsers offer the feature of URL suggestion as the user types the letters in the URL tab (provided the
URLs were browsed on the system, on the particular browser, previously).
Figure 44-8: Browsing History
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3868                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
Figure 44-9: History Window
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3869                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Download History
Download history is one of the features of Internet browsers, where downloaded information is saved. To
view the download history:
 Select Tools and click Download; or
 Just press Ctrl+J (shortcut to access download history information)
Though users have a tendency to clean up the downloaded information, if not cleaned up, it provides
detailed information of the files that are downloaded and can be a source of evidence.
Figure 44-10: File Downloading Window
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3870                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Cache
A cache is a collection of web page copies stored on the system’s hard disk or in its volatile memory, i.e.,
random-access memory (RAM).
To change cache settings, open the browser. Select Tools. Open the Advanced panel, and click the
Network tab. Enter a number in the Use up to field to specify the size of the cache.
A user will sometimes select the Clear Now option for security purposes, in order to delete the cache
information. Steps to get information from the cache are as follows:
 Check the browser information in the cache
 If the browser cache information is deleted, recover the information using tools such as
INDEX.DAT file viewer
Figure 44-11: Cache Window
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3871                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Cookies
A cookie is a piece of information that is stored on the system by a web browser. Steps to be followed to
check the cookies are as follows:
 Check the cookie information to determine the websites the user has accessed
 To access cookies, select Tools. Click options→Privacy→Show Cookies
Figure 44-12: Cookie Window
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3872                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
Figure 44-13: Window Showing Cookies
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3873                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Saved Passwords
A password is the secret word or string used for authentication purposes. New versions of browsers
provide the ability to store passwords of visited websites. Passwords are remembered and saved by the
browser, depending upon the user’s request, and this information is stored in the Remember Passwords
section of the browser tools. Investigators need to check this information for as it provides URLs of sites,
usernames, as well passwords. To check for those passwords and access the links to find evidence:
 Go to Tools→Options→Security→Show Passwords
Figure 44-14: Password Window
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3874                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Authenticated Sessions
An authenticated session is the use of the correct username and password for a particular link. To check
for authenticated sessions, follow these steps:
 Check whether the user logged in to website with authentication
 Check for the number of attempts made by the user
Figure 44-15: Login Window
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3875                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Step 7: Check ISP Logs
ISP logs are all Internet activity information that is saved by Internet service providers. They are logs of
the web pages that the user has visited. These logs provide data access information (Internet access) of the
users to whom a particular ISP provider provides service.
This is a difficult way to extract information because:
 ISPs do not usually show the logs, to maintain user privacy
 Though ISPs show the logs, it is difficult to extract required information from the huge amount of
logs
The ISP can provide help; for instance, suppose the police raided the owner a child pornography site. It is
easy to look up to the IP addresses of the users who have visited the site and once the IP addresses are
found, the police can get the details of the users with the ISP’s help.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3876                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Sources of Digital Evidence
Following are some of the sources of evidence that play an important role during investigation:
 Offender’s computer:
The offender’s computer is the main source of evidence during the investigation of child
pornography cases. When an offender downloads any image, it saves it to the hard drive, which is
important evidence for the investigation. There are many materials, such as log files, which show
the detailed information about who logged on to the computer and when. The web browser’s
history shows the online activities of the criminal. Email and chat logs extract an online
communication record of the offender.
 Hand-held devices:
Offenders may also use handheld devices for child pornography. Devices such as PDAs and
mobile phones with digital cameras can be used for recording offensive pictures and transmitting
digital images. Therefore, these devices are also important in investigation.
 Servers:
Servers may also play an important role in investigation. For example, an ISP authentication
server records the information of the customer with the IP address that can be used for
identifying the user. FTP and web servers are generally used for uploading and downloading the
files, but it also records the details about which file to be uploaded or downloaded and also
monitors the IP address of the user.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3877                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Citizens’ Responsibility Against Pornography
Possessing, transmitting, or distributing the child porn images are illegal acts. More than being a crime, it
is inhuman to harass a child for doing the act, so as a citizen it is our responsibility to act against it thus
eradicating it completely for a better society.
Following are the guidelines that citizens can use in order to eradicate pornography:
 Protest against child porn websites
 Provide information about the impact of pornography on children
 Take initiatives to cease child porn on web
 Report against the site that is distributing child porn to government officials
 Report to anti- child porn organizations about the site
o Report is anonymous and 24*7 online, so no problem can be created after posting the report
 Block credit card transactions that are requested for child pornography
 Ask ISPs to block the content or URL
o Example: World's largest Internet Service Providers (ISPs) Verizon, Time Warner Cable, and
Sprint blocked access to child porn material, available on the Internet.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3878                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Guidelines to Avoid Child Pornography on the Web
There are many child pornographic sites prevailing on the Internet. Following are the guidelines to avoid
child pornography on the web:
 Use Internet filters that filter unwanted content on the system: Internet filters are the software
that is installed on the system in order to avoid unwanted content such as child porn sites,
gambling sites, etc.
 Make use of search engines that have in-built filters: It is necessary to make use of search engines
that have in-built filters as they help in safe searching and filtered results. Example: Google safe
search filtering
 Avoid guesswork on URLs: Most of the users have a habit of making a guess work on URLs to get
the information, but this at times moves the user to pornographic sites.
 Use proper and appropriate keywords during research: Use appropriate keywords while
researching, otherwise this can cause problems
 Avoid browsing questionable URLs or banners that take you to unwelcomed sites
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3879                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Guidelines for Parents to Protect Children from Pornography
Source: http://www.crime-research.org/
Initial teachers for children are their parents, so it is necessary that they guide their children to make good
decisions. Following are the guidelines for parents to reduce the risk of their children being taken
advantage of:
 Create a friendly relationship with your child: If the child is afraid of his/her parents, it is
unlikely that he/she will ask them for help. So it is necessary and the parents’ responsibility to
have a good relationship with their children.
 Guide your child while browsing: Browsing a huge network like the Internet is at times
dangerous to your child, so parents can help by guiding their children and teaching them safe
ways to search.
 Install filtering software that blocks porn sites: There are various Internet filters available that
filter websites that the user (parent) wishes to block on the system.
 Promote the use of search engines with safe search: Promote the use of search engines with safe
search (Google offers safe search) in order to stay away from inappropriate sites.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3880                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Make children aware of child pornography prevailing on Internet: Explain to your child in
detail about child pornography that is prevalent on the Internet. Even familiarize them with laws
and offenses they could face due to its promotion.
 Assist them with various anti-child pornography organizations: Though software is installed,
there is still a chance of pornography prevailing on the system. It is the duty of parents to inform
kids about whom to approach and how to report that particular illegal site, thus helping to
eradicate pornography.
 Use software: Use software that monitors and records all websites visited by your child, captures
and logs their instant messenger chats, etc.
If parents find that their children have been looking at pornography, they should explain to the child that
he or she has committed a crime, and make sure that the child understands the law.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3881                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 
Tools to Protect Children from Pornography
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3882                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Reveal
Source: http://www.antichildporn.org/
The concept behind this software is to help bridge the technology gap between the knowledgeable child
who is on the Internet, yet lacks the life skills needed to know what is and is not dangerous, and parents
who may be a bit behind in understanding this technology and what their child may be getting into.
Reveal, although not intended as a police forensic tool, it thought to be of some utility in providing a quick
means for evaluating large amounts of computer data/files. In the advanced section of Reveal, the ability
to create a customized dictionary will be helpful in some types of data reviews.
The attached program is a self-extracting and self-installing program which creates a directory (default)
on your "C" drive in "C:ProgramsReveal". It also creates a couple of sub directories under this directory
as well as putting an icon on the Desktop. It also comes with an un-install program and is thought to be
free of any code, which will affect the way you have your computer setup.
Features:
 Reveal works by searching all files found and comparing each word inside a file against special
dictionaries of words commonly used by pedophiles, child pornographers, cultists, occultists,
drug pushers, and purveyors of hate and violence
 It also searches for images, video, and audio files and provides a quick and easy means for you to
review these files for content which may be objectionable
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3883                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 iProtectYou
Source: ‘http://www.softforyou.com/
iProtectYou is an Internet filtering and monitoring program, which enables you to control when the
Internet can be used and which websites can be accessed through your computer. iProtectYou is designed
for parents who are concerned about the possible detrimental effects of the Internet on the development
of their children. iProtectYou is also designed for schools and libraries, so that they can control what is
being viewed in public spaces, and schools, so that children do not have free access to undesirable sites on
the Internet.
The porn blocker iProtectYou gives parents several methods for monitoring and controlling their children
from accessing child pornography over the Internet:
 Porn block by word filtering: You can prevent access to websites containing vulgar or explicit
words or phrases. These settings can changed be at any time at your discretion. In order to
increase the effectiveness of the program, you have the option to use words from a pre-made list,
or you can define your own.
 Porn block by URL (address) filtering: You can prevent access to individual websites based on
their URL (address). iProtectYou gives you complete control over this filter's settings. You can
also choose to block web sites using iProtectYou's built-in list of bad sites.
 Porn block by using the bad site list: This comprehensive and ever-changing list is made up of
over thousands of websites on the Internet that contain undesirable content such as pornography.
If the parent wants to block a particular website not found in the list, they can do this by using the
URL (Address) filtering.
Features:
 Restrict your family members from visiting websites and news groups that may contain
pernicious information
 Block emails, chat sessions, instant messages, and P2P connections if they contain inappropriate
words
 Prevent your private information (credit card number for example) from being sent to the
Internet
 Set a schedule to specify days and times when online activity is allowed
 Limit Internet Traffic to a specified amount of data that can be sent or received per user / per day
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3884                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Control the list of programs that can have access to the Internet
 Get notification emails with full descriptions of blocked operations and an attached screen-shot of
your kids' computer to control them remotely
 Get detailed information about Internet resources used by your computer
 Set different levels of restrictions for every member of your family depending on their maturity,
interest, habits, and parental control needs
Figure 44-16: iProtectYou Pro control pannel
 
Figure 44-17: iProtectYou Users and Groups screenshot
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3885                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 
Figure 44-18: iProtectYou setting screenshot
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3886                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 WUPC Web Control for Parents 4
Source: http://www.download.com/
WUPC Web Control for Parents 4 is an easy-to-use parental control tool, developed specially to protect
children from forbidden materials such as pornography, online gambling, and online drug information. It
helps to prevent kids from accessing user-specified websites. It has a very clear interface, where you can
review websites that were visited by your child and lock all forbidden materials with two clicks.
Figure 44-19: WUPC Web Control for Parents 4
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3887                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 BrowseControl
Source: http://www.browsecontrol.com/
BrowseControl controls access to the Internet and blocks applications on Windows operating systems. It
can also be used to block access to floppy disks, CD drives, and USB drives. It helps the user to restrict
inappropriate surfing and enforce Internet usage policies.
Following are the features of BrowseControl:
 It can completely block the Internet
 Allow access to only websites the user specifies
 Deny web access to websites the user specifies
 Schedule Internet ON at only certain times of the day
 It consists of an Application Blocker that allows the user to specify software applications he or she
wants to block the user from running
 It can block any number of protocols and the user can even specify any additional ports
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3888                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
Figure 44-20: BrowseControl
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3889                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 ChatGuard
Source: http://www.chatprotection.com/
ChatGuard is the software developed for protection from online sexual solicitation
It monitors:
 Internet
o Chat sessions, URLs, communications, emails, and so on
 Games and audio
 Desktop enhancements
 Business and finance
Figure 44-21: ChatGuard session logs screenshot
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3890                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
Figure 44-22: ChatGuard version update screenshot
Figure 44-23: ChatGuard parent library screenshot
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3891                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Child Exploitation Tracking System (CETS)
Source: http://www.microsoft.com/
CETS was developed jointly by Microsoft Canada, the Royal Canadian Mounted Police (RCMP), and the
Toronto Police Service. CETS, a software solution built using open industry standards, assists law-
enforcement officials in their work to stop the exploitation of children on the Internet by enabling
effective collaboration and providing a set of advanced software tools and technologies for use by
investigators.
The tracking system will serve as a repository of information and will also be used as an investigative tool.
The solution enables police agencies to capture, share, and search information from the point of detection
through the investigative phase, arrest, and offender management.
CETS is a great tool for information management; CETS puts together the work of hundreds of police
agencies in one place. The tool can establish links from the different agencies that police wouldn't
necessarily make.
Features:
 CETS enables agencies to avoid duplicate efforts. Sharing information over a secure network,
officers can match up investigations that reference the same people or online identities
 CETS links and connects criminal behavior online that is difficult for the human eye to see
 Using CETS, police agencies can manage and analyze huge volumes of information in powerful
new ways, such as cross-referencing obscure data relationships and using social-network analysis
to identify communities of offenders 
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3892                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3893                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3894                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3895                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Reports on Child Pornography
Source: http://www.icmec.org/
The following tables demonstrate the survey of various countries against child pornography. These tables
show that some countries such as Afghanistan, Albania, Bangladesh, India, Pakistan, Thailand, Singapore,
and Egypt do not have any law against child pornography, while countries such as Argentina, Austria,
Belgium, Brazil, Canada, France, Germany, Hong Kong, Italy, Japan, New Zealand, Russia, South Africa,
United Kingdom and United States have well defined laws against child pornography.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3896                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3897                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 
 
 
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3898                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 
 
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3899                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 
 
 
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3900                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 
 
 
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3901                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 
 
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3902                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 
 
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3903                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 
 
 
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3904                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 
 
 
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3905                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 
 
 
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3906                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 
Figure 44-24: Child Pornography Reports
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3907                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 
Laws Against Child Pornography
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3908                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 
 
 
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3909                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 U.S. Laws Against Child Pornography
Source: http://www.missingkids.com/
18 U.S.C. 1466A – OBSCENE VISUAL REPRESENTATIONS OF THE SEXUAL ABUSE OF CHILDREN
It is forbidden to knowingly produce, distribute, receive, or possess with the intent to distribute, a visual
depiction of any kind, including a drawing, cartoon, sculpture, or painting, that:
 depicts a minor engaging in sexually explicit conduct and is obscene, or
 depicts an image that is, or appears to be, of a minor engaging in graphic bestiality, sadistic or
masochistic abuse, or sexual intercourse, including genital-genital, oral-genital, anal-genital, or
oral-anal, whether between persons of the same or opposite sex, and such depiction lacks serious
literary, artistic, political, or scientific value.
Attempts or conspiracies to knowingly produce, distribute, receive, or possess with the intent to
distribute, a visual depiction of any kind, including a drawing, cartoon, sculpture, or painting, that:
 depicts a minor engaging in sexually explicit conduct and is obscene, or
 depicts an image that is, or appears to be, of a minor engaging in graphic bestiality, sadistic or
masochistic abuse, or sexual intercourse, including genital-genital, oral-genital, anal-genital, or
oral-anal, whether between persons of the same or opposite sex, and such depiction lacks serious
literary, artistic, political, or scientific value, are also forbidden.
It is forbidden to knowingly possess a visual depiction of any kind, including a drawing, cartoon,
sculpture, or painting, that:
 depicts a minor engaging in sexually explicit conduct and is obscene, or
 depicts an image that is, or appears to be, of a minor engaging in graphic bestiality, sadistic or
masochistic abuse, or sexual intercourse, including genital-genital, oral-genital, anal-genital, or
oral-anal, whether between persons of the same or opposite sex, and such depiction lacks serious
literary, artistic, political, or scientific value,
If one of the...circumstances [noted below] is present:
 any communication involved in or made in furtherance of the offense is communicated or
transported by the mail, or in interstate or foreign commerce by any means, including by
computer, or any means or instrumentality of interstate or foreign commerce is otherwise used in
committing or in furtherance of the commission of the offense;
 any communication involved in or made in furtherance of the offense contemplates the
transmission or transportation of a visual depiction by the mail, or in interstate or foreign
commerce by any means, including by computer;
 any person travels or is transported in interstate or foreign commerce in the course of the
commission or in furtherance of the commission of the offense;
 any visual depiction involved in the offense has been mailed, or has been shipped or transported
in interstate or foreign commerce by any means, including by computer, or was produced using
materials that have been mailed, or that have been shipped or transported in interstate or foreign
commerce by any means, including by computer; or
 The offense is committed in the special maritime and territorial jurisdiction of the United States
or in any territory or possession of the United States.
An attempt to knowingly possess such a visual depiction is also forbidden under the same circumstances
Source: http://www.law.cornell.edu/
§ 2251. Sexual exploitation of children
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3910                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
(a) Any person who employs, uses, persuades, induces, entices, or coerces any minor to engage in, or who
has a minor assist any other person to engage in, or who transports any minor in interstate or foreign
commerce, or in any Territory or Possession of the United States, with the intent that such minor engage
in, any sexually explicit conduct for the purpose of producing any visual depiction of such conduct, shall
be punished as provided under subsection (e), if such person knows or has reason to know that such
visual depiction will be transported in interstate or foreign commerce or mailed, if that visual depiction
was produced using materials that have been mailed, shipped, or transported in interstate or foreign
commerce by any means, including by computer, or if such visual depiction has actually been transported
in interstate or foreign commerce or mailed.
(b) Any parent, legal guardian, or person having custody or control of a minor who knowingly permits
such minor to engage in, or to assist any other person to engage in, sexually explicit conduct for the
purpose of producing any visual depiction of such conduct shall be punished as provided under subsection
(e) of this section, if such parent, legal guardian, or person knows or has reason to know that such visual
depiction will be transported in interstate or foreign commerce or mailed, if that visual depiction was
produced using materials that have been mailed, shipped, or transported in interstate or foreign
commerce by any means, including by computer, or if such visual depiction has actually been transported
in interstate or foreign commerce or mailed.
(c)
(1) Any person who, in a circumstance described in paragraph (2), employs, uses, persuades, induces,
entices, or coerces any minor to engage in, or who has a minor assist any other person to engage in,
any sexually explicit conduct outside of the United States, its territories or possessions, for the
purpose of producing any visual depiction of such conduct, shall be punished as provided under
subsection (e).
(2) The circumstance referred to in paragraph (1) is that—
(A) The person intends such visual depiction to be transported to the United States, its territories
or possessions, by any means, including by computer or mail; or
(B) The person transports such visual depiction to the United States, its territories or possessions,
by any means, including by computer or mail.
(d)
(1)Any person, who, in a circumstance described in paragraph (2), knowingly makes, prints, or
publishes, or causes to be made, printed, or published, any notice or advertisement seeking or
offering—
(A) to receive, exchange, buy, produce, display, distribute, or reproduce, any visual depiction, if
the production of such visual depiction involves the use of a minor engaging in sexually explicit
conduct and such visual depiction is of such conduct; or
(B) Participation in any act of sexually explicit conduct by or with any minor for the purpose of
producing a visual depiction of such conduct; shall be punished as provided under subsection (e).
(2) The circumstance referred to in paragraph (1) is that—
(A) such person knows or has reason to know that such notice or advertisement will be
transported in interstate or foreign commerce by any means including by computer or mailed; or
(B) Such notice or advertisement is transported in interstate or foreign commerce by any means
including by computer or mailed.
(e) Any individual who violates, or attempts or conspires to violate, this section shall be fined under this
title and imprisoned not less than 15 years nor more than 30 years, but if such person has one prior
conviction under this chapter, chapter 71, chapter 109A, or chapter 117, or under section 920 of title 10
(article 120 of the Uniform Code of Military Justice), or under the laws of any State relating to the sexual
exploitation of children, such person shall be fined under this title and imprisoned for not less than 25
years nor more than 50 years, but if such person has 2 or more prior convictions under this chapter,
chapter 71, chapter 109A, or chapter 117, or under section 920 of title 10 (article 120 of the Uniform Code
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3911                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
of Military Justice), or under the laws of any State relating to the sexual exploitation of children, such
person shall be fined under this title and imprisoned not less than 35 years nor more than life. Any
organization that violates, or attempts or conspires to violate, this section shall be fined under this title.
Whoever, in the course of an offense under this section, engages in conduct that results in the death of a
person shall be punished by death or imprisoned for any term of years or for life.
§ 2252. Certain activities relating to material involving the sexual exploitation of minors
(a) Any person who—
(1) Knowingly transports or ships in interstate or foreign commerce by any means including by
computer or mails, any visual depiction, if—
(A) The producing of such visual depiction involves the use of a minor engaging in sexually
explicit conduct; and
(B) Such visual depiction is of such conduct;
(2) knowingly receives, or distributes, any visual depiction that has been mailed, or has been shipped
or transported in interstate or foreign commerce, or which contains materials which have been mailed
or so shipped or transported, by any means including by computer, or knowingly reproduces any
visual depiction for distribution in interstate or foreign commerce or through the mails, if—
(A) The producing of such visual depiction involves the use of a minor engaging in sexually
explicit conduct; and
(B) Such visual depiction is of such conduct;
(3) Either—
(A) in the special maritime and territorial jurisdiction of the United States, or on any land or
building owned by, leased to, or otherwise used by or under the control of the Government of the
United States, or in the Indian country as defined in section 1151 of this title, knowingly sells or
possesses with intent to sell any visual depiction; or
(B) knowingly sells or possesses with intent to sell any visual depiction that has been mailed, or
has been shipped or transported in interstate or foreign commerce, or which was produced using
materials which have been mailed or so shipped or transported, by any means, including by
computer, if—
(i) The producing of such visual depiction involves the use of a minor engaging in sexually
explicit conduct; and
(ii) Such visual depiction is of such conduct; or
(4) Either—
(A) in the special maritime and territorial jurisdiction of the United States, or on any land or
building owned by, leased to, or otherwise used by or under the control of the Government of the
United States, or in the Indian country as defined in section 1151 of this title, knowingly possesses
1 or more books, magazines, periodicals, films, video tapes, or other matter which contain any
visual depiction; or
(B) knowingly possesses 1 or more books, magazines, periodicals, films, video tapes, or other
matter which contain any visual depiction that has been mailed, or has been shipped or
transported in interstate or foreign commerce, or which was produced using materials which have
been mailed or so shipped or transported, by any means including by computer, if—
(i) The producing of such visual depiction involves the use of a minor engaging in sexually
explicit conduct; and
(ii) Such visual depiction is of such conduct; shall be punished as provided in subsection (b)
of this section.
(b)
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3912                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
(1) Whoever violates, or attempts or conspires to violate, paragraphs [1] (1), (2), or (3) of subsection (a)
shall be fined under this title and imprisoned not less than 5 years and not more than 20 years, but if
such person has a prior conviction under this chapter, chapter 71, chapter 109A, or chapter 117, or
under section 920 of title 10 (article 120 of the Uniform Code of Military Justice), or under the laws of
any State relating to aggravated sexual abuse, sexual abuse, or abusive sexual conduct involving a
minor or ward, or the production, possession, receipt, mailing, sale, distribution, shipment, or
transportation of child pornography, such person shall be fined under this title and imprisoned for
not less than 15 years nor more than 40 years.
(2) Whoever violates, or attempts or conspires to violate, paragraph (4) of subsection (a) shall be
fined under this title or imprisoned not more than 10 years, or both, but if such person has a prior
conviction under this chapter, chapter 71, chapter 109A, or chapter 117, or under section 920 of title
10 (article 120 of the Uniform Code of Military Justice), or under the laws of any State relating to
aggravated sexual abuse, sexual abuse, or abusive sexual conduct involving a minor or ward, or the
production, possession, receipt, mailing, sale, distribution, shipment, or transportation of child
pornography, such person shall be fined under this title and imprisoned for not less than 10 years nor
more than 20 years.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3913                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 U.S. Laws Against Child Pornography
Source: http://www4.law.cornell.edu/
42 U.S.C. 13032 – Reporting of child pornography by electronic communication service providers
1. Duty of report: Whoever, while engaged in providing an electronic communication service or a
remote computing service to the public, through a facility or means of interstate or foreign
commerce, obtains knowledge of facts or circumstances from which a violation of section 2251,
2251A, 2252, 2252A, 2252B, or 2260 of title 18, involving child pornography (as defined in section
2256 of that title), or a violation of section 1466A of that title, is apparent, shall, as soon as
reasonably possible, make a report of such facts or circumstances to the Cyber Tip Line at the
National Center for Missing and Exploited Children (NCMEC), which shall forward that report to
a law enforcement agency or agencies designated by the Attorney General.
2. Designation of agencies: Not later than 180 days after October 30, 1998, the Attorney General
shall designate the law enforcement agency or agencies to which a report shall be forwarded
under paragraph (1)
3. In addition to forwarding such reports to those agencies designated in subsection (b)(2) of this
section, the National Center for Missing and Exploited Children is authorized to forward any such
report to an appropriate official of a state or subdivision of a state for the purpose of enforcing
state criminal law.
4. Failure to report: A provider of electronic communication services or remote computing services
described in paragraph (1) who knowingly and willfully fails to make a report under that
paragraph shall be fined:
a. in the case of an initial failure to make a report, not more than $50,000; and
b. in the case of any second or subsequent failure to make a report, not more than $100,000 
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3914                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Australia Laws Against Child Pornography
Source: http://www.austlii.edu.au/
474.19 Using a carriage service for child pornography material
(1) A person is guilty of an offence if:
(a) The person:
(i) Uses a carriage service to access material; or
(ii) Uses a carriage service to cause material to be transmitted to the person; or
(iii) Uses a carriage service to transmit material; or
(iv) Uses a carriage service to make material available; or
(v) Uses a carriage service to publish or otherwise distribute material; and
(b) The material is child pornography material.
Penalty: Imprisonment for 10 years.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3915                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
(2) To avoid doubt, the following are the fault elements for the physical elements of an offence
against subsection (1):
(a) Intention is the fault element for the conduct referred to in paragraph (1) (a);
(b) Recklessness is the fault element for the circumstances referred to in paragraph (1)(b).
(3) As well as the general defenses provided for in Part 2.3, defenses are provided for under
section 474.21 in relation to this section.
474.20 Possessing, controlling, producing, supplying or obtaining child pornography material for use
through a carriage service
(1) A person is guilty of an offence if:
(a) The person:
(i) Has possession or control of material; or
(ii) Produces, supplies or obtains material; and
(b) The material is child pornography material; and
(c) The person has that possession or control, or engages in that production, supply or
obtaining, with the intention that the material be used:
(i) By that person; or
(ii) By another person;
In committing an offence against section 474.19 (using a carriage service for child pornography material).
Penalty: Imprisonment for 10 years.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3916                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Austria Laws Against Child Pornography
Source: http://www.interpol.org/
§ 207a - Pornographic depictions of minors
(1) Anyone who
1. Produces or
2. Imports, transports or exports for the purpose of dissemination or
3. offers, procures, transfers, presents or makes available in any other manner to another person a
pornographic depiction of a minor (under paragraph 4) will be sentenced to up to three years'
imprisonment.
(2) Anyone who commits the offence for financial gain will be sentenced to six months' to five years'
imprisonment. Anyone who commits the offence as a member of a criminal organization, or in such a way
that the minor sustains particularly grievous harm, will be sentenced to 1-10 years' imprisonment; anyone
who produces a pornographic depiction of a minor (under paragraph 4) using severe violence or who, in
producing such pornographic depiction, endangers the life of the depicted minor either intentionally or as
a result of gross negligence, will also be punished.
(3) Anyone who obtains, or is in possession of, a pornographic depiction of a minor over 14 years of age
(under paragraph 4, subparagraphs 3 and 4) will be sentenced to up to one year's imprisonment. Anyone
who obtains, or is in possession of, a pornographic depiction of a minor (under paragraph 4) will be
sentenced to up to two years' imprisonment.
(4) Pornographic depictions of minors are:
1. Realistic depictions of a sexual act performed on a minor under 14 years of age or by such minor
on himself, on another person or with an animal,
2. realistic depictions of an event performed with a minor under 14 years of age, examination of
which creates the impression, according to the circumstances of the case, that it involves a sexual
act performed on such minor or by the minor on himself, on another person or with an animal,
3. Realistic depictions
a. of a sexual act within the meaning of subparagraph 1 or of an event within the meaning
of subparagraph 2, though with minors over 14 years of age, or
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3917                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
b. of the genitals or pubic region of minors, provided such depictions are distorted in a
sensational manner, focus on the genitals or pubic region or are devoid of other
manifestations of life in order to sexually to arouse the observer,
4. pictorial representations, an examination of which - following alteration of a depiction or
without use of such alteration - creates the impression, according to the circumstances of the case,
that it is a depiction within the meaning of subparagraphs 1-3.
(5) In accordance with paragraph 1, subparagraph 1, and paragraph 3, anyone who:
1. produces, or is in possession of, a pornographic depiction of a minor over 14 years of age with
the latter's consent or for the latter's own private use, or
2. Produces, or is in possession of, a pornographic depiction of a minor over 14 years of age,
within the meaning of paragraph 4, subparagraph 4, for his own private use, provided no risk of
dissemination of the depiction is associated with the act, shall not be punished.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3918                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Belgium Laws Against Child Pornography
Source: http://www.childfocus-net-alert.be/
“Art.383bis (*)
§ 1. Notwithstanding the application of Articles 379 and 380, whosoever has displayed, sold,
rented, distributed or handed out emblems, objects, films, photos, slides or other visual media
representing sexual positions or acts of a pornographic nature, involving or representing minors
or has handed to a transport or distribution agent, manufactured or held, imported or caused to
be imported such objects with a view to commerce or distribution shall be punished by penal
servitude and a fine of five hundred to ten thousand francs.
§ 2. Whosoever has knowingly possessed emblems, objects, films, photos, slides or other visual
media as referred to under § 1 shall be punished by imprisonment for a month to a year and a fine
of hundred to a thousand francs.
§ 3. The offence referred to under § 1 shall be punished by forced labor for ten to fifteen years and
a fine of five hundred to fifty thousand francs if it constitutes an act of participation in the main or
accessory activity of an association, whether or not the culprit holds the position of manager.
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3919                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
§ 4. The special confiscation provided for in Article 42, 1°, may be applied to the offences referred
to in § 1 and § 2, even when the objects that it concern, are not the property of the convicted
person.
§ 5. Articles 382 and 389 are applicable to the offences referred to in § 1 and § 3. "
"Art.380ter (*)
§ 1. Shall be punished by imprisonment for two months to two years and a fine of two hundred
francs to two thousand francs whosoever and by whatever means publishes, distributes or
disseminates or causes to be published, distributed or disseminated publicity, directly or
indirectly, even in concealing its nature through artifices of language, for an offer of services of a
sexual nature with a direct or indirect profit-making objective, when the said publicity is
specifically addressed to minors or when it refers to services proposed either by minors or by
persons claimed to be so. The sentence shall be imprisonment for three months to three years and
a fine of three hundred to three thousand francs when the publicity referred to in Article 1 has the
objective or effect, direct or indirect, of facilitating the prostitution or debauchery of a minor or
his/her exploitation for sexual purposes.
§ 2. Shall be punished by imprisonment for one month to a year and a fine of a hundred to a
thousand francs whosoever by whatever means publishes, distributes or disseminates or causes to
be published, distributed or disseminated publicity, directly or indirectly, even in concealing its
nature through artifices of language, for an offer of services of a sexual nature with a direct or
indirect profit-making objective, when these services are offered through a telecommunications
medium.
§ 3. In cases not covered by § 1 and § 2, shall be punished by imprisonment for one month to a
year and a fine of a hundred to a thousand francs whosoever by whatever means of publicity, even
in concealing its nature through artifices of language, makes it known that he indulges in
prostitution, facilitates the prostitution of others or wishes to enter into a relationship with a
person indulging in debauchery.
Shall be punished by the same sentences whosoever by means of publicity encourages, through
the allusion made therein, the exploitation of minors or adults for sexual purposes or uses such
publicity on the occasion of an offer of services ."
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3920                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Cyprus Laws Against Child Pornography
Source: http://www.interpol.org/
The age in child pornography legislation is 18 years (Criminal Code chapter 154, Article 154)
The Convention on Cybercrime, law 22(III)/2004
Title 3 – Content-related offences
Article 9 – Offences related to child pornography
1. Each Party shall adopt such legislative and other measures as may be necessary to establish as
criminal offences under its domestic law, when committed intentionally and without right the
following conduct
a. producing child pornography for the purpose of its distribution through a computer system;
b. offering or making available child pornography through a computer system;
c. distributing or transmitting child pornography through a computer system;
d. procuring child pornography through a computer system for oneself or for another person;
e. possessing child pornography in a computer system or on a computer data storage medium.
2. For the purpose of paragraph 1 above, the term 'child pornography' shall include pornographic
material that visually depicts:
a. a minor engaged in sexually explicit conduct;
b. a person appearing to be a minor engaged in sexually explicit conduct;
c. realistic images representing a minor engaged in sexually explicit conduct.
3. For the purpose of paragraph 2 above, the term 'minor' shall include all persons under 18 years of
age. A Party may, however, require a lower age limit, which shall be not less than 16 years.
4. Each Party may reserve the right not to apply, in whole or in part, paragraphs
1. sub-paragraphs d and e, and 2. sub-paragraphs b and c.
Combating Trafficking in Human Beings and Sexual Abuse of Minors Law 3(1)/2000
Trading in pornography material - Law 3(1)/2000
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3921                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
Sec. 4(1): 'Whoever, using children for trading purposes, makes, possess, carries, imports or exports by
any means or circulates documents, printed material, literary works, drawings, paintings, emblems,
photographs, movies or other indecent objects of any kind or uses any means of publication for the
facilitation of the circulation or the trading of the indecent objects commits an offence and in case of
conviction will be liable to imprisonment not exceeding ten (10) years.'
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3922                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 Japan Laws Against Child Pornography
Source: http://www.interpol.int/
Article 2 - Definitions
For the purpose of this Law, 'child pornography' means photos, videotapes and other visual materials
which:
i. Depict, in a way that can be recognized visually, such a pose of a child relating to sexual
intercourse or an act similar to sexual intercourse with or by the child.
ii. Depict, in a way that can be recognized visually, such a pose of a child relating to the act of
touching genital organs, etc. of the child or of having the child touch someone else's genital
organs, etc. in order to arouse or stimulate the viewer's sexual desire; or
iii. Depict, in a way that can be recognized visually, such a pose of a child who is naked totally or
partially in order to arouse or stimulate the viewer's sexual desire.
Article 7 - Distribution, etc. of Child pornography
i. A person who distributes, sells, lends as a business, or displays in public, child pornography shall
be punished with imprisonment with labor for not more than three years or a fine not exceeding
three million yen
ii. A person who produces, possesses, transports, imports to or exports from Japan child
pornography for the purpose of conducting any of the acts mentioned in the preceding paragraph
shall be punished with the same penalty as is described in the said paragraph
iii. A Japanese national who imports to or exports from a foreign country child pornography for the
purpose of conducting any of the acts mentioned in paragraph 1 of this article shall be punished
with the same penalty as is described in the said paragraph
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3923                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 South African Laws Against Child Pornography
Source: http://llnw.creamermedia.co.za/
Child Care Amendment Act
To amend the Child Care Act, 1983, so as to provide for a right of appeal against certain orders relating to
children; to provide for the establishment of secure care facilities; to revoke the power of the Minister to
transfer certain pupils and children to any institution, custody or supervision mentioned in section 290 of
the Criminal Procedure Act, 1977; to provide for the prohibition against the commercial sexual
exploitation of children; and to make further provision for the estimation of a person’s age in certain
proceedings; and to provide for matters connected therewith.
Section 50
1. Any person who participates or is involved in the commercial sexual exploitation of a child shall
be guilty of an offence
2. Any person who is an owner, lessor, manager, tenant or occupier of property on which the
commercial sexual exploitation of a child occurs and who, within a reasonable time of gaining
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3924                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
information of such occurrence, fails to report such occurrence at a police station, shall be guilty
of an offence
3. Any person who is convicted of an offence in terms of this section, shall be liable to a fine, or to
imprisonment for a period not exceeding 10 years, or to both such fine and such imprisonment
Amendment of section 2 of Act 65 of 1996
a. The objects of this Act shall be to—
(a) regulate the creation, production, possession, and distribution of certain publications and
certain films by means of classification, the imposition of age restrictions and the giving of
consumer advice due regard being had in particular to the protection of children against sexual
exploitation or degradation in publications, films and on the Internet and
(b) make the exploitative use of children in pornographic publications, films or on the Internet
punishable
Amendment of section 27 of Act 65 of 1996
 Any person shall be guilty of an offence if he or she knowingly:
(a) creates, produces, imports, or is in possession of a publication which contains a visual
presentation of child pornography
(b) creates, produces, imports, or is in possession of a film which contains a scene or scenes of
child pornography
Computer Hacking Forensic Investigator Exam 312-49
Investigating Child Pornography Cases 
Module XLV Page | 3925                                               Computer Hacking Forensic Investigator Copyright © by EC-Council 
   All Rights Reserved. Reproduction is Strictly Prohibited. 
 UK laws Against Child Pornography
Source: http://www.opsi.gov.uk/
Sex Offences Act 2003 (SOA 2003)
An Act to make new provision about sexual offences, their prevention and the protection of children from
harm from other sexual acts, and for connected purpose. Sections that relate to child harassment towards
pornography are as follows:
 Section 15: Meeting a child following sexual grooming etc.
1. A person aged 18 or over (A) commits an offence if:
a. having met or communicated with another person (B) on at least two earlier occasions, he
intentionally meets B, or travels with the intention of meeting B in any part of the world
b. at the time, he intends to do anything to or in respect of B, during or after the meeting
and in any part of the world, which if done will involve the commission by A of a relevant
offence
c. B is under 16 and
d. A does not reasonably believe that B is 16 or over
2. In subsection (1):
a. The reference to A having met or communicated with B is a reference to A having met B
in any part of the world or having communicated with B by any means from, to or in any
part of the world;
b. “relevant offence” means:
i. an offence under this Part,
ii. an offence within any of paragraphs 61 to 92 of Schedule 3, or
iii. anything done outside England and Wales and Northern Ireland which is not an
offence within sub-paragraph (i) or (ii) but would be an offence within sub-paragraph
(i) if done in England and Wales
3. In this section as it applies to Northern Ireland:
a. subsection (1) has effect with the substitution of “17” for “16” in both places;
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098
File000098

Contenu connexe

Tendances

Unraveling intermediary liability
Unraveling intermediary liabilityUnraveling intermediary liability
Unraveling intermediary liabilityEmily Laidlaw
 
What is a joke? The role of social media providers in regulating speech
What is a joke? The role of social media providers in regulating speechWhat is a joke? The role of social media providers in regulating speech
What is a joke? The role of social media providers in regulating speechEmily Laidlaw
 
Privacy and social media in the workplace
Privacy and social media in the workplacePrivacy and social media in the workplace
Privacy and social media in the workplaceBailey and Wyant PLLC
 
Social Media in the Workplace
Social Media in the Workplace Social Media in the Workplace
Social Media in the Workplace Rachel Hamilton
 
The Human Rights Responsibilities of Internet Gatekeepers
The Human Rights Responsibilities of Internet GatekeepersThe Human Rights Responsibilities of Internet Gatekeepers
The Human Rights Responsibilities of Internet GatekeepersEmily Laidlaw
 
Social Media in the Workplace and Beyond
Social Media in the Workplace and BeyondSocial Media in the Workplace and Beyond
Social Media in the Workplace and BeyondAlexNemiroff
 
Municipalities & The Internet: A Few Legal Issues
Municipalities & The Internet: A Few Legal IssuesMunicipalities & The Internet: A Few Legal Issues
Municipalities & The Internet: A Few Legal IssuesShawn Tuma
 
Social Media and Your Staff by Brian Miller and Jean Boyle, solicitors at Sto...
Social Media and Your Staff by Brian Miller and Jean Boyle, solicitors at Sto...Social Media and Your Staff by Brian Miller and Jean Boyle, solicitors at Sto...
Social Media and Your Staff by Brian Miller and Jean Boyle, solicitors at Sto...Brian Miller, Solicitor
 
Myths And Misconceptions About Workplace Bullying Josh Bornstein
Myths And Misconceptions About Workplace Bullying Josh BornsteinMyths And Misconceptions About Workplace Bullying Josh Bornstein
Myths And Misconceptions About Workplace Bullying Josh BornsteinMaurice Blackburn Lawyers
 
2012: NJ GMIS: The Double Edge Sword of the Social Network
2012: NJ GMIS: The Double Edge Sword of the Social Network2012: NJ GMIS: The Double Edge Sword of the Social Network
2012: NJ GMIS: The Double Edge Sword of the Social NetworkCarol Spencer
 
Perspectivesmanage
PerspectivesmanagePerspectivesmanage
PerspectivesmanageArt Bowker
 
Young Adults And On Line Privacy
Young Adults And On Line PrivacyYoung Adults And On Line Privacy
Young Adults And On Line PrivacyRecrue
 
Public-Employee Privacy Rights in the Age of Social Media
Public-Employee Privacy Rights in the Age of Social MediaPublic-Employee Privacy Rights in the Age of Social Media
Public-Employee Privacy Rights in the Age of Social MediaBailey and Wyant PLLC
 
Social Media And Employment Screening
Social Media And Employment ScreeningSocial Media And Employment Screening
Social Media And Employment ScreeningLakesia Wright
 
2600 v20 n2 (summer 2003)
2600 v20 n2 (summer 2003)2600 v20 n2 (summer 2003)
2600 v20 n2 (summer 2003)Felipe Prado
 

Tendances (20)

Unraveling intermediary liability
Unraveling intermediary liabilityUnraveling intermediary liability
Unraveling intermediary liability
 
What is a joke? The role of social media providers in regulating speech
What is a joke? The role of social media providers in regulating speechWhat is a joke? The role of social media providers in regulating speech
What is a joke? The role of social media providers in regulating speech
 
Privacy and social media in the workplace
Privacy and social media in the workplacePrivacy and social media in the workplace
Privacy and social media in the workplace
 
Social Media in the Workplace
Social Media in the Workplace Social Media in the Workplace
Social Media in the Workplace
 
The Human Rights Responsibilities of Internet Gatekeepers
The Human Rights Responsibilities of Internet GatekeepersThe Human Rights Responsibilities of Internet Gatekeepers
The Human Rights Responsibilities of Internet Gatekeepers
 
Social Media in the Workplace and Beyond
Social Media in the Workplace and BeyondSocial Media in the Workplace and Beyond
Social Media in the Workplace and Beyond
 
Privacy Law
Privacy LawPrivacy Law
Privacy Law
 
Municipalities & The Internet: A Few Legal Issues
Municipalities & The Internet: A Few Legal IssuesMunicipalities & The Internet: A Few Legal Issues
Municipalities & The Internet: A Few Legal Issues
 
Teaching Ethics
Teaching EthicsTeaching Ethics
Teaching Ethics
 
Social Media and Your Staff by Brian Miller and Jean Boyle, solicitors at Sto...
Social Media and Your Staff by Brian Miller and Jean Boyle, solicitors at Sto...Social Media and Your Staff by Brian Miller and Jean Boyle, solicitors at Sto...
Social Media and Your Staff by Brian Miller and Jean Boyle, solicitors at Sto...
 
A Tale of One City
A Tale of One CityA Tale of One City
A Tale of One City
 
Myths And Misconceptions About Workplace Bullying Josh Bornstein
Myths And Misconceptions About Workplace Bullying Josh BornsteinMyths And Misconceptions About Workplace Bullying Josh Bornstein
Myths And Misconceptions About Workplace Bullying Josh Bornstein
 
2012: NJ GMIS: The Double Edge Sword of the Social Network
2012: NJ GMIS: The Double Edge Sword of the Social Network2012: NJ GMIS: The Double Edge Sword of the Social Network
2012: NJ GMIS: The Double Edge Sword of the Social Network
 
Perspectivesmanage
PerspectivesmanagePerspectivesmanage
Perspectivesmanage
 
OLC Presentation Jipson
OLC Presentation JipsonOLC Presentation Jipson
OLC Presentation Jipson
 
Young Adults And On Line Privacy
Young Adults And On Line PrivacyYoung Adults And On Line Privacy
Young Adults And On Line Privacy
 
Public-Employee Privacy Rights in the Age of Social Media
Public-Employee Privacy Rights in the Age of Social MediaPublic-Employee Privacy Rights in the Age of Social Media
Public-Employee Privacy Rights in the Age of Social Media
 
Social Media And Employment Screening
Social Media And Employment ScreeningSocial Media And Employment Screening
Social Media And Employment Screening
 
6161141 Dissertation 310315
6161141 Dissertation 3103156161141 Dissertation 310315
6161141 Dissertation 310315
 
2600 v20 n2 (summer 2003)
2600 v20 n2 (summer 2003)2600 v20 n2 (summer 2003)
2600 v20 n2 (summer 2003)
 

Similaire à File000098

Justine- pedophile laws
Justine- pedophile lawsJustine- pedophile laws
Justine- pedophile lawsJustine
 
Crj 101 as we enter the last week of the course/tutorialoutlet
Crj 101 as we enter the last week of the course/tutorialoutletCrj 101 as we enter the last week of the course/tutorialoutlet
Crj 101 as we enter the last week of the course/tutorialoutletLockley
 
prt. 1...Online Pedophiles
prt. 1...Online Pedophilesprt. 1...Online Pedophiles
prt. 1...Online PedophilesJustine
 
Internet Safety For Kids By Tanmay
Internet Safety For Kids By TanmayInternet Safety For Kids By Tanmay
Internet Safety For Kids By Tanmaytsdikshit
 
Protecting children in cyberspace
Protecting children in cyberspace Protecting children in cyberspace
Protecting children in cyberspace Karnika Seth
 
Pornography on the Internet
Pornography on the Internet Pornography on the Internet
Pornography on the Internet yadith_
 
Pornography on the internet
Pornography on the internetPornography on the internet
Pornography on the internetryangregory55
 
Pornography on the internet
Pornography on the internetPornography on the internet
Pornography on the internetryangregory55
 
Pathways White Paper FINAL (1) (1)
Pathways White Paper FINAL (1) (1)Pathways White Paper FINAL (1) (1)
Pathways White Paper FINAL (1) (1)Professor Mary Aiken
 
Internet Safety
Internet SafetyInternet Safety
Internet SafetyPHSD
 
Grant Proposal Excerpt Build Your Own NGO
Grant Proposal Excerpt Build Your Own NGOGrant Proposal Excerpt Build Your Own NGO
Grant Proposal Excerpt Build Your Own NGOEricka Rodas
 
CYBER CRIME AGAINST CHILDREN_2
CYBER CRIME AGAINST CHILDREN_2CYBER CRIME AGAINST CHILDREN_2
CYBER CRIME AGAINST CHILDREN_2Anchalanshri Dixit
 
Sex Trafficking Survivors Fighting Constant Revictimization.pdf
Sex Trafficking Survivors Fighting Constant Revictimization.pdfSex Trafficking Survivors Fighting Constant Revictimization.pdf
Sex Trafficking Survivors Fighting Constant Revictimization.pdfHeatherTapani
 
Social Media For Investigations By Detective Jeff Bangild Toronto Police #Boo...
Social Media For Investigations By Detective Jeff Bangild Toronto Police #Boo...Social Media For Investigations By Detective Jeff Bangild Toronto Police #Boo...
Social Media For Investigations By Detective Jeff Bangild Toronto Police #Boo...Scott Mills
 
Children-safety-online-Presentation.pptx
Children-safety-online-Presentation.pptxChildren-safety-online-Presentation.pptx
Children-safety-online-Presentation.pptxRahuljain40418
 
SENATOR Mike Crapo (Cyber Bullying Law)
SENATOR Mike Crapo (Cyber Bullying Law)SENATOR Mike Crapo (Cyber Bullying Law)
SENATOR Mike Crapo (Cyber Bullying Law)VogelDenise
 

Similaire à File000098 (20)

Justine- pedophile laws
Justine- pedophile lawsJustine- pedophile laws
Justine- pedophile laws
 
Crj 101 as we enter the last week of the course/tutorialoutlet
Crj 101 as we enter the last week of the course/tutorialoutletCrj 101 as we enter the last week of the course/tutorialoutlet
Crj 101 as we enter the last week of the course/tutorialoutlet
 
prt. 1...Online Pedophiles
prt. 1...Online Pedophilesprt. 1...Online Pedophiles
prt. 1...Online Pedophiles
 
Internet Safety For Kids By Tanmay
Internet Safety For Kids By TanmayInternet Safety For Kids By Tanmay
Internet Safety For Kids By Tanmay
 
Protecting children in cyberspace
Protecting children in cyberspace Protecting children in cyberspace
Protecting children in cyberspace
 
Pornography on the Internet
Pornography on the Internet Pornography on the Internet
Pornography on the Internet
 
Porno
PornoPorno
Porno
 
Pornography on the internet
Pornography on the internetPornography on the internet
Pornography on the internet
 
Pornography on the internet
Pornography on the internetPornography on the internet
Pornography on the internet
 
Pathways White Paper FINAL (1) (1)
Pathways White Paper FINAL (1) (1)Pathways White Paper FINAL (1) (1)
Pathways White Paper FINAL (1) (1)
 
KidSafe - Parental Training Presentation
KidSafe  - Parental Training PresentationKidSafe  - Parental Training Presentation
KidSafe - Parental Training Presentation
 
Internet Safety
Internet SafetyInternet Safety
Internet Safety
 
Grant Proposal Excerpt Build Your Own NGO
Grant Proposal Excerpt Build Your Own NGOGrant Proposal Excerpt Build Your Own NGO
Grant Proposal Excerpt Build Your Own NGO
 
File000158
File000158File000158
File000158
 
Cyber crime against children
Cyber crime against childrenCyber crime against children
Cyber crime against children
 
CYBER CRIME AGAINST CHILDREN_2
CYBER CRIME AGAINST CHILDREN_2CYBER CRIME AGAINST CHILDREN_2
CYBER CRIME AGAINST CHILDREN_2
 
Sex Trafficking Survivors Fighting Constant Revictimization.pdf
Sex Trafficking Survivors Fighting Constant Revictimization.pdfSex Trafficking Survivors Fighting Constant Revictimization.pdf
Sex Trafficking Survivors Fighting Constant Revictimization.pdf
 
Social Media For Investigations By Detective Jeff Bangild Toronto Police #Boo...
Social Media For Investigations By Detective Jeff Bangild Toronto Police #Boo...Social Media For Investigations By Detective Jeff Bangild Toronto Police #Boo...
Social Media For Investigations By Detective Jeff Bangild Toronto Police #Boo...
 
Children-safety-online-Presentation.pptx
Children-safety-online-Presentation.pptxChildren-safety-online-Presentation.pptx
Children-safety-online-Presentation.pptx
 
SENATOR Mike Crapo (Cyber Bullying Law)
SENATOR Mike Crapo (Cyber Bullying Law)SENATOR Mike Crapo (Cyber Bullying Law)
SENATOR Mike Crapo (Cyber Bullying Law)
 

Plus de Desmond Devendran (20)

Siam key-facts
Siam key-factsSiam key-facts
Siam key-facts
 
Siam foundation-process-guides
Siam foundation-process-guidesSiam foundation-process-guides
Siam foundation-process-guides
 
Siam foundation-body-of-knowledge
Siam foundation-body-of-knowledgeSiam foundation-body-of-knowledge
Siam foundation-body-of-knowledge
 
Enterprise service-management-essentials
Enterprise service-management-essentialsEnterprise service-management-essentials
Enterprise service-management-essentials
 
Service Integration and Management
Service Integration and Management Service Integration and Management
Service Integration and Management
 
Diagram of iso_22301_implementation_process_en
Diagram of iso_22301_implementation_process_enDiagram of iso_22301_implementation_process_en
Diagram of iso_22301_implementation_process_en
 
CHFI 1
CHFI 1CHFI 1
CHFI 1
 
File000176
File000176File000176
File000176
 
File000175
File000175File000175
File000175
 
File000174
File000174File000174
File000174
 
File000173
File000173File000173
File000173
 
File000172
File000172File000172
File000172
 
File000171
File000171File000171
File000171
 
File000170
File000170File000170
File000170
 
File000169
File000169File000169
File000169
 
File000168
File000168File000168
File000168
 
File000167
File000167File000167
File000167
 
File000166
File000166File000166
File000166
 
File000165
File000165File000165
File000165
 
File000164
File000164File000164
File000164
 

Dernier

14042024_First India Newspaper Jaipur.pdf
14042024_First India Newspaper Jaipur.pdf14042024_First India Newspaper Jaipur.pdf
14042024_First India Newspaper Jaipur.pdfFIRST INDIA
 
Foreign Relation of Pakistan with Neighboring Countries.pptx
Foreign Relation of Pakistan with Neighboring Countries.pptxForeign Relation of Pakistan with Neighboring Countries.pptx
Foreign Relation of Pakistan with Neighboring Countries.pptxunark75
 
Political-Ideologies-and-The-Movements.pptx
Political-Ideologies-and-The-Movements.pptxPolitical-Ideologies-and-The-Movements.pptx
Political-Ideologies-and-The-Movements.pptxSasikiranMarri
 
Power in International Relations (Pol 5)
Power in International Relations (Pol 5)Power in International Relations (Pol 5)
Power in International Relations (Pol 5)ssuser583c35
 
13042024_First India Newspaper Jaipur.pdf
13042024_First India Newspaper Jaipur.pdf13042024_First India Newspaper Jaipur.pdf
13042024_First India Newspaper Jaipur.pdfFIRST INDIA
 
15042024_First India Newspaper Jaipur.pdf
15042024_First India Newspaper Jaipur.pdf15042024_First India Newspaper Jaipur.pdf
15042024_First India Newspaper Jaipur.pdfFIRST INDIA
 
Geostrategic significance of South Asian countries.ppt
Geostrategic significance of South Asian countries.pptGeostrategic significance of South Asian countries.ppt
Geostrategic significance of South Asian countries.pptUsmanKaran
 
11042024_First India Newspaper Jaipur.pdf
11042024_First India Newspaper Jaipur.pdf11042024_First India Newspaper Jaipur.pdf
11042024_First India Newspaper Jaipur.pdfFIRST INDIA
 
lok sabha Elections in india- 2024 .pptx
lok sabha Elections in india- 2024 .pptxlok sabha Elections in india- 2024 .pptx
lok sabha Elections in india- 2024 .pptxdigiyvbmrkt
 
Transforming Andhra Pradesh: TDP's Legacy in Road Connectivity
Transforming Andhra Pradesh: TDP's Legacy in Road ConnectivityTransforming Andhra Pradesh: TDP's Legacy in Road Connectivity
Transforming Andhra Pradesh: TDP's Legacy in Road Connectivitynarsireddynannuri1
 
Mitochondrial Fusion Vital for Adult Brain Function and Disease Understanding...
Mitochondrial Fusion Vital for Adult Brain Function and Disease Understanding...Mitochondrial Fusion Vital for Adult Brain Function and Disease Understanding...
Mitochondrial Fusion Vital for Adult Brain Function and Disease Understanding...The Lifesciences Magazine
 
16042024_First India Newspaper Jaipur.pdf
16042024_First India Newspaper Jaipur.pdf16042024_First India Newspaper Jaipur.pdf
16042024_First India Newspaper Jaipur.pdfFIRST INDIA
 
12042024_First India Newspaper Jaipur.pdf
12042024_First India Newspaper Jaipur.pdf12042024_First India Newspaper Jaipur.pdf
12042024_First India Newspaper Jaipur.pdfFIRST INDIA
 
Emerging issues in migration policies.ppt
Emerging issues in migration policies.pptEmerging issues in migration policies.ppt
Emerging issues in migration policies.pptNandinituteja1
 

Dernier (14)

14042024_First India Newspaper Jaipur.pdf
14042024_First India Newspaper Jaipur.pdf14042024_First India Newspaper Jaipur.pdf
14042024_First India Newspaper Jaipur.pdf
 
Foreign Relation of Pakistan with Neighboring Countries.pptx
Foreign Relation of Pakistan with Neighboring Countries.pptxForeign Relation of Pakistan with Neighboring Countries.pptx
Foreign Relation of Pakistan with Neighboring Countries.pptx
 
Political-Ideologies-and-The-Movements.pptx
Political-Ideologies-and-The-Movements.pptxPolitical-Ideologies-and-The-Movements.pptx
Political-Ideologies-and-The-Movements.pptx
 
Power in International Relations (Pol 5)
Power in International Relations (Pol 5)Power in International Relations (Pol 5)
Power in International Relations (Pol 5)
 
13042024_First India Newspaper Jaipur.pdf
13042024_First India Newspaper Jaipur.pdf13042024_First India Newspaper Jaipur.pdf
13042024_First India Newspaper Jaipur.pdf
 
15042024_First India Newspaper Jaipur.pdf
15042024_First India Newspaper Jaipur.pdf15042024_First India Newspaper Jaipur.pdf
15042024_First India Newspaper Jaipur.pdf
 
Geostrategic significance of South Asian countries.ppt
Geostrategic significance of South Asian countries.pptGeostrategic significance of South Asian countries.ppt
Geostrategic significance of South Asian countries.ppt
 
11042024_First India Newspaper Jaipur.pdf
11042024_First India Newspaper Jaipur.pdf11042024_First India Newspaper Jaipur.pdf
11042024_First India Newspaper Jaipur.pdf
 
lok sabha Elections in india- 2024 .pptx
lok sabha Elections in india- 2024 .pptxlok sabha Elections in india- 2024 .pptx
lok sabha Elections in india- 2024 .pptx
 
Transforming Andhra Pradesh: TDP's Legacy in Road Connectivity
Transforming Andhra Pradesh: TDP's Legacy in Road ConnectivityTransforming Andhra Pradesh: TDP's Legacy in Road Connectivity
Transforming Andhra Pradesh: TDP's Legacy in Road Connectivity
 
Mitochondrial Fusion Vital for Adult Brain Function and Disease Understanding...
Mitochondrial Fusion Vital for Adult Brain Function and Disease Understanding...Mitochondrial Fusion Vital for Adult Brain Function and Disease Understanding...
Mitochondrial Fusion Vital for Adult Brain Function and Disease Understanding...
 
16042024_First India Newspaper Jaipur.pdf
16042024_First India Newspaper Jaipur.pdf16042024_First India Newspaper Jaipur.pdf
16042024_First India Newspaper Jaipur.pdf
 
12042024_First India Newspaper Jaipur.pdf
12042024_First India Newspaper Jaipur.pdf12042024_First India Newspaper Jaipur.pdf
12042024_First India Newspaper Jaipur.pdf
 
Emerging issues in migration policies.ppt
Emerging issues in migration policies.pptEmerging issues in migration policies.ppt
Emerging issues in migration policies.ppt
 

File000098

  • 1. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3841                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.  Computer Hacking Forensic Investigator (CHFI) Module XLV: Investigating Child Pornography Cases Exam 312-49
  • 2. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3842                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   News: 7 Southern California Men Arrested in Child Porn Investigation Source: http://www.latimes.com/ 52 people were suspected of possessing or producing child pornography using peer-to-peer computer networks to exchange those graphic images and videos. These were from Los Angeles, Orange, Riverside, San Bernardino and Ventura counties and out of them, seven Southern California men were arrested on Tuesday following an eight-month investigation by federal, state, and local law enforcement agencies. U.S. Atty. Thomas O'Brien at a news conference in Los Angeles said that, "The evidence is horrific”. The charged included attorneys, a law enforcement officer, and men with previous child porn-related convictions. If convicted of the maximum charges for possession of child pornography, each defendant could face up to 10 years in federal prison. Those with a previous conviction could face a minimum of 10 years. Those charged include Gary Samuel Cochran, 50, of Huntington Beach, previously convicted of child molestation and possession of obscene materials depicting children engaged in sex acts; Evan Craig Stephens, 36, of Upland, a registered sex offender; George Tyler Farmer, 39, of Oxnard, previously convicted of molesting a 6-year-old child; and Eric David Lacey, 48, of Hollywood.
  • 3. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3843                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   News: Chinese National Arrested Over Child Porn Source: http://www.abc.net.au/ Many of the cases are enrolled against child pornography. A man who was arriving from Hong Kong was arrested at Cairns Airport, in far north Queensland after customs official found child porn on his laptop computer. Later, a 30 years old Chinese national was detained and taken to the Cairns watch-house for court proceedings before being bailed. Kaylene Zakharoff, an acting customs’ national manager of investigations said that:  “The man faces up to 10 years imprisonment if he/she is convicted”  “Visitors to Australia need not be aware that Australia does have strict import controls and this type of pornography is not accepted and we will investigate and prosecute these matters where appropriate.”
  • 4. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3844                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   News: Theft Leads to Child Porn Search Source: http://www.argusleader.com/ According to the court’s documents, investigators have found child porn images on the system of Elk point’s volunteer fire management. According to the search warrant documents though large numbers of suspected child porn images were found on the system of Kavanaugh, 43, he was not charged against it. According to an affidavit in support of the search warrant, the investigation began when Kavanaugh reported that his computer was stolen from his Burbank home on June 27. He complained this to Sheriff Dan Limoges, county prosecutors, and the attorney general's office about a deputy's refusal to take the report seriously. In one of those conversations, he even said that the laptop was found later in his yard in damaged condition and was used for several times. On July 8, deputies retrieved the computer from the Elk Point Fire Station and examined it. According to an affidavit, the search revealed, "Dozens of female nude images which had titles such as high school teens and two images titled mother and young daughter natural. These two images contained a nude woman with a preteen girl, both fully nude." Investigators obtained a search warrant the next day but the charges have not been filed as Miller said that, he has not received any report from the sheriff's office. He said, "It's still in the investigative stage. It's far too early to make any statement at all." Elk Point Mayor Isabel Trobaugh said:  She was surprised to hear about the investigation, but she had no first-hand knowledge of it  The volunteer fire department is separate from city government and is funded by property owners in the fire district.
  • 5. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3845                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.  Module Objective Child pornography is the serious crime prevailing on the Internet. It is the harassing act against the children where the adults are using them for their gratification. Possessing or transmitting the child porn images or videos is considered as a crime and various organizations (law enforcement and non-profitable organizations) are taking initiative to stop it. This module will familiarize you with:  Child Pornography  People’s Motives behind Child Pornography  People involved in Child Pornography  Role of Internet in Promoting Child Pornography  Effects of Child Pornography on children  Measures to Prevent Dissemination of Child Pornography  Challenges in Controlling Child Pornography  Steps for Investigating Child Pornography Cases  Sources of Digital Evidence  Techniques to Reduce the Problem of Child Pornography  Guidelines to Avoid Pornography  Report on Child Pornography  Laws against Child Pornography  Anti-Child Pornography Organizations
  • 6. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3846                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.  Module Flow  
  • 7. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3847                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Introduction to Child Pornography Child Pornography is a serious crime. There are growing numbers of children who access the Internet all over the world. Rapidly expanding computer technology and the Internet has given access to the production and distribution of child pornography. Child pornography is defined as “a visual depiction of any kind, including a drawing, cartoon, sculpture, or painting, photograph, film, video, or computer-generated image or picture, whether made or produced by electronic, mechanical, or other means, of sexually explicit conduct, where it depicts a minor engaging in sexually explicit conduct and is obscene, or depicts an image that is, or appears to be, of a minor engaging in graphic bestiality, sadistic or masochistic abuse, or sexual intercourse, including genital- genital, oral-genital, anal-genital, or oral-anal, whether between persons of the same or opposite sex.”. Source: http://www.missingkids.com Child pornography also includes the production, distribution, and possession of pornographic material. As children spend more and more of their time on the Internet, they are becoming increasingly prey to child abusers/pornographers. Child pornography begins with the production of pornographic materials such as porn images and videos. Offenders enter into correspondence with children through online instant messaging or chat rooms. They emotionally attract the prospective victim and befriend them. After establishing a steady relationship, they introduce children to pornography by providing images and videos that have sexually explicit material. Not only girls and boys but also infants are becoming victim to such offensive activities. Pornographers make use of poor children, disabled minors, and sometimes neighborhood children for sexual exploitation. Distribution of porn material is also a serious crime. The Internet has made the distribution of illegal material easy. Pornographers resort to newsgroups, Internet Relay Chat, web-based groups, email, webcams, and peer-to-peer technology to distribute pornographic material. Downloading of such images is also considered a crime.
  • 8. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3848                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited. 
  • 9. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3849                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Survey Source: http://www.missingkids.com/  Figure 44-1: The Second National Incidence Studies of Missing, Abducted, Runaway, and Thrown away Children Figure 44-2: The Second National Incidence Studies of Missing, Abducted, Runaway, and Thrown away Children
  • 10. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3850                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.  Figure 44-3: Sex Crime Cases Survey Report
  • 11. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3851                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   People’s Motive behind Child Pornography It is observed that criminals involved in pornographic cases are unmarried, separated, divorced, or widowed. They become involved with child pornography due to various factors. These factors could range from mere moneymaking to sexual perversion. Children being the most vulnerable of the victims of sexual perversion, these offenders go for child pornography. They draw children into pornographic activities by:  Seduction  Coercion: They force children into sexual activities or threaten them with dire consequences  Payment: They offer monetary benefits to attract children  Solicitation: Request them for a sexual relationship Voyeurism is another motive behind child pornography. It includes people who derive sexual pleasure by secretly watching the sexual activities or others in the nude. Blackmailing is also a factor that leads some people to child pornography. The offenders lure or force children or teenagers into offensive activities and make videos and images of them. Later, they blackmail the victims or their parents by threatening to expose the images or videos. Offenders sell pornographic material to make easy money. They also build their own web sites that provide pornographic materials for money, such as downloading the pornographic images from their site.
  • 12. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3852                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   People Involved in Child Pornography People involved in child pornography, known as “pornographers”, are either directly or indirectly related to child abuse. It involves people who enter into online relationships with children. They attract victims for sexual activities or send the pornographic materials to children as part of the grooming process. They contact children using online messaging or a chatroom. This is considered as direct abuse of children. A person who physically abuses children is also considered a child pornographer. For such people, the main intention is to satisfy their sexual curiosity. They also make pornographic images or videos for their own satisfaction. Production of porn material is also a serious crime. A person who produces porn images or records the sexual activities of children is also considered a pornographer. A person who provides sources of child pornography is also included in such an offence. Such offences are indirect abuse of children. They may distribute pornographic materials through email, web cam, and in a chatroom. People who intentionally download pornographic material from the Internet and save it to their computer also fall into the category of pornographer. They may not have any intention to abuse and may not be related to other offenders; they download it for pleasure. Parents or guardians who allow their children to engage in pornographic activity are also considered offenders.
  • 13. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3853                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Role of Internet in Child Pornography The Internet is a fast communication vehicle providing a number of online services. This growing facility helps children and youngsters to learn. Yet, with the increase in access, there has been a rise in Internet crimes. The Internet plays an important role in child pornography cases. Through the Internet, it is easy to access a huge quantity of pornographic material. It provides complete anonymity and privacy. It reduces the cost of production and distribution of such material. The offender distributes the material easily with web services such as email, user groups, and webcams. An offender can create his own web site and upload the porn material, so that others can easily download it. Using an Internet facility such as a web cam, he can send real-time porn pictures or video. The most frequent source for distributing porn material is email. Offenders can send images or videos as attachments. Offenders can also use email for grooming or seduction purposes. Other methods of distributing child pornography through the Internet are as follows: Newsgroup: In a newsgroup, members may discuss their sexual interest in child and adult pornographic material Chatrooms: In chatrooms, offenders chat and share porn materials with each other. The Internet is the best and most inexpensive method for transferring porn materials. The most advantageous factor about the Internet is that the offenders can access pornographic material anytime and anywhere. The Internet enables them to send the images or videos in any format which can be stored easily in any digital devices such as mobile phones and PDAs.
  • 14. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3854                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Effects of Child Pornography on Children Child pornography affects children physically, socially, and psychologically. It causes physical injuries to the victims during molestation such as genital bruising and lacerations. In many cases, teenagers may be inflicted with negative effects on growing sexuality due to inappropriate early sexual experiences. Child pornography also gives rise to sexually transmitted diseases. Child pornographic victims also suffer from psychological traumas such as depression, emptiness, and schizophrenia. Girl victims may suffer from higher rates of nightmares, back pain, headaches, pelvic pain, and other similar symptoms in her adult age. Pornography may cause sexual addiction that result in prostitution teenage pregnancy and sexually transmitted diseases. A victim may also lose his or her mental balance and become suicidal.
  • 15. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3855                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Measures to Prevent Dissemination of Child Pornography  Computer Industry Self Regulation (Role of ISP): An ISP (Internet Service Provider) plays an important role in reducing the problems of child pornography. If an ISP helps to procure pornographic material over the Internet, then it becomes easy for the police to apprehend the pornographer. Yet in some cases, an ISP stores and gives access to child pornography sites for commercial purposes. Therefore, it is necessary for an ISP to take some self-regulatory actions to reduce the problem of child pornography. Some of these strategies include: o Block the illegal sites: It is important that various ISP associations should come together and make a decision to block the illegal sites. If any member opens it unknowingly, then he should be told to remove that site. o Use the filters for browsers and search engines for safe search: ISPs can use filters on the browsers to help block sites containing words related to pornography and use filters on the search engines so that it will not search the illegal sites or images. o Establish compliant sites: Some of the ISP associations should open the complaint site or hot sites that will help people to complain against pornography. Such an association may directly deal with the police or any other authority.  Legislative Regulation: Create rules and regulations against child pornography to minimize the problem of pornography. Make it mandatory for the ISP to inform the police about illegal sites. Inform ISPs to verify the identities of the people who open the Internet. If they find anyone who illegally uses others’ accounts, they should inform the police. Confirm the age of the account holder and restrict children from opening an account without an adult’s supervision. Inform an advertiser not to advertise such illegal sites. Inform the credit card companies not to pay money to anyone without confirming it. If they find any transaction with a pornographer, block the credit card transaction of that person.  Citizen’s Committee:
  • 16. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3856                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.  A Citizen’s committee may also help in controlling child pornography. They may establish an organization, which creates awareness among the public about such issues and provides them with a forum to voice their complaints about such activities. They may provide information to parents and teachers through their sites or publications about the problem of child pornography and how to tackle them.  Parental Strategies: Parents play an important role in protecting children from child pornography. They should restrict their children from accessing such materials. They should use filtering software and search engines to protect their children from any indecent material.  Law Enforcement Responses (Role of Police): Police play a crucial role in investigating the pornographic sites. The police may use new computer forensics tools and techniques to investigate such sites. They may scan the Internet service and restrict the ISP to remove illegal sites. They may perform sting operations to investigate the offenders. They may make contact through chatrooms, newsgroups, or via P2P with offenders by disguising themselves as teenagers to investigate the offenders. Police may also use the honey-trap sites to find offenders. These sites contain pornographic material, but they note the IP address or the credit card number of a criminal who tries to download the porn material from these sites.
  • 17. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3857                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Challenges in Controlling Child Pornography  Large Internet traffic: The Internet is the network of networks; it provides a fast and easy way for disseminating information. In order to keep a check on the sites, if you block the way to open any site, then there are many alternatives available to reach the same target. In a similar way, if you block any website or newsgroup, then there are a number of sites and groups which replace the same. Due to this large traffic over the Internet, it is difficult to catch the person who visits such sites.  Unclear jurisdiction due to anonymity of offenders: The Internet is the best tool for communication all over the world. So, criminals from any corner of the world can send or use pornographic material. Laws differ from country to country so it adds to the difficulty of tracking the offender. For example, in the United States a child is defined as those who are under 18 years of age, while in Australia it is defined as those who are under 16years of age. It may happen that an offender produces the porn material in one country and distributes it in another country. This causes a problem about who will investigate and under which country’s law, the offender should be arrested.  Lack of laws and regulation: Another challenge to check child pornography is the lack of laws and regulation in different countries. In most countries, there are no laws against child pornography, so offenders can easily produce the porn material in such countries and distribute it through the Internet all over the world.  Sophistication and the use of Internet technology by offenders: Due to sophisticated Internet technologies, it is difficult to track the offender. Offenders use various techniques such as email, webcams, chatrooms, and newsgroups to distribute the material. With the Internet, it is easy to access a number of pornographic materials which reduces the cost of production and distribution of such material. It provides complete anonymity and privacy that causes a problem during investigation.
  • 18. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3858                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Precautions before Investigating Child Pornography Cases The investigators are required to take the precautions or the guidelines for evaluation and solving the case. The precautions to be taken before investigating child pornography cases are as follows:  Ensure the authorization to investigate the child pornography cases  Familiarize with the local laws that are related to the child pornography  Document each step of the investigation in detail  Take assistance from two authorized persons
  • 19. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3859                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Steps for Investigating Child Pornography Investigators follow certain steps for investigating child pornography cases, which are as follows: 1. Search and seize all computers and media devices 2. Check the authenticated login sessions 3. Search the hard disk for pornographic material 4. Recover deleted files and folders 5. Check metadata of files and folders related to pornography 6. Check and recover browser information: a. Browsing history b. Download history c. Saved form and search history d. Cache e. Cookies f. Saved passwords g. Authenticated sessions 7. Check ISP logs
  • 20. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3860                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Step 1: Search and Seize All Computers and Media Devices The user can save the information on the system or media devices such as USBs, CDs, and DVDs. Follow these steps to search the files on these devices for evidence:  Search the files and folders of the suspect’s system for pornographic material  Look for the pornographic material on media devices such as USBs, CDs and DVDs, and pen drives  Document and seize the collected evidence carefully
  • 21. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3861                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Step 2: Check Authenticated Login Sessions Check sessions through which the user can log in to the system either through an administrator account, standard account, or via guest account with an authentication (password):  Check the login information as user accounts are password protected  Check under which account the pornographic material was accessed  Check the user, who accessed the porn material, i.e., is he an authenticated user, a guest, or an administrator? Figure 44-4: User Login
  • 22. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3862                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Step 3: Search the Hard Disk for Pornographic Material Search the hard disk of the suspect’s system for pornographic material.  Hard disk search includes searching in: o Files and folders o Applications o Temporary Internet files o Recycle Bin Tools such as SurfRecon scan the system for pornographic material (both on hard disk as well as browser cache).
  • 23. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3863                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Step 4: Recover Deleted Files and Folders The user may delete the pornographic material from the desktop, hard disk, and even from the Recycle Bin. To recover files and folders, even though they are deleted from the Recycle Bin:  Use tools such as File Recover, Data recovery wizards, PC Inspector File Recovery, etc. Figure 44-5: Data Recovery Wizards (Source: https://www.regnow.com/)
  • 24. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3864                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.  Figure 44-6: PC Inspector File Recovery (Source: http://www.raymond.cc/)
  • 25. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3865                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Step 5: Check Metadata of Files and Folders Related to Pornography Metadata is the information of when the file was created, modified, or deleted. File/folder creation, modification, or deletion allows the investigator to know when the material was accessed.  Check the metadata of files and folders that consist of pornographic material  Check the metadata of files and folders from the Recycle Bin (as most users tend to delete the files from the desktop or drives after accessing them) Figure 44-7: Folder Properties Window
  • 26. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3866                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Step 6: Check and Recover the Browser Information It is easy to check the browsed information with the help of browsers such as Internet Explorer, Mozilla Firefox, etc.  Check and recover browser, information which includes: o Browsing history, save form, and search history o Download history o Cache o Cookies o Offline website data o Saved passwords o Authenticated sessions
  • 27. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3867                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Browsing History, Save Form, and Search History To access browsing history, open Internet browser and press Ctrl+H to open the browsing history. The steps to check the browsing history, save form, and search history are as follows:  Check the links that were accessed to trace the child pornography link  Search for the suspected link through the search bar Browsers offer the feature of URL suggestion as the user types the letters in the URL tab (provided the URLs were browsed on the system, on the particular browser, previously). Figure 44-8: Browsing History
  • 28. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3868                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.  Figure 44-9: History Window
  • 29. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3869                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Download History Download history is one of the features of Internet browsers, where downloaded information is saved. To view the download history:  Select Tools and click Download; or  Just press Ctrl+J (shortcut to access download history information) Though users have a tendency to clean up the downloaded information, if not cleaned up, it provides detailed information of the files that are downloaded and can be a source of evidence. Figure 44-10: File Downloading Window
  • 30. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3870                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Cache A cache is a collection of web page copies stored on the system’s hard disk or in its volatile memory, i.e., random-access memory (RAM). To change cache settings, open the browser. Select Tools. Open the Advanced panel, and click the Network tab. Enter a number in the Use up to field to specify the size of the cache. A user will sometimes select the Clear Now option for security purposes, in order to delete the cache information. Steps to get information from the cache are as follows:  Check the browser information in the cache  If the browser cache information is deleted, recover the information using tools such as INDEX.DAT file viewer Figure 44-11: Cache Window
  • 31. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3871                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Cookies A cookie is a piece of information that is stored on the system by a web browser. Steps to be followed to check the cookies are as follows:  Check the cookie information to determine the websites the user has accessed  To access cookies, select Tools. Click options→Privacy→Show Cookies Figure 44-12: Cookie Window
  • 32. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3872                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.  Figure 44-13: Window Showing Cookies
  • 33. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3873                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Saved Passwords A password is the secret word or string used for authentication purposes. New versions of browsers provide the ability to store passwords of visited websites. Passwords are remembered and saved by the browser, depending upon the user’s request, and this information is stored in the Remember Passwords section of the browser tools. Investigators need to check this information for as it provides URLs of sites, usernames, as well passwords. To check for those passwords and access the links to find evidence:  Go to Tools→Options→Security→Show Passwords Figure 44-14: Password Window
  • 34. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3874                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Authenticated Sessions An authenticated session is the use of the correct username and password for a particular link. To check for authenticated sessions, follow these steps:  Check whether the user logged in to website with authentication  Check for the number of attempts made by the user Figure 44-15: Login Window
  • 35. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3875                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Step 7: Check ISP Logs ISP logs are all Internet activity information that is saved by Internet service providers. They are logs of the web pages that the user has visited. These logs provide data access information (Internet access) of the users to whom a particular ISP provider provides service. This is a difficult way to extract information because:  ISPs do not usually show the logs, to maintain user privacy  Though ISPs show the logs, it is difficult to extract required information from the huge amount of logs The ISP can provide help; for instance, suppose the police raided the owner a child pornography site. It is easy to look up to the IP addresses of the users who have visited the site and once the IP addresses are found, the police can get the details of the users with the ISP’s help.
  • 36. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3876                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Sources of Digital Evidence Following are some of the sources of evidence that play an important role during investigation:  Offender’s computer: The offender’s computer is the main source of evidence during the investigation of child pornography cases. When an offender downloads any image, it saves it to the hard drive, which is important evidence for the investigation. There are many materials, such as log files, which show the detailed information about who logged on to the computer and when. The web browser’s history shows the online activities of the criminal. Email and chat logs extract an online communication record of the offender.  Hand-held devices: Offenders may also use handheld devices for child pornography. Devices such as PDAs and mobile phones with digital cameras can be used for recording offensive pictures and transmitting digital images. Therefore, these devices are also important in investigation.  Servers: Servers may also play an important role in investigation. For example, an ISP authentication server records the information of the customer with the IP address that can be used for identifying the user. FTP and web servers are generally used for uploading and downloading the files, but it also records the details about which file to be uploaded or downloaded and also monitors the IP address of the user.
  • 37. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3877                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Citizens’ Responsibility Against Pornography Possessing, transmitting, or distributing the child porn images are illegal acts. More than being a crime, it is inhuman to harass a child for doing the act, so as a citizen it is our responsibility to act against it thus eradicating it completely for a better society. Following are the guidelines that citizens can use in order to eradicate pornography:  Protest against child porn websites  Provide information about the impact of pornography on children  Take initiatives to cease child porn on web  Report against the site that is distributing child porn to government officials  Report to anti- child porn organizations about the site o Report is anonymous and 24*7 online, so no problem can be created after posting the report  Block credit card transactions that are requested for child pornography  Ask ISPs to block the content or URL o Example: World's largest Internet Service Providers (ISPs) Verizon, Time Warner Cable, and Sprint blocked access to child porn material, available on the Internet.
  • 38. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3878                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Guidelines to Avoid Child Pornography on the Web There are many child pornographic sites prevailing on the Internet. Following are the guidelines to avoid child pornography on the web:  Use Internet filters that filter unwanted content on the system: Internet filters are the software that is installed on the system in order to avoid unwanted content such as child porn sites, gambling sites, etc.  Make use of search engines that have in-built filters: It is necessary to make use of search engines that have in-built filters as they help in safe searching and filtered results. Example: Google safe search filtering  Avoid guesswork on URLs: Most of the users have a habit of making a guess work on URLs to get the information, but this at times moves the user to pornographic sites.  Use proper and appropriate keywords during research: Use appropriate keywords while researching, otherwise this can cause problems  Avoid browsing questionable URLs or banners that take you to unwelcomed sites
  • 39. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3879                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Guidelines for Parents to Protect Children from Pornography Source: http://www.crime-research.org/ Initial teachers for children are their parents, so it is necessary that they guide their children to make good decisions. Following are the guidelines for parents to reduce the risk of their children being taken advantage of:  Create a friendly relationship with your child: If the child is afraid of his/her parents, it is unlikely that he/she will ask them for help. So it is necessary and the parents’ responsibility to have a good relationship with their children.  Guide your child while browsing: Browsing a huge network like the Internet is at times dangerous to your child, so parents can help by guiding their children and teaching them safe ways to search.  Install filtering software that blocks porn sites: There are various Internet filters available that filter websites that the user (parent) wishes to block on the system.  Promote the use of search engines with safe search: Promote the use of search engines with safe search (Google offers safe search) in order to stay away from inappropriate sites.
  • 40. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3880                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Make children aware of child pornography prevailing on Internet: Explain to your child in detail about child pornography that is prevalent on the Internet. Even familiarize them with laws and offenses they could face due to its promotion.  Assist them with various anti-child pornography organizations: Though software is installed, there is still a chance of pornography prevailing on the system. It is the duty of parents to inform kids about whom to approach and how to report that particular illegal site, thus helping to eradicate pornography.  Use software: Use software that monitors and records all websites visited by your child, captures and logs their instant messenger chats, etc. If parents find that their children have been looking at pornography, they should explain to the child that he or she has committed a crime, and make sure that the child understands the law.
  • 41. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3881                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.    Tools to Protect Children from Pornography
  • 42. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3882                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Reveal Source: http://www.antichildporn.org/ The concept behind this software is to help bridge the technology gap between the knowledgeable child who is on the Internet, yet lacks the life skills needed to know what is and is not dangerous, and parents who may be a bit behind in understanding this technology and what their child may be getting into. Reveal, although not intended as a police forensic tool, it thought to be of some utility in providing a quick means for evaluating large amounts of computer data/files. In the advanced section of Reveal, the ability to create a customized dictionary will be helpful in some types of data reviews. The attached program is a self-extracting and self-installing program which creates a directory (default) on your "C" drive in "C:ProgramsReveal". It also creates a couple of sub directories under this directory as well as putting an icon on the Desktop. It also comes with an un-install program and is thought to be free of any code, which will affect the way you have your computer setup. Features:  Reveal works by searching all files found and comparing each word inside a file against special dictionaries of words commonly used by pedophiles, child pornographers, cultists, occultists, drug pushers, and purveyors of hate and violence  It also searches for images, video, and audio files and provides a quick and easy means for you to review these files for content which may be objectionable
  • 43. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3883                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   iProtectYou Source: ‘http://www.softforyou.com/ iProtectYou is an Internet filtering and monitoring program, which enables you to control when the Internet can be used and which websites can be accessed through your computer. iProtectYou is designed for parents who are concerned about the possible detrimental effects of the Internet on the development of their children. iProtectYou is also designed for schools and libraries, so that they can control what is being viewed in public spaces, and schools, so that children do not have free access to undesirable sites on the Internet. The porn blocker iProtectYou gives parents several methods for monitoring and controlling their children from accessing child pornography over the Internet:  Porn block by word filtering: You can prevent access to websites containing vulgar or explicit words or phrases. These settings can changed be at any time at your discretion. In order to increase the effectiveness of the program, you have the option to use words from a pre-made list, or you can define your own.  Porn block by URL (address) filtering: You can prevent access to individual websites based on their URL (address). iProtectYou gives you complete control over this filter's settings. You can also choose to block web sites using iProtectYou's built-in list of bad sites.  Porn block by using the bad site list: This comprehensive and ever-changing list is made up of over thousands of websites on the Internet that contain undesirable content such as pornography. If the parent wants to block a particular website not found in the list, they can do this by using the URL (Address) filtering. Features:  Restrict your family members from visiting websites and news groups that may contain pernicious information  Block emails, chat sessions, instant messages, and P2P connections if they contain inappropriate words  Prevent your private information (credit card number for example) from being sent to the Internet  Set a schedule to specify days and times when online activity is allowed  Limit Internet Traffic to a specified amount of data that can be sent or received per user / per day
  • 44. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3884                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Control the list of programs that can have access to the Internet  Get notification emails with full descriptions of blocked operations and an attached screen-shot of your kids' computer to control them remotely  Get detailed information about Internet resources used by your computer  Set different levels of restrictions for every member of your family depending on their maturity, interest, habits, and parental control needs Figure 44-16: iProtectYou Pro control pannel   Figure 44-17: iProtectYou Users and Groups screenshot
  • 45. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3885                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.    Figure 44-18: iProtectYou setting screenshot
  • 46. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3886                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   WUPC Web Control for Parents 4 Source: http://www.download.com/ WUPC Web Control for Parents 4 is an easy-to-use parental control tool, developed specially to protect children from forbidden materials such as pornography, online gambling, and online drug information. It helps to prevent kids from accessing user-specified websites. It has a very clear interface, where you can review websites that were visited by your child and lock all forbidden materials with two clicks. Figure 44-19: WUPC Web Control for Parents 4
  • 47. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3887                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   BrowseControl Source: http://www.browsecontrol.com/ BrowseControl controls access to the Internet and blocks applications on Windows operating systems. It can also be used to block access to floppy disks, CD drives, and USB drives. It helps the user to restrict inappropriate surfing and enforce Internet usage policies. Following are the features of BrowseControl:  It can completely block the Internet  Allow access to only websites the user specifies  Deny web access to websites the user specifies  Schedule Internet ON at only certain times of the day  It consists of an Application Blocker that allows the user to specify software applications he or she wants to block the user from running  It can block any number of protocols and the user can even specify any additional ports
  • 48. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3888                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.  Figure 44-20: BrowseControl
  • 49. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3889                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   ChatGuard Source: http://www.chatprotection.com/ ChatGuard is the software developed for protection from online sexual solicitation It monitors:  Internet o Chat sessions, URLs, communications, emails, and so on  Games and audio  Desktop enhancements  Business and finance Figure 44-21: ChatGuard session logs screenshot
  • 50. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3890                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.  Figure 44-22: ChatGuard version update screenshot Figure 44-23: ChatGuard parent library screenshot
  • 51. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3891                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Child Exploitation Tracking System (CETS) Source: http://www.microsoft.com/ CETS was developed jointly by Microsoft Canada, the Royal Canadian Mounted Police (RCMP), and the Toronto Police Service. CETS, a software solution built using open industry standards, assists law- enforcement officials in their work to stop the exploitation of children on the Internet by enabling effective collaboration and providing a set of advanced software tools and technologies for use by investigators. The tracking system will serve as a repository of information and will also be used as an investigative tool. The solution enables police agencies to capture, share, and search information from the point of detection through the investigative phase, arrest, and offender management. CETS is a great tool for information management; CETS puts together the work of hundreds of police agencies in one place. The tool can establish links from the different agencies that police wouldn't necessarily make. Features:  CETS enables agencies to avoid duplicate efforts. Sharing information over a secure network, officers can match up investigations that reference the same people or online identities  CETS links and connects criminal behavior online that is difficult for the human eye to see  Using CETS, police agencies can manage and analyze huge volumes of information in powerful new ways, such as cross-referencing obscure data relationships and using social-network analysis to identify communities of offenders 
  • 52. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3892                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited. 
  • 53. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3893                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited. 
  • 54. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3894                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited. 
  • 55. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3895                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Reports on Child Pornography Source: http://www.icmec.org/ The following tables demonstrate the survey of various countries against child pornography. These tables show that some countries such as Afghanistan, Albania, Bangladesh, India, Pakistan, Thailand, Singapore, and Egypt do not have any law against child pornography, while countries such as Argentina, Austria, Belgium, Brazil, Canada, France, Germany, Hong Kong, Italy, Japan, New Zealand, Russia, South Africa, United Kingdom and United States have well defined laws against child pornography.
  • 56. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3896                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   
  • 57. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3897                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.       
  • 58. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3898                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.     
  • 59. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3899                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.       
  • 60. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3900                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.       
  • 61. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3901                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.     
  • 62. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3902                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.     
  • 63. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3903                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.       
  • 64. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3904                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.       
  • 65. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3905                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.       
  • 66. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3906                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.    Figure 44-24: Child Pornography Reports
  • 67. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3907                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.    Laws Against Child Pornography
  • 68. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3908                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.       
  • 69. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3909                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   U.S. Laws Against Child Pornography Source: http://www.missingkids.com/ 18 U.S.C. 1466A – OBSCENE VISUAL REPRESENTATIONS OF THE SEXUAL ABUSE OF CHILDREN It is forbidden to knowingly produce, distribute, receive, or possess with the intent to distribute, a visual depiction of any kind, including a drawing, cartoon, sculpture, or painting, that:  depicts a minor engaging in sexually explicit conduct and is obscene, or  depicts an image that is, or appears to be, of a minor engaging in graphic bestiality, sadistic or masochistic abuse, or sexual intercourse, including genital-genital, oral-genital, anal-genital, or oral-anal, whether between persons of the same or opposite sex, and such depiction lacks serious literary, artistic, political, or scientific value. Attempts or conspiracies to knowingly produce, distribute, receive, or possess with the intent to distribute, a visual depiction of any kind, including a drawing, cartoon, sculpture, or painting, that:  depicts a minor engaging in sexually explicit conduct and is obscene, or  depicts an image that is, or appears to be, of a minor engaging in graphic bestiality, sadistic or masochistic abuse, or sexual intercourse, including genital-genital, oral-genital, anal-genital, or oral-anal, whether between persons of the same or opposite sex, and such depiction lacks serious literary, artistic, political, or scientific value, are also forbidden. It is forbidden to knowingly possess a visual depiction of any kind, including a drawing, cartoon, sculpture, or painting, that:  depicts a minor engaging in sexually explicit conduct and is obscene, or  depicts an image that is, or appears to be, of a minor engaging in graphic bestiality, sadistic or masochistic abuse, or sexual intercourse, including genital-genital, oral-genital, anal-genital, or oral-anal, whether between persons of the same or opposite sex, and such depiction lacks serious literary, artistic, political, or scientific value, If one of the...circumstances [noted below] is present:  any communication involved in or made in furtherance of the offense is communicated or transported by the mail, or in interstate or foreign commerce by any means, including by computer, or any means or instrumentality of interstate or foreign commerce is otherwise used in committing or in furtherance of the commission of the offense;  any communication involved in or made in furtherance of the offense contemplates the transmission or transportation of a visual depiction by the mail, or in interstate or foreign commerce by any means, including by computer;  any person travels or is transported in interstate or foreign commerce in the course of the commission or in furtherance of the commission of the offense;  any visual depiction involved in the offense has been mailed, or has been shipped or transported in interstate or foreign commerce by any means, including by computer, or was produced using materials that have been mailed, or that have been shipped or transported in interstate or foreign commerce by any means, including by computer; or  The offense is committed in the special maritime and territorial jurisdiction of the United States or in any territory or possession of the United States. An attempt to knowingly possess such a visual depiction is also forbidden under the same circumstances Source: http://www.law.cornell.edu/ § 2251. Sexual exploitation of children
  • 70. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3910                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.  (a) Any person who employs, uses, persuades, induces, entices, or coerces any minor to engage in, or who has a minor assist any other person to engage in, or who transports any minor in interstate or foreign commerce, or in any Territory or Possession of the United States, with the intent that such minor engage in, any sexually explicit conduct for the purpose of producing any visual depiction of such conduct, shall be punished as provided under subsection (e), if such person knows or has reason to know that such visual depiction will be transported in interstate or foreign commerce or mailed, if that visual depiction was produced using materials that have been mailed, shipped, or transported in interstate or foreign commerce by any means, including by computer, or if such visual depiction has actually been transported in interstate or foreign commerce or mailed. (b) Any parent, legal guardian, or person having custody or control of a minor who knowingly permits such minor to engage in, or to assist any other person to engage in, sexually explicit conduct for the purpose of producing any visual depiction of such conduct shall be punished as provided under subsection (e) of this section, if such parent, legal guardian, or person knows or has reason to know that such visual depiction will be transported in interstate or foreign commerce or mailed, if that visual depiction was produced using materials that have been mailed, shipped, or transported in interstate or foreign commerce by any means, including by computer, or if such visual depiction has actually been transported in interstate or foreign commerce or mailed. (c) (1) Any person who, in a circumstance described in paragraph (2), employs, uses, persuades, induces, entices, or coerces any minor to engage in, or who has a minor assist any other person to engage in, any sexually explicit conduct outside of the United States, its territories or possessions, for the purpose of producing any visual depiction of such conduct, shall be punished as provided under subsection (e). (2) The circumstance referred to in paragraph (1) is that— (A) The person intends such visual depiction to be transported to the United States, its territories or possessions, by any means, including by computer or mail; or (B) The person transports such visual depiction to the United States, its territories or possessions, by any means, including by computer or mail. (d) (1)Any person, who, in a circumstance described in paragraph (2), knowingly makes, prints, or publishes, or causes to be made, printed, or published, any notice or advertisement seeking or offering— (A) to receive, exchange, buy, produce, display, distribute, or reproduce, any visual depiction, if the production of such visual depiction involves the use of a minor engaging in sexually explicit conduct and such visual depiction is of such conduct; or (B) Participation in any act of sexually explicit conduct by or with any minor for the purpose of producing a visual depiction of such conduct; shall be punished as provided under subsection (e). (2) The circumstance referred to in paragraph (1) is that— (A) such person knows or has reason to know that such notice or advertisement will be transported in interstate or foreign commerce by any means including by computer or mailed; or (B) Such notice or advertisement is transported in interstate or foreign commerce by any means including by computer or mailed. (e) Any individual who violates, or attempts or conspires to violate, this section shall be fined under this title and imprisoned not less than 15 years nor more than 30 years, but if such person has one prior conviction under this chapter, chapter 71, chapter 109A, or chapter 117, or under section 920 of title 10 (article 120 of the Uniform Code of Military Justice), or under the laws of any State relating to the sexual exploitation of children, such person shall be fined under this title and imprisoned for not less than 25 years nor more than 50 years, but if such person has 2 or more prior convictions under this chapter, chapter 71, chapter 109A, or chapter 117, or under section 920 of title 10 (article 120 of the Uniform Code
  • 71. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3911                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.  of Military Justice), or under the laws of any State relating to the sexual exploitation of children, such person shall be fined under this title and imprisoned not less than 35 years nor more than life. Any organization that violates, or attempts or conspires to violate, this section shall be fined under this title. Whoever, in the course of an offense under this section, engages in conduct that results in the death of a person shall be punished by death or imprisoned for any term of years or for life. § 2252. Certain activities relating to material involving the sexual exploitation of minors (a) Any person who— (1) Knowingly transports or ships in interstate or foreign commerce by any means including by computer or mails, any visual depiction, if— (A) The producing of such visual depiction involves the use of a minor engaging in sexually explicit conduct; and (B) Such visual depiction is of such conduct; (2) knowingly receives, or distributes, any visual depiction that has been mailed, or has been shipped or transported in interstate or foreign commerce, or which contains materials which have been mailed or so shipped or transported, by any means including by computer, or knowingly reproduces any visual depiction for distribution in interstate or foreign commerce or through the mails, if— (A) The producing of such visual depiction involves the use of a minor engaging in sexually explicit conduct; and (B) Such visual depiction is of such conduct; (3) Either— (A) in the special maritime and territorial jurisdiction of the United States, or on any land or building owned by, leased to, or otherwise used by or under the control of the Government of the United States, or in the Indian country as defined in section 1151 of this title, knowingly sells or possesses with intent to sell any visual depiction; or (B) knowingly sells or possesses with intent to sell any visual depiction that has been mailed, or has been shipped or transported in interstate or foreign commerce, or which was produced using materials which have been mailed or so shipped or transported, by any means, including by computer, if— (i) The producing of such visual depiction involves the use of a minor engaging in sexually explicit conduct; and (ii) Such visual depiction is of such conduct; or (4) Either— (A) in the special maritime and territorial jurisdiction of the United States, or on any land or building owned by, leased to, or otherwise used by or under the control of the Government of the United States, or in the Indian country as defined in section 1151 of this title, knowingly possesses 1 or more books, magazines, periodicals, films, video tapes, or other matter which contain any visual depiction; or (B) knowingly possesses 1 or more books, magazines, periodicals, films, video tapes, or other matter which contain any visual depiction that has been mailed, or has been shipped or transported in interstate or foreign commerce, or which was produced using materials which have been mailed or so shipped or transported, by any means including by computer, if— (i) The producing of such visual depiction involves the use of a minor engaging in sexually explicit conduct; and (ii) Such visual depiction is of such conduct; shall be punished as provided in subsection (b) of this section. (b)
  • 72. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3912                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.  (1) Whoever violates, or attempts or conspires to violate, paragraphs [1] (1), (2), or (3) of subsection (a) shall be fined under this title and imprisoned not less than 5 years and not more than 20 years, but if such person has a prior conviction under this chapter, chapter 71, chapter 109A, or chapter 117, or under section 920 of title 10 (article 120 of the Uniform Code of Military Justice), or under the laws of any State relating to aggravated sexual abuse, sexual abuse, or abusive sexual conduct involving a minor or ward, or the production, possession, receipt, mailing, sale, distribution, shipment, or transportation of child pornography, such person shall be fined under this title and imprisoned for not less than 15 years nor more than 40 years. (2) Whoever violates, or attempts or conspires to violate, paragraph (4) of subsection (a) shall be fined under this title or imprisoned not more than 10 years, or both, but if such person has a prior conviction under this chapter, chapter 71, chapter 109A, or chapter 117, or under section 920 of title 10 (article 120 of the Uniform Code of Military Justice), or under the laws of any State relating to aggravated sexual abuse, sexual abuse, or abusive sexual conduct involving a minor or ward, or the production, possession, receipt, mailing, sale, distribution, shipment, or transportation of child pornography, such person shall be fined under this title and imprisoned for not less than 10 years nor more than 20 years.
  • 73. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3913                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   U.S. Laws Against Child Pornography Source: http://www4.law.cornell.edu/ 42 U.S.C. 13032 – Reporting of child pornography by electronic communication service providers 1. Duty of report: Whoever, while engaged in providing an electronic communication service or a remote computing service to the public, through a facility or means of interstate or foreign commerce, obtains knowledge of facts or circumstances from which a violation of section 2251, 2251A, 2252, 2252A, 2252B, or 2260 of title 18, involving child pornography (as defined in section 2256 of that title), or a violation of section 1466A of that title, is apparent, shall, as soon as reasonably possible, make a report of such facts or circumstances to the Cyber Tip Line at the National Center for Missing and Exploited Children (NCMEC), which shall forward that report to a law enforcement agency or agencies designated by the Attorney General. 2. Designation of agencies: Not later than 180 days after October 30, 1998, the Attorney General shall designate the law enforcement agency or agencies to which a report shall be forwarded under paragraph (1) 3. In addition to forwarding such reports to those agencies designated in subsection (b)(2) of this section, the National Center for Missing and Exploited Children is authorized to forward any such report to an appropriate official of a state or subdivision of a state for the purpose of enforcing state criminal law. 4. Failure to report: A provider of electronic communication services or remote computing services described in paragraph (1) who knowingly and willfully fails to make a report under that paragraph shall be fined: a. in the case of an initial failure to make a report, not more than $50,000; and b. in the case of any second or subsequent failure to make a report, not more than $100,000 
  • 74. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3914                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Australia Laws Against Child Pornography Source: http://www.austlii.edu.au/ 474.19 Using a carriage service for child pornography material (1) A person is guilty of an offence if: (a) The person: (i) Uses a carriage service to access material; or (ii) Uses a carriage service to cause material to be transmitted to the person; or (iii) Uses a carriage service to transmit material; or (iv) Uses a carriage service to make material available; or (v) Uses a carriage service to publish or otherwise distribute material; and (b) The material is child pornography material. Penalty: Imprisonment for 10 years.
  • 75. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3915                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.  (2) To avoid doubt, the following are the fault elements for the physical elements of an offence against subsection (1): (a) Intention is the fault element for the conduct referred to in paragraph (1) (a); (b) Recklessness is the fault element for the circumstances referred to in paragraph (1)(b). (3) As well as the general defenses provided for in Part 2.3, defenses are provided for under section 474.21 in relation to this section. 474.20 Possessing, controlling, producing, supplying or obtaining child pornography material for use through a carriage service (1) A person is guilty of an offence if: (a) The person: (i) Has possession or control of material; or (ii) Produces, supplies or obtains material; and (b) The material is child pornography material; and (c) The person has that possession or control, or engages in that production, supply or obtaining, with the intention that the material be used: (i) By that person; or (ii) By another person; In committing an offence against section 474.19 (using a carriage service for child pornography material). Penalty: Imprisonment for 10 years.
  • 76. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3916                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Austria Laws Against Child Pornography Source: http://www.interpol.org/ § 207a - Pornographic depictions of minors (1) Anyone who 1. Produces or 2. Imports, transports or exports for the purpose of dissemination or 3. offers, procures, transfers, presents or makes available in any other manner to another person a pornographic depiction of a minor (under paragraph 4) will be sentenced to up to three years' imprisonment. (2) Anyone who commits the offence for financial gain will be sentenced to six months' to five years' imprisonment. Anyone who commits the offence as a member of a criminal organization, or in such a way that the minor sustains particularly grievous harm, will be sentenced to 1-10 years' imprisonment; anyone who produces a pornographic depiction of a minor (under paragraph 4) using severe violence or who, in producing such pornographic depiction, endangers the life of the depicted minor either intentionally or as a result of gross negligence, will also be punished. (3) Anyone who obtains, or is in possession of, a pornographic depiction of a minor over 14 years of age (under paragraph 4, subparagraphs 3 and 4) will be sentenced to up to one year's imprisonment. Anyone who obtains, or is in possession of, a pornographic depiction of a minor (under paragraph 4) will be sentenced to up to two years' imprisonment. (4) Pornographic depictions of minors are: 1. Realistic depictions of a sexual act performed on a minor under 14 years of age or by such minor on himself, on another person or with an animal, 2. realistic depictions of an event performed with a minor under 14 years of age, examination of which creates the impression, according to the circumstances of the case, that it involves a sexual act performed on such minor or by the minor on himself, on another person or with an animal, 3. Realistic depictions a. of a sexual act within the meaning of subparagraph 1 or of an event within the meaning of subparagraph 2, though with minors over 14 years of age, or
  • 77. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3917                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.  b. of the genitals or pubic region of minors, provided such depictions are distorted in a sensational manner, focus on the genitals or pubic region or are devoid of other manifestations of life in order to sexually to arouse the observer, 4. pictorial representations, an examination of which - following alteration of a depiction or without use of such alteration - creates the impression, according to the circumstances of the case, that it is a depiction within the meaning of subparagraphs 1-3. (5) In accordance with paragraph 1, subparagraph 1, and paragraph 3, anyone who: 1. produces, or is in possession of, a pornographic depiction of a minor over 14 years of age with the latter's consent or for the latter's own private use, or 2. Produces, or is in possession of, a pornographic depiction of a minor over 14 years of age, within the meaning of paragraph 4, subparagraph 4, for his own private use, provided no risk of dissemination of the depiction is associated with the act, shall not be punished.
  • 78. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3918                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Belgium Laws Against Child Pornography Source: http://www.childfocus-net-alert.be/ “Art.383bis (*) § 1. Notwithstanding the application of Articles 379 and 380, whosoever has displayed, sold, rented, distributed or handed out emblems, objects, films, photos, slides or other visual media representing sexual positions or acts of a pornographic nature, involving or representing minors or has handed to a transport or distribution agent, manufactured or held, imported or caused to be imported such objects with a view to commerce or distribution shall be punished by penal servitude and a fine of five hundred to ten thousand francs. § 2. Whosoever has knowingly possessed emblems, objects, films, photos, slides or other visual media as referred to under § 1 shall be punished by imprisonment for a month to a year and a fine of hundred to a thousand francs. § 3. The offence referred to under § 1 shall be punished by forced labor for ten to fifteen years and a fine of five hundred to fifty thousand francs if it constitutes an act of participation in the main or accessory activity of an association, whether or not the culprit holds the position of manager.
  • 79. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3919                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.  § 4. The special confiscation provided for in Article 42, 1°, may be applied to the offences referred to in § 1 and § 2, even when the objects that it concern, are not the property of the convicted person. § 5. Articles 382 and 389 are applicable to the offences referred to in § 1 and § 3. " "Art.380ter (*) § 1. Shall be punished by imprisonment for two months to two years and a fine of two hundred francs to two thousand francs whosoever and by whatever means publishes, distributes or disseminates or causes to be published, distributed or disseminated publicity, directly or indirectly, even in concealing its nature through artifices of language, for an offer of services of a sexual nature with a direct or indirect profit-making objective, when the said publicity is specifically addressed to minors or when it refers to services proposed either by minors or by persons claimed to be so. The sentence shall be imprisonment for three months to three years and a fine of three hundred to three thousand francs when the publicity referred to in Article 1 has the objective or effect, direct or indirect, of facilitating the prostitution or debauchery of a minor or his/her exploitation for sexual purposes. § 2. Shall be punished by imprisonment for one month to a year and a fine of a hundred to a thousand francs whosoever by whatever means publishes, distributes or disseminates or causes to be published, distributed or disseminated publicity, directly or indirectly, even in concealing its nature through artifices of language, for an offer of services of a sexual nature with a direct or indirect profit-making objective, when these services are offered through a telecommunications medium. § 3. In cases not covered by § 1 and § 2, shall be punished by imprisonment for one month to a year and a fine of a hundred to a thousand francs whosoever by whatever means of publicity, even in concealing its nature through artifices of language, makes it known that he indulges in prostitution, facilitates the prostitution of others or wishes to enter into a relationship with a person indulging in debauchery. Shall be punished by the same sentences whosoever by means of publicity encourages, through the allusion made therein, the exploitation of minors or adults for sexual purposes or uses such publicity on the occasion of an offer of services ."
  • 80. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3920                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Cyprus Laws Against Child Pornography Source: http://www.interpol.org/ The age in child pornography legislation is 18 years (Criminal Code chapter 154, Article 154) The Convention on Cybercrime, law 22(III)/2004 Title 3 – Content-related offences Article 9 – Offences related to child pornography 1. Each Party shall adopt such legislative and other measures as may be necessary to establish as criminal offences under its domestic law, when committed intentionally and without right the following conduct a. producing child pornography for the purpose of its distribution through a computer system; b. offering or making available child pornography through a computer system; c. distributing or transmitting child pornography through a computer system; d. procuring child pornography through a computer system for oneself or for another person; e. possessing child pornography in a computer system or on a computer data storage medium. 2. For the purpose of paragraph 1 above, the term 'child pornography' shall include pornographic material that visually depicts: a. a minor engaged in sexually explicit conduct; b. a person appearing to be a minor engaged in sexually explicit conduct; c. realistic images representing a minor engaged in sexually explicit conduct. 3. For the purpose of paragraph 2 above, the term 'minor' shall include all persons under 18 years of age. A Party may, however, require a lower age limit, which shall be not less than 16 years. 4. Each Party may reserve the right not to apply, in whole or in part, paragraphs 1. sub-paragraphs d and e, and 2. sub-paragraphs b and c. Combating Trafficking in Human Beings and Sexual Abuse of Minors Law 3(1)/2000 Trading in pornography material - Law 3(1)/2000
  • 81. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3921                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.  Sec. 4(1): 'Whoever, using children for trading purposes, makes, possess, carries, imports or exports by any means or circulates documents, printed material, literary works, drawings, paintings, emblems, photographs, movies or other indecent objects of any kind or uses any means of publication for the facilitation of the circulation or the trading of the indecent objects commits an offence and in case of conviction will be liable to imprisonment not exceeding ten (10) years.'
  • 82. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3922                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   Japan Laws Against Child Pornography Source: http://www.interpol.int/ Article 2 - Definitions For the purpose of this Law, 'child pornography' means photos, videotapes and other visual materials which: i. Depict, in a way that can be recognized visually, such a pose of a child relating to sexual intercourse or an act similar to sexual intercourse with or by the child. ii. Depict, in a way that can be recognized visually, such a pose of a child relating to the act of touching genital organs, etc. of the child or of having the child touch someone else's genital organs, etc. in order to arouse or stimulate the viewer's sexual desire; or iii. Depict, in a way that can be recognized visually, such a pose of a child who is naked totally or partially in order to arouse or stimulate the viewer's sexual desire. Article 7 - Distribution, etc. of Child pornography i. A person who distributes, sells, lends as a business, or displays in public, child pornography shall be punished with imprisonment with labor for not more than three years or a fine not exceeding three million yen ii. A person who produces, possesses, transports, imports to or exports from Japan child pornography for the purpose of conducting any of the acts mentioned in the preceding paragraph shall be punished with the same penalty as is described in the said paragraph iii. A Japanese national who imports to or exports from a foreign country child pornography for the purpose of conducting any of the acts mentioned in paragraph 1 of this article shall be punished with the same penalty as is described in the said paragraph
  • 83. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3923                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   South African Laws Against Child Pornography Source: http://llnw.creamermedia.co.za/ Child Care Amendment Act To amend the Child Care Act, 1983, so as to provide for a right of appeal against certain orders relating to children; to provide for the establishment of secure care facilities; to revoke the power of the Minister to transfer certain pupils and children to any institution, custody or supervision mentioned in section 290 of the Criminal Procedure Act, 1977; to provide for the prohibition against the commercial sexual exploitation of children; and to make further provision for the estimation of a person’s age in certain proceedings; and to provide for matters connected therewith. Section 50 1. Any person who participates or is involved in the commercial sexual exploitation of a child shall be guilty of an offence 2. Any person who is an owner, lessor, manager, tenant or occupier of property on which the commercial sexual exploitation of a child occurs and who, within a reasonable time of gaining
  • 84. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3924                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.  information of such occurrence, fails to report such occurrence at a police station, shall be guilty of an offence 3. Any person who is convicted of an offence in terms of this section, shall be liable to a fine, or to imprisonment for a period not exceeding 10 years, or to both such fine and such imprisonment Amendment of section 2 of Act 65 of 1996 a. The objects of this Act shall be to— (a) regulate the creation, production, possession, and distribution of certain publications and certain films by means of classification, the imposition of age restrictions and the giving of consumer advice due regard being had in particular to the protection of children against sexual exploitation or degradation in publications, films and on the Internet and (b) make the exploitative use of children in pornographic publications, films or on the Internet punishable Amendment of section 27 of Act 65 of 1996  Any person shall be guilty of an offence if he or she knowingly: (a) creates, produces, imports, or is in possession of a publication which contains a visual presentation of child pornography (b) creates, produces, imports, or is in possession of a film which contains a scene or scenes of child pornography
  • 85. Computer Hacking Forensic Investigator Exam 312-49 Investigating Child Pornography Cases  Module XLV Page | 3925                                               Computer Hacking Forensic Investigator Copyright © by EC-Council     All Rights Reserved. Reproduction is Strictly Prohibited.   UK laws Against Child Pornography Source: http://www.opsi.gov.uk/ Sex Offences Act 2003 (SOA 2003) An Act to make new provision about sexual offences, their prevention and the protection of children from harm from other sexual acts, and for connected purpose. Sections that relate to child harassment towards pornography are as follows:  Section 15: Meeting a child following sexual grooming etc. 1. A person aged 18 or over (A) commits an offence if: a. having met or communicated with another person (B) on at least two earlier occasions, he intentionally meets B, or travels with the intention of meeting B in any part of the world b. at the time, he intends to do anything to or in respect of B, during or after the meeting and in any part of the world, which if done will involve the commission by A of a relevant offence c. B is under 16 and d. A does not reasonably believe that B is 16 or over 2. In subsection (1): a. The reference to A having met or communicated with B is a reference to A having met B in any part of the world or having communicated with B by any means from, to or in any part of the world; b. “relevant offence” means: i. an offence under this Part, ii. an offence within any of paragraphs 61 to 92 of Schedule 3, or iii. anything done outside England and Wales and Northern Ireland which is not an offence within sub-paragraph (i) or (ii) but would be an offence within sub-paragraph (i) if done in England and Wales 3. In this section as it applies to Northern Ireland: a. subsection (1) has effect with the substitution of “17” for “16” in both places;