Security Series Walk-Through |
|
x | |
Preface |
|
xii | |
About the Authors |
|
xvii | |
Acknowledgments |
|
xviii | |
Quality Assurance |
|
xviii | |
|
PART ONE Admissibility of Electronic Evidence |
|
|
1 | (78) |
|
Forensic Evidence and Crime Investigation |
|
|
3 | (35) |
|
|
4 | (6) |
|
Information Warfare, Electronic Attack, and Terrorism |
|
|
10 | (2) |
|
Computer Forensics Evidence and Investigations |
|
|
12 | (7) |
|
Electronic Evidence: Technology and Legal Issues |
|
|
19 | (3) |
|
Computer Forensics: A Growing Field and Practice Area |
|
|
22 | (3) |
|
|
25 | (2) |
|
Electronic Discovery (E-Discovery) |
|
|
27 | (11) |
|
|
31 | (1) |
|
|
31 | (7) |
|
Computer Forensics and Digital Detective Work |
|
|
38 | (41) |
|
The Role of E-Evidence in Solving Physical and Computer Crimes |
|
|
39 | (4) |
|
Computer Forensics Science |
|
|
43 | (3) |
|
Digital Signatures and Profiling |
|
|
46 | (2) |
|
Computer Forensics and the E-Evidence Collection Process |
|
|
48 | (5) |
|
Suppression, Probable Cause, and Search Warrants |
|
|
53 | (7) |
|
Types of Motives and Cybercrimes |
|
|
60 | (7) |
|
Forensics Rules and Evidence Issues |
|
|
67 | (3) |
|
Computer Forensics Investigator's Responsibilities |
|
|
70 | (9) |
|
|
70 | (1) |
|
|
71 | (8) |
|
PART TWO Preparing for E-Evidence Collection and Preservation |
|
|
79 | (114) |
|
Tools, Environments, Equipment, and Certifications |
|
|
81 | (39) |
|
Managing the Life-Cycle of a Case |
|
|
82 | (3) |
|
Acquiring and Authenticating the E-Evidence |
|
|
85 | (6) |
|
Searching and Analyzing the Data |
|
|
91 | (4) |
|
Investigative Environments and Analysis Modes |
|
|
95 | (1) |
|
Forensic Tools and Toolkits |
|
|
96 | (10) |
|
|
106 | (4) |
|
Certification and Training Programs |
|
|
110 | (10) |
|
|
111 | (1) |
|
|
112 | (8) |
|
|
120 | (37) |
|
Reasons for Policies and Procedures |
|
|
121 | (2) |
|
|
123 | (5) |
|
Steps in the Forensic Examination |
|
|
128 | (10) |
|
|
138 | (5) |
|
The Art of Forensics: Analyzing the Data |
|
|
143 | (5) |
|
Reporting on the Investigation |
|
|
148 | (9) |
|
|
151 | (1) |
|
|
152 | (5) |
|
Data, PDA, and Cell Phone Forensics |
|
|
157 | (36) |
|
Basic Hard Drive Technology |
|
|
158 | (3) |
|
Other Storage Technologies |
|
|
161 | (4) |
|
Personal Digital Assistant Devices (PDAs) |
|
|
165 | (1) |
|
|
166 | (1) |
|
|
167 | (6) |
|
|
173 | (2) |
|
|
175 | (3) |
|
Disk Image Forensic Tools |
|
|
178 | (2) |
|
PDA/Cellular Phone Forensic Software |
|
|
180 | (13) |
|
|
187 | (1) |
|
|
188 | (5) |
|
PART THREE Forensic Examination of Computers and Digital and Electronic Media |
|
|
193 | (124) |
|
Operating Systems and Data Transmission Basics for Digital Investigations |
|
|
195 | (41) |
|
What Is an Operating System? |
|
|
196 | (1) |
|
Major Components of an Operating System |
|
|
197 | (4) |
|
|
201 | (15) |
|
|
216 | (5) |
|
|
221 | (15) |
|
|
229 | (1) |
|
|
229 | (7) |
|
Investigating Windows, Linux, and Graphics Files |
|
|
236 | (46) |
|
Investigating Windows Systems |
|
|
237 | (3) |
|
Finding User Data and Profiles in Windows Folders |
|
|
240 | (7) |
|
Investigating System Artifacts |
|
|
247 | (7) |
|
Investigating Linux Systems |
|
|
254 | (8) |
|
|
262 | (20) |
|
|
267 | (1) |
|
|
267 | (15) |
|
E-Mail and Webmail Forensics |
|
|
282 | (35) |
|
Importance of E-Mail as Evidence |
|
|
283 | (1) |
|
|
284 | (6) |
|
|
290 | (3) |
|
Working with Mail Servers |
|
|
293 | (3) |
|
Examining E-Mails for Evidence |
|
|
296 | (8) |
|
Working with Instant Messaging |
|
|
304 | (13) |
|
|
306 | (1) |
|
|
307 | (10) |
|
PART FOUR Detecting Intrusions, Malware, and Fraud |
|
|
317 | (88) |
|
Internet and Network Forensics and Intrusion Detection |
|
|
319 | (29) |
|
An Introduction to Network Forensics and Intrusion Detection |
|
|
320 | (6) |
|
Data Sources on a Network |
|
|
326 | (5) |
|
Physical Aspects of Capturing Data |
|
|
331 | (1) |
|
Logical Aspects of Capturing Data |
|
|
332 | (1) |
|
|
333 | (5) |
|
|
338 | (10) |
|
|
342 | (1) |
|
|
342 | (6) |
|
Tracking Down Those Who Intend to Do Harm on a Large Scale |
|
|
348 | (24) |
|
Large-Scale Investigations |
|
|
349 | (2) |
|
Terrorism, Virtual Warfare, and Other Types of Internet-Based Hostilities |
|
|
351 | (7) |
|
Botnets and Criminal Commerce |
|
|
358 | (3) |
|
Tracking Criminals' Trails |
|
|
361 | (11) |
|
|
364 | (1) |
|
|
364 | (8) |
|
Fraud and Forensic Accounting Investigation |
|
|
372 | (33) |
|
Challenges of Fraud Investigations |
|
|
373 | (9) |
|
|
382 | (8) |
|
Characteristics and Symptoms of Fraud |
|
|
390 | (2) |
|
Fraud Investigation and Deterrence |
|
|
392 | (2) |
|
Digital Forensic Accounting |
|
|
394 | (11) |
|
|
397 | (1) |
|
|
398 | (7) |
|
PART FIVE Legal, Ethical, and Testimony Topics |
|
|
405 | (62) |
|
Federal Rules and Criminal Codes |
|
|
407 | (29) |
|
|
408 | (9) |
|
|
417 | (19) |
|
|
429 | (1) |
|
|
429 | (7) |
|
Ethical and Professional Responsibility in Testimony |
|
|
436 | (31) |
|
The Importance of Forensic Expert Witnesses and Expert Reports |
|
|
437 | (6) |
|
|
443 | (7) |
|
Guidelines for Testifying |
|
|
450 | (8) |
|
Professional and Educational Resources |
|
|
458 | (9) |
|
|
459 | (1) |
|
|
460 | (7) |
Appendix A: Online Resources |
|
467 | (5) |
Appendix B: Government and Legal References |
|
472 | (6) |
Appendix C: Sample Legal Forms, Letters, and Motions |
|
478 | (26) |
Appendix D: Summaries of Court Cases |
|
504 | (4) |
Glossary |
|
508 | (8) |
References |
|
516 | (7) |
Index |
|
523 | |