0%

Book Description

The Definitive, Up-to-Date Guide to Digital Forensics

The rapid proliferation of cyber crime is increasing the demand for digital forensics experts in both law enforcement and in the private sector. In Digital Archaeology, expert practitioner Michael Graves has written the most thorough, realistic, and up-to-date guide to the principles and techniques of modern digital forensics.

Graves begins by providing a solid understanding of the legal underpinnings of and critical laws affecting computer forensics, including key principles of evidence and case law. Next, he explains how to systematically and thoroughly investigate computer systems to unearth crimes or other misbehavior, and back it up with evidence that will stand up in court.

Drawing on the analogy of archaeological research, Graves explains each key tool and method investigators use to reliably uncover hidden information in digital systems. His detailed demonstrations often include the actual syntax of command-line utilities. Along the way, he presents exclusive coverage of facilities management, a full chapter on the crucial topic of first response to a digital crime scene, and up-to-the-minute coverage of investigating evidence in the cloud.

Graves concludes by presenting coverage of important professional and business issues associated with building a career in digital forensics, including current licensing and certification requirements.

Topics Covered Include

  • Acquiring and analyzing data in ways consistent with forensic procedure

  • Recovering and examining e-mail, Web, and networking activity

  • Investigating users’ behavior on mobile devices

  • Overcoming anti-forensics measures that seek to prevent data capture and analysis

  • Performing comprehensive electronic discovery in connection with lawsuits

  • Effectively managing cases and documenting the evidence you find

  • Planning and building your career in digital forensics

  • Digital Archaeology is a key resource for anyone preparing for a career as a professional investigator; for IT professionals who are sometimes called upon to assist in investigations; and for those seeking an explanation of the processes involved in preparing an effective defense, including how to avoid the legally indefensible destruction of digital evidence.

    Book Description

    The Definitive, Up-to-Date Guide to Digital Forensics

    The rapid proliferation of cyber crime is increasing the demand for digital forensics experts in both law enforcement and in the private sector. In Digital Archaeology, expert practitioner Michael Graves has written the most thorough, realistic, and up-to-date guide to the principles and techniques of modern digital forensics.

    Graves begins by providing a solid understanding of the legal underpinnings of and critical laws affecting computer forensics, including key principles of evidence and case law. Next, he explains how to systematically and thoroughly investigate computer systems to unearth crimes or other misbehavior, and back it up with evidence that will stand up in court.

    Drawing on the analogy of archaeological research, Graves explains each key tool and method investigators use to reliably uncover hidden information in digital systems. His detailed demonstrations often include the actual syntax of command-line utilities. Along the way, he presents exclusive coverage of facilities management, a full chapter on the crucial topic of first response to a digital crime scene, and up-to-the-minute coverage of investigating evidence in the cloud.

    Graves concludes by presenting coverage of important professional and business issues associated with building a career in digital forensics, including current licensing and certification requirements.

    Topics Covered Include

  • Acquiring and analyzing data in ways consistent with forensic procedure

  • Recovering and examining e-mail, Web, and networking activity

  • Investigating users’ behavior on mobile devices

  • Overcoming anti-forensics measures that seek to prevent data capture and analysis

  • Performing comprehensive electronic discovery in connection with lawsuits

  • Effectively managing cases and documenting the evidence you find

  • Planning and building your career in digital forensics

  • Digital Archaeology is a key resource for anyone preparing for a career as a professional investigator; for IT professionals who are sometimes called upon to assist in investigations; and for those seeking an explanation of the processes involved in preparing an effective defense, including how to avoid the legally indefensible destruction of digital evidence.

    Table of Contents

    1. About This eBook
    2. Title Page
    3. Copyright Page
    4. Dedication Page
    5. Contents
    6. Preface
      1. Why This Book?
      2. Who Will Benefit from This Book?
      3. Who Will NOT Benefit from This Book?
      4. How This Book Is Organized
      5. Understanding the Book’s Format
      6. The Need for Professionals
      7. Certification Programs for Forensics Professionals
      8. A Personal Note on Certification Programs
      9. Acknowledgments
    7. About the Author
    8. 1. The Anatomy of a Digital Investigation
      1. A Basic Model for Investigators
      2. Understanding the Scope of the Investigation
      3. Identifying the Stakeholders
      4. The Art of Documentation
      5. Chapter Review
      6. Chapter Exercises
      7. References
    9. 2. Laws Affecting Forensic Investigations
      1. Constitutional Implications of Forensic Investigation
      2. The Right to Privacy
      3. The Expert Witness
      4. Chapter Review
      5. Chapter Exercises
      6. References
    10. 3. Search Warrants and Subpoenas
      1. Distinguishing between Warrants and Subpoenas
      2. What Is a Search and When Is It Legal?
      3. Basic Elements of Obtaining a Warrant
      4. The Plain View Doctrine
      5. The Warrantless Search
      6. Subpoenas
      7. Chapter Review
      8. Chapter Exercises
      9. References
    11. 4. Legislated Privacy Concerns
      1. General Privacy
      2. Financial Legislation
      3. Privacy in Health Care and Education
      4. Privileged Information
      5. Chapter Review
      6. Chapter Exercises
      7. References
    12. 5. The Admissibility of Evidence
      1. What Makes Evidence Admissible?
      2. Keeping Evidence Authentic
      3. Defining the Scope of the Search
      4. When the Constitution Doesn’t Apply
      5. Chapter Review
      6. Chapter Exercises
      7. References
    13. 6. First Response and the Digital Investigator
      1. Forensics and Computer Science
      2. Controlling the Scene of the Crime
      3. Handling Evidence
      4. Chapter Review
      5. Chapter Exercises
      6. References
    14. 7. Data Acquisition
      1. Order of Volatility
      2. Memory and Running Processes
      3. Acquiring Media
      4. Chapter Review
      5. Chapter Exercises
      6. References
    15. 8. Finding Lost Files
      1. File Recovery
      2. The Deleted File
      3. Data Carving
      4. Chapter Review
      5. Chapter Exercises
      6. References
    16. 9. Document Analysis
      1. File Identification
      2. Understanding Metadata
      3. Mining the Temporary Files
      4. Identifying Alternate Hiding Places of Data
      5. Chapter Review
      6. Chapter Exercises
      7. References
    17. 10. E-mail Forensics
      1. E-mail Technology
      2. Information Stores
      3. The Anatomy of an E-mail
      4. An Approach to E-mail Analysis
      5. Chapter Review
      6. Chapter Exercises
      7. References
    18. 11. Web Forensics
      1. Internet Addresses
      2. Web Browsers
      3. Web Servers
      4. Proxy Servers
      5. Chapter Review
      6. Chapter Exercises
      7. References
    19. 12. Searching the Network
      1. An Eagle’s Eye View
      2. Initial Response
      3. Proactive Collection of Evidence
      4. Post-Incident Collection of Evidence
      5. Router and Switch Forensics
      6. Chapter Review
      7. Chapter Exercises
      8. References
    20. 13. Excavating a Cloud
      1. What Is Cloud Computing?
      2. Shaping the Cloud
      3. The Implications of Cloud Forensics
      4. On Virtualization
      5. Constitutional Issues
      6. Chapter Review
      7. Chapter Exercises
      8. References
    21. 14. Mobile Device Forensics
      1. Challenges of Mobile Device Forensics
      2. How Cell Phones Work
      3. Data Storage on Cell Phones
      4. Acquisition and Storage
      5. Legal Aspects of Mobile Device Forensics
      6. Chapter Review
      7. Chapter Exercises
      8. References
    22. 15. Fighting Antiforensics
      1. Artifact Destruction
      2. Hiding Data on the System
      3. Covert Data
      4. Chapter Review
      5. Chapter Exercises
      6. References
    23. 16. Litigation and Electronic Discovery
      1. What Is E-Discovery?
      2. A Roadmap of E-Discovery
      3. Conclusion
      4. Chapter Review
      5. Chapter Exercises
      6. References
    24. 17. Case Management and Report Writing
      1. Managing a Case
      2. Writing Reports
      3. Chapter Review
      4. Chapter Exercises
      5. References
    25. 18. Tools of the Digital Investigator
      1. Software Tools
      2. Working with “Court-Approved” Tools
      3. Hardware Tools
      4. Nontechnical Tools
      5. Chapter Review
      6. Chapter Exercises
      7. References
    26. 19. Building a Forensic Workstation
      1. What Is a Forensic Workstation?
      2. Commercially Available Forensic Workstations
      3. Building a Forensic Workstation From Scratch
      4. Chapter Review
      5. Chapter Exercises
      6. References
    27. 20. Licensing and Certification
      1. Digital Forensic Certification
      2. Vendor-Neutral Certification Programs
      3. Vendor-Specific Certification Programs
      4. Digital Forensic Licensing Requirements
      5. Chapter Review
      6. Chapter Exercises
      7. References
    28. 21. The Business of Digital Forensics
      1. Starting a New Forensics Organization
      2. Maintaining the Organization
      3. Generating Revenue
      4. Organizational Certification
      5. Chapter Review
      6. Chapter Exercises
      7. References
    29. A. Chapter Review Answers
      1. Chapter 1
      2. Chapter 2
      3. Chapter 3
      4. Chapter 4
      5. Chapter 5
      6. Chapter 6
      7. Chapter 7
      8. Chapter 8
      9. Chapter 9
      10. Chapter 10
      11. Chapter 11
      12. Chapter 12
      13. Chapter 13
      14. Chapter 14
      15. Chapter 15
      16. Chapter 16
      17. Chapter 17
      18. Chapter 18
      19. Chapter 19
      20. Chapter 20
      21. Chapter 21
    30. B. Sample Forms
      1. Sample Search Warrant
      2. Sample Subpoena
      3. Sample Case Log
      4. Sample Chain of Custody
      5. Physical Disk Information
      6. Forensic Imaging Data
      7. Provide legible photographs of physical disk
    31. Glossary
    32. Index
    3.19.56.45