Contents
1 The Anatomy of a Digital Investigation
A Basic Model for Investigators
Understanding the Scope of the Investigation
2 Laws Affecting Forensic Investigations
Constitutional Implications of Forensic Investigation
3 Search Warrants and Subpoenas
Distinguishing between Warrants and Subpoenas
What Is a Search and When Is It Legal?
Basic Elements of Obtaining a Warrant
Privacy in Health Care and Education
5 The Admissibility of Evidence
What Makes Evidence Admissible?
Defining the Scope of the Search
When the Constitution Doesn’t Apply
6 First Response and the Digital Investigator
Forensics and Computer Science
Controlling the Scene of the Crime
Identifying Alternate Hiding Places of Data
An Approach to E-mail Analysis
Proactive Collection of Evidence
Post-Incident Collection of Evidence
The Implications of Cloud Forensics
Challenges of Mobile Device Forensics
Legal Aspects of Mobile Device Forensics
16 Litigation and Electronic Discovery
17 Case Management and Report Writing
18 Tools of the Digital Investigator
Working with “Court-Approved” Tools
19 Building a Forensic Workstation
What Is a Forensic Workstation?
Commercially Available Forensic Workstations
Building a Forensic Workstation From Scratch
20 Licensing and Certification
Digital Forensic Certification
Vendor-Neutral Certification Programs
Vendor-Specific Certification Programs
Digital Forensic Licensing Requirements
21 The Business of Digital Forensics