Computer Forensics JumpStart

by Solomon, Micah; Barrett, Diane; Broom, Neil

• ISBN13: 9780782143751
• ISBN10: 078214375X
• Edition: 1st
• Format: Paperback
• Copyright: 2004-12-10
• Publisher: Wiley

Summary

Launch Your Career in Computer ForensicsQuickly and EffectivelyWritten by a team of computer forensics experts, Computer Forensics JumpStart provides all the core information you need to launch your career in this fast-growing field: Conducting a computer forensics investigation Examining the layout of a network Finding hidden data Capturing images Identifying, collecting, and preserving computer evidence Understanding encryption and examining encrypted files Documenting your case Evaluating common computer forensic tools Presenting computer evidence in court as an expert witness

Author Biography

Neil Broom is the President of the Technical Resource Center in Atlanta, Georgia, and is also the Lead Instructor and Developer of the Computer Forensics and Cyber Investigations course and the Certified Cyber Crime Examiner C+¥superscript 3-¿E) certification.

Table of Contents

Introduction	p. xvii
The Need for Computer Forensics	p. 1
Defining Computer Forensics	p. 2
Real-Life Examples of Computer Crime	p. 4
Hacker Pleads Guilty to Illegally Accessing New York Times Computer Network	p. 4
Man Pleads Guilty to Hacking Intrusion and Theft of Data Costing Company $5.8 Million	p. 5
Three Men Indicted for Hacking into Lowe's Companies' Computers with Intent to Steal Credit Card Information	p. 6
Former Chief Computer Network Program Designer Arraigned for Alleged $10 Million Computer Software Bomb	p. 7
Juvenile Computer Hacker Sentenced to Six Months in Detention Facility	p. 8
Corporate versus Law Enforcement Concerns	p. 9
Corporate Concerns Focus on Detection and Prevention	p. 9
Law Enforcement Focuses on Prosecution	p. 11
Russian Computer Hacker Indicted in California for Breaking into Computer Systems and Extorting Victim Companies	p. 11
Training	p. 13
Practitioners	p. 13
End Users	p. 15
What Are Your Organization's Needs?	p. 18
Terms to Know	p. 19
Review Questions	p. 20
Preparation-What to Do Before You Start	p. 21
Know Your Hardware	p. 22
What I/O Devices Are Used?	p. 22
Check Computers for Unauthorized Hardware	p. 28
Keep Up to Date with New I/O Trends	p. 32
Know Your Operating System	p. 35
Different Operating Systems	p. 35
Know What Filesystems Are in Use	p. 38
Maintain Tools and Procedures for Each Operating System and Filesystem	p. 40
Preinstalled Tools Make Forensics Easier	p. 41
Know Your Limits	p. 42
Legal Organizational Rights and Limits	p. 43
Search and Seizure Guidelines	p. 44
Will This End Up in Court?	p. 45
Develop Your Incident Response Team	p. 45
Organize the Team	p. 46
State Clear Processes	p. 46
Coordinate with Local Law Enforcement	p. 47
Terms to Know	p. 48
Review Questions	p. 49
Computer Evidence	p. 51
What Is Computer Evidence?	p. 52
Incidents and Computer Evidence	p. 52
Types of Evidence	p. 52
Search and Seizure	p. 58
Voluntary Surrender	p. 58
Subpoena	p. 59
Search Warrant	p. 59
Chain of Custody	p. 60
Definition	p. 60
Controls	p. 61
Documentation	p. 64
Evidence Admissibility in a Court of Law	p. 66
Relevance and Admissibility	p. 66
Techniques to Ensure Admissibility	p. 67
Leave No Trace	p. 68
Read-Only Image	p. 68
Software Write Blocker	p. 69
Hardware Write Blocker	p. 69
Terms to Know	p. 70
Review Questions	p. 71
Common Tasks	p. 73
Evidence Identification	p. 74
Physical Hardware	p. 75
Removable Storage	p. 78
Documents	p. 79
Evidence Preservation	p. 80
Pull the Plug or Shut It Down?	p. 81
Supply Power As Needed	p. 82
Provide Evidence of Initial State	p. 83
Evidence Analysis	p. 85
Knowing Where to Look	p. 85
Wading through the Sea of Data	p. 87
Sampling Data	p. 88
Evidence Presentation	p. 88
Know Your Audience	p. 89
Organization of Presentation	p. 91
Keep It Simple	p. 92
Terms to Know	p. 93
Review Questions	p. 94
Capturing the Data Image	p. 95
Full Volume Images	p. 96
Evidence Collection Order	p. 96
Preparing Media and Tools	p. 97
Collecting the Volatile Data	p. 100
Creating a Duplicate of the Hard Disk	p. 103
Extracting Data from PDAs	p. 107
Image and Tool Documentation	p. 108
Partial Volume Image	p. 109
Imaging/Capture Tools	p. 111
Utilities	p. 112
Commercial Software	p. 113
PDA Tools	p. 115
Terms to Know	p. 115
Review Questions	p. 116
Extracting Information from Data	p. 117
What Are You Looking For?	p. 118
Internet Files	p. 118
E-mail Headers	p. 122
Deleted Files	p. 126
Passwords	p. 127
How People Think	p. 129
Picking the Low-Hanging Fruit	p. 130
Hidden Evidence	p. 131
Trace Evidence	p. 135
Terms to Know	p. 137
Review Questions	p. 138
Passwords and Encryption	p. 139
Passwords	p. 140
Finding Passwords	p. 141
Deducing Passwords	p. 142
Cracking Passwords	p. 143
Encryption Basics	p. 146
Common Encryption Practices	p. 147
Private Key Algorithms	p. 148
Public Key Algorithms	p. 150
Steganography	p. 151
Strengths and Weaknesses of Encryption	p. 152
Key Length	p. 153
Key Management	p. 153
Handling Encrypted Data	p. 154
Identifying Encrypted Files	p. 154
Decrypting Files	p. 155
Terms to Know	p. 159
Review Questions	p. 160
Common Forensics Tools	p. 161
Disk Imaging and Validation Tools	p. 162
ByteBack	p. 163
dd	p. 164
DriveSpy	p. 165
EnCase	p. 165
Forensic Replicator	p. 166
FTK Imager	p. 167
Norton Ghost	p. 168
ProDiscover	p. 168
SafeBack	p. 170
SMART	p. 170
WinHex	p. 171
Forensics Tools	p. 172
Software Suites	p. 172
Miscellaneous Software Tools	p. 184
Hardware	p. 187
Your Forensics Toolkit	p. 190
Each Organization Is Different	p. 192
Most Examiners Use Overlapping Tools	p. 192
Terms to Know	p. 192
Review Questions	p. 193
Pulling It All Together	p. 195
Begin with a Concise Summary	p. 196
Document Everything, Assume Nothing	p. 197
Interviews and Diagrams	p. 198
Videotapes and Photographs	p. 200
Transporting the Evidence	p. 201
Documenting Gathered Evidence	p. 201
Additional Documentation	p. 204
Formulating the Report	p. 205
Sample Analysis Reports	p. 206
Case #234-NextGard Technology Copyright Piracy Summary	p. 207
Additional Report Subsections	p. 213
Using Software to Generate Reports	p. 214
Terms to Know	p. 218
Review Questions	p. 219
How to Testify in Court	p. 221
Preparation Is Everything	p. 222
Understand the Case	p. 224
Understand the Strategy	p. 225
Understand Your Job	p. 225
Appearance Matters	p. 226
Clothing	p. 226
Grooming	p. 226
Attitude	p. 227
What Matters Is What They Hear	p. 227
Listening	p. 228
Tone	p. 228
Vocabulary	p. 229
Know Your Forensics Process and Tools	p. 229
Best Practices	p. 230
Your Process and Documentation	p. 230
Your Forensic Toolkit	p. 231
Say Only What Is Necessary	p. 231
Be Complete, But Not Overly Elaborate	p. 231
Remember Your Audience	p. 232
Keep It Simple	p. 234
Explaining Technical Concepts	p. 234
Use Presentation Aids When Needed	p. 234
Watch for Feedback	p. 235
Be Ready to Justify Every Step	p. 235
Summary	p. 236
Terms to Know	p. 236
Review Questions	p. 237
Answers to Review Questions	p. 239
Chapter 1	p. 239
Chapter 2	p. 240
Chapter 3	p. 240
Chapter 4	p. 241
Chapter 5	p. 242
Chapter 6	p. 243
Chapter 7	p. 244
Chapter 8	p. 245
Chapter 9	p. 246
Chapter 10	p. 247
Forensics Resources	p. 249
Information	p. 249
Organizations	p. 249
Publications	p. 249
Services	p. 250
Software	p. 250
Training	p. 251
Forensics Certifications	p. 253
Advanced Information Security (AIS)	p. 254
Certified Computer Examiner (CCE)	p. 254
Certified Cyber-Crime Expert (C[superscript 3]E)	p. 255
Certified Information Forensics Investigator (CIFI)	p. 255
Certified Computer Crime Investigator (CCCI)	p. 256
Certified Computer Forensic Technician (CCFT)	p. 256
Certified Forensic Computer Examiner (CFCE)	p. 257
Certified Information Systems Auditor (CISA)	p. 257
EnCase Certified Examiner Program	p. 258
GIAC Certified Forensic Analyst (GCFA)	p. 258
Professional Certified Investigator (PCI)	p. 258
Forensics Tools	p. 261
Forensics Tool Suites	p. 261
Ultimate Toolkit	p. 261
Maresware	p. 261
X-Ways Forensics	p. 262
Forensicware	p. 262
Password-Cracking Utilities	p. 262
Passware	p. 262
ElcomSoft	p. 263
CD Analysis Utilities	p. 263
IsoBuster	p. 263
CD/DVD Inspector	p. 264
Metadata Viewer Utility	p. 264
Metadata Assistant	p. 264
Graphic Viewing Utility	p. 265
Quick View Plus	p. 265
Forensics Hardware Devices	p. 265
Intelligent Computer Solutions	p. 265
Computer Forensics Training	p. 266
Intense School Computer Forensics Training Class	p. 266
Glossary	p. 267
Index	p. 274
Table of Contents provided by Ingram. All Rights Reserved.