The Investigator's Guide to Computer Crime

by Franklin, Carl J., Ph.D.

• ISBN13: 9780398076016
• ISBN10: 0398076014
• Format: Hardcover
• Copyright: 2006-01-20
• Publisher: Charles C Thomas Pub Ltd

Table of Contents

About the Author	ii
Section 1: Establishing Standards for the Computer Crime Investigation
Chapter 1: The Growing Trend of Computer Crime	5	(12)
A. Introduction to Computer Crime	5	(2)
B. Defining Computer and Technology Crime	7	(3)
C. Establishing Parameters for Investigating Computer Crime	10	(3)
D. Trends in Computer Crime	13	(4)
Chapter 2: The Computer Crime Investigation Team	17	(13)
A. Why Do We Need A Computer Crime Investigation Team?	17	(1)
B. Who Should Be on the Team	18	(7)
1. Case Supervisor	19	(1)
2. Physical Search Team	19	(4)
a. Guardian	20	(1)
b. Crime Scene Manager	21	(1)
c. Lead Investigator	22	(1)
d. Search Coordinator	22	(1)
e. Other Team Members	23	(1)
3. Sketch and Photo Team	23	(1)
4. Security and Arrest Team	24	(1)
5. Technical Evidence Seizure Team	25	(1)
6. Interview Team	25	(1)
C. What if We Don't Have a Team?	25	(1)
D. What Training and Education Do Team Members Need?	26	(4)
Chapter 3: The Computer System in the Criminal Enterprise	30	(13)
A. Determining the Computer's Role in the Offense	30	(2)
B. Introduction to Computer Forensics	32	(4)
1. The Methodology of Computer Forensics	33	(2)
2. Establishing Policy and Procedures for Computer Cases	35	(1)
C. The Modus Operandi of Computer Crime: Motive and Technology	36	(7)
1. Entitlement	38	(1)
2. Compensatory	39	(1)
3. Anger or Retaliatory	39	(1)
4. Anger Excitation	40	(3)
Chapter 4: The Computer Crime Lab	43	(23)
A. Introduction	43	(1)
B. The Work Space	44	(3)
C. Basic Equipment Needs	47	(13)
1. The Computer Toolkit	47	(8)
2. Evidence Seizure Tools	55	(2)
3. Storage Containers	57	(2)
4. Computer-Oriented Items	59	(1)
D. Enhanced and Specialty Equipment	60	(6)
1. Magnetometer and Magnetic Compass	61	(1)
2. Portable Computer System	61	(1)
3. Software	62	(2)
4. Electronic Specialty Equipment	64	(2)
Chapter 5: Expert Assistance	66	(13)
A. Determining That an Expert is Needed	66	(4)
B. Finding Experts	70	(5)
1. Federal Sources	71	(1)
2. Private Experts	72	(8)
a. Professional Computer Organizations	73	(1)
b. Colleges and Universities	74	(1)
c. Computer and Telecommunications Industry Personnel	75	(1)
d. The Victim as Expert	75	(1)
C. What the Experts Can Do for Your Investigation	75	(4)
Section 2: Specific Computer Crimes
Chapter 6: Hardware and Software Crimes	79	(17)
A. Introduction	79	(1)
B. Classifying Hardware Involvement	80	(4)
1. Hardware as Contraband	80	(1)
2. Hardware as an Instrumentality of an Offense	81	(2)
3. Hardware as Evidence	83	(1)
C. Theft of Hardware or Software	84	(12)
1. Tracing Stolen Computer Components	84	(8)
a. Identifying Integrated Circuits	84	(5)
b. Computer Motherboards and Add-On Cards	89	(2)
c. Cases and Peripherals	91	(1)
2. Tracing Stolen Software	92	(4)
Chapter 7: Theft of Information	96	(14)
A. Introduction	96	(2)
B. Prioritizing the Investigation	98	(6)
1. Trade Secret	99	(2)
2. Proprietary Information	101	(2)
3. Confidential Information	103	(1)
C. The Value of Information	104	(4)
D. Identifying the Stolen Information	108	(2)
Chapter 8: Cyberstalking	110	(19)
A. What Is Cyberstalking?	111	(2)
B. Nature and Extent of Cyberstalking	113	(3)
C. Offline vs. Online Stalking–A Comparison	116	(3)
D. Evidence that Cyberstalking is a Growing Problem	119	(1)
E. Current Efforts to Address Cyberstalking	120	(2)
F. Jurisdictional and Statutory Limitations	122	(1)
G. Anonymity on the Internet	123	(1)
H. Law Enforcement Response	124	(2)
I. Industry Efforts	126	(1)
J. Cyberstalking Laws	127	(2)
Chapter 9: Identity Theft	129	(18)
A. The Nature of the Problem	129	(3)
B. How Does Identity Theft Occur?	132	(2)
C. Investigating the Identity Theft Case	134	(2)
D. Federal Criminal Laws for Identity Theft	136	(3)
E. Exemplary Federal Cases	139	(1)
F. State Criminal Laws	140	(1)
G. Steps to Help the Victim of Identity Theft	141	(6)
Section 3: The Computer Crime Investigation
Chapter 10: Initial Assessment and Response to the Computer Crime	147	(10)
A. Incident Notification and Response Protocol	147	(4)
B. The Initial Contact	151	(1)
C. Evaluating the Initial Scene	152	(1)
D. The Initial Interview	152	(5)
Chapter 11: Applying Forensic Science to Computers	157	(11)
A. Forensic Science Techniques	158	(1)
B. Recognition of Digital Evidence	159	(2)
C. Collecting and Preserving Hardware and Digital Evidence	161	(4)
D. Classification and Comparison of Digital Evidence	165	(3)
Chapter 12: Tracking the Offender	168	(21)
A. Basic Network Systems	169	(2)
B. The Basics of Tracking	171	(6)
1. The IP Address	172	(1)
2. The Internet Service Provider and Whois	173	(1)
3. The Route Through the System	174	(1)
4. Assigning Addresses	175	(2)
C. The Domain Name Service (DNS)	177	(1)
D. Using the DNS in the Track	178	(3)
1. Recursion	179	(2)
2. Other Addresses	181	(1)
E. Why are Addresses Important	181	(1)
F. The Art of the Track	182	(2)
G. Tracking the Mail Trail	184	(1)
H. SMTP Server Logs	185	(4)
Section 4: Search, Seizure, and Digital Evidence
Chapter 13: Computer-Related Evidence	189	(14)
A. Types of Computer-Related Evidence	189	(2)
1. Direct and Circumstantial Evidence	189	(1)
2. Applying Direct and Circumstantial Evidence	190	(1)
B. The Best Evidence Rule	191	(3)
C. Authenticating Electronic Documents	194	(3)
1. Distinctive Evidence	195	(1)
2. Chain of Custody	196	(1)
D. Electronic Processing of Evidence	197	(1)
E. Creation of Evidence from Computers	198	(2)
F. The Hearsay Rule	200	(3)
Chapter 14: Fourth Amendment Principles and Computer Searches	203	(30)
A. What Does the Fourth Amendment Protect?	204	(2)
B. Relevant Changes in the last Forty Years	206	(1)
C. Exceptions to the Warrant Requirement	207	(34)
1. Plain View	207	(4)
2. Exigent Circumstances	211	(3)
3. Border Searches	214	(1)
4. Consent Searches	214	(30)
a. Scope of the Consent	216	(1)
b. Third-Party Consent	217	(1)
c. General Rules of Consent	218	(2)
d. Spousal Consent	220	(1)
e. Parental Consent	221	(1)
f. Employer Consent	221	(4)
g. Networks: System Administrators	225	(1)
h. Informants and Undercover Operatives	226	(2)
i. Public Schools	228	(5)
Appendix A: Identifying the Computer Components	233	(28)
1. A. Brief History of the Modern Computer	233	(3)
2. Advances in Computer Design	236	(5)
3. The Desktop IBM Compatible Computer System	241	(20)
a. System Architecture	242	(2)
b. System Components	244	(18)
i. The Case and CPU	244	(3)
ii. The Motherboard	247	(4)
iii. Bus Slots and I/O Cards	251	(4)
iv. Peripherals	255	(3)
v. Data Storage	258	(2)
vi. Power Supply and Connectors	260	(1)
Appendix B: Understanding Software	261	(16)
A. Introduction to Software	262	(1)
B. Operating Systems	262	(7)
1. UNIX	262	(3)
2. Linux	265	(2)
3. Apple Mac OS	267	(1)
4. Windows	268	(1)
C. Application Programs	269	(8)
1. Business Software	269	(5)
a. Word Processors	270	(1)
b. Spreadsheets	271	(1)
c. Database	271	(1)
d. Graphics	272	(1)
e. Presentation	273	(1)
f. Communication	273	(1)
g. Other	273	(1)
2. Entertainment Software	274	(1)
a. Games	274	(1)
b. Graphics	274	(1)
c. Educational	275	(1)
3. Utility Software	275	(3)
a. System Maintenance	275	(1)
b. Software Support	275	(1)
c. Other	276	(1)
Appendix C: Networks and Communication Systems	277	(25)
A. Network Basics	278	(7)
1. Clients and Servers	280	(1)
2. Wiring and Cable	281	(1)
3. Network Interface Cards	282	(1)
4. Switches	283	(1)
5. Bridges	283	(1)
6. Routers	283	(1)
7. Modems	284	(1)
8. Network Management	284	(1)
B. Local-Area Networks: Ethernet, Fast Ethernet, and Gigabit Ethernet	285	(8)
1. Ethernet Basics	286	(1)
2. The 5-4-3 Rule	287	(1)
3. 10Base2	287	(1)
4. 10BaseT	287	(1)
5. 10BaseF	288	(1)
6. 100BaseT	288	(1)
7. 100BaseT4	289	(1)
8. 100BaseFx	289	(1)
9. 1000BaseX	289	(1)
10. CSMA/CD	289	(1)
11. I/G and U/L within the MAC address	290	(1)
12. Cisco's Inter-Switch Link (ISL)	291	(1)
13. Error Conditions	291	(2)
C. Token Ring	293	(1)
D. High-Speed LAN Technologies	293	(1)
E. Wireless Connections	294	(1)
F. Remote Access and Wide-Area Networks	295	(1)
G. Analog vs. Digital	295	(1)
H. ISDN	295	(1)
I. Leased Lines	296	(1)
J. Cable Modem/Router	296	(1)
K. Remote Access Servers	297	(1)
L. Digital Subscriber Line Service	297	(1)
M. Virtual Private Networks	298	(1)
N. Good Network Design: The 80/20 Rule	299	(1)
O. Understanding Network Protocols	299	(3)
Appendix D: Computer Seizure Checklist	302	(3)
Glossary	305	(4)
Index	309