For introductory and intermediate courses in computer forensics, digital investigations, or computer crime investigation By applying information systems, computer security, and criminal justice principles and practices to crime investigations and other legal actions, this text teaches students how to use forensically-sound methodologies and software to acquire admissible electronic evidence(e-evidence) with coverage ofcomputer and email forensics, cell phone and IM forensics, and PDA and Blackberry forensics.

Security Series Walk-Through

x

Preface

xii

About the Authors

xvii

Acknowledgments

xviii

Quality Assurance

xviii

PART ONE Admissibility of Electronic Evidence

1

(78)

Forensic Evidence and Crime Investigation

3

(35)

Basics of Crimes

4

(6)

Information Warfare, Electronic Attack, and Terrorism

10

(2)

Computer Forensics Evidence and Investigations

12

(7)

Electronic Evidence: Technology and Legal Issues

19

(3)

Computer Forensics: A Growing Field and Practice Area

22

(3)

Discovery

25

(2)

Electronic Discovery (E-Discovery)

27

(11)

Summary

31

(1)

Test Your Skills

31

(7)

Computer Forensics and Digital Detective Work

38

(41)

The Role of E-Evidence in Solving Physical and Computer Crimes

39

(4)

Computer Forensics Science

43

(3)

Digital Signatures and Profiling

46

(2)

Computer Forensics and the E-Evidence Collection Process

48

(5)

Suppression, Probable Cause, and Search Warrants

53

(7)

Types of Motives and Cybercrimes

60

(7)

Forensics Rules and Evidence Issues

67

(3)

Computer Forensics Investigator's Responsibilities

70

(9)

Summary

70

(1)

Test Your Skills

71

(8)

PART TWO Preparing for E-Evidence Collection and Preservation

79

(114)

Tools, Environments, Equipment, and Certifications

81

(39)

Managing the Life-Cycle of a Case

82

(3)

Acquiring and Authenticating the E-Evidence

85

(6)

Searching and Analyzing the Data

91

(4)

Investigative Environments and Analysis Modes

95

(1)

Forensic Tools and Toolkits

96

(10)

Forensics Equipment

106

(4)

Certification and Training Programs

110

(10)

Summary

111

(1)

Test Your Skills

112

(8)

Policies and Procedures

120

(37)

Reasons for Policies and Procedures

121

(2)

Precase Preparations

123

(5)

Steps in the Forensic Examination

128

(10)

Examining the Evidence

138

(5)

The Art of Forensics: Analyzing the Data

143

(5)

Reporting on the Investigation

148

(9)

Summary

151

(1)

Test Your Skills

152

(5)

Data, PDA, and Cell Phone Forensics

157

(36)

Basic Hard Drive Technology

158

(3)

Other Storage Technologies

161

(4)

Personal Digital Assistant Devices (PDAs)

165

(1)

Cellular Phones

166

(1)

Drive and Media Analysis

167

(6)

PDA Analysis

173

(2)

Cellular Phone Analysis

175

(3)

Disk Image Forensic Tools

178

(2)

PDA/Cellular Phone Forensic Software

180

(13)

Summary

187

(1)

Test Your Skills

188

(5)

PART THREE Forensic Examination of Computers and Digital and Electronic Media

193

(124)

Operating Systems and Data Transmission Basics for Digital Investigations

195

(41)

What Is an Operating System?

196

(1)

Major Components of an Operating System

197

(4)

Common Operating Systems

201

(15)

Common File System Types

216

(5)

OSI and TCP/IP Models

221

(15)

Summary

229

(1)

Test Your Skills

229

(7)

Investigating Windows, Linux, and Graphics Files

236

(46)

Investigating Windows Systems

237

(3)

Finding User Data and Profiles in Windows Folders

240

(7)

Investigating System Artifacts

247

(7)

Investigating Linux Systems

254

(8)

Graphic File Forensics

262

(20)

Summary

267

(1)

Test Your Skills

267

(15)

E-Mail and Webmail Forensics

282

(35)

Importance of E-Mail as Evidence

283

(1)

Working with E-Mail

284

(6)

Working with Webmail

290

(3)

Working with Mail Servers

293

(3)

Examining E-Mails for Evidence

296

(8)

Working with Instant Messaging

304

(13)

Summary

306

(1)

Test Your Skills

307

(10)

PART FOUR Detecting Intrusions, Malware, and Fraud

317

(88)

Internet and Network Forensics and Intrusion Detection

319

(29)

An Introduction to Network Forensics and Intrusion Detection

320

(6)

Data Sources on a Network

326

(5)

Physical Aspects of Capturing Data

331

(1)

Logical Aspects of Capturing Data

332

(1)

Examining Data

333

(5)

NFAT Software Tools

338

(10)

Summary

342

(1)

Test Your Skills

342

(6)

Tracking Down Those Who Intend to Do Harm on a Large Scale

348

(24)

Large-Scale Investigations

349

(2)

Terrorism, Virtual Warfare, and Other Types of Internet-Based Hostilities

351

(7)

Botnets and Criminal Commerce

358

(3)

Tracking Criminals' Trails

361

(11)

Summary

364

(1)

Test Your Skills

364

(8)

Fraud and Forensic Accounting Investigation

372

(33)

Challenges of Fraud Investigations

373

(9)

Types of Fraud

382

(8)

Characteristics and Symptoms of Fraud

390

(2)

Fraud Investigation and Deterrence

392

(2)

Digital Forensic Accounting

394

(11)

Summary

397

(1)

Test Your Skills

398

(7)

PART FIVE Legal, Ethical, and Testimony Topics

405

(62)

Federal Rules and Criminal Codes

407

(29)

Due Process of the Law

408

(9)

Anticrime Laws

417

(19)

Summary

429

(1)

Test Your Skills

429

(7)

Ethical and Professional Responsibility in Testimony

436

(31)

The Importance of Forensic Expert Witnesses and Expert Reports

437

(6)

The Trial Process

443

(7)

Guidelines for Testifying

450

(8)

Professional and Educational Resources

458

(9)

Summary

459

(1)

Test Your Skills

460

(7)

Appendix A: Online Resources

467

(5)

Appendix B: Government and Legal References

472

(6)

Appendix C: Sample Legal Forms, Letters, and Motions

478

(26)

Appendix D: Summaries of Court Cases

504

(4)

Glossary

508

(8)

References

516

(7)

Index

523

What is included with this book?

The New copy of this book will include any supplemental materials advertised. Please check the title of the book to determine if it should include any access cards, study guides, lab manuals, CDs, etc.

The Used, Rental and eBook copies of this book are not guaranteed to include any supplemental materials. Typically, only the book itself is included. This is true even if the title states it includes any access cards, study guides, lab manuals, CDs, etc.

Amazon no longer offers textbook rentals. We do!

Amazon no longer offers textbook rentals. We do!

We're the #1 textbook rental company. Let us show you why.

Computer Forensics Principles and Practices

9780131547278

0131547275

Supplemental Materials

Summary

Table of Contents

Supplemental Materials

Rewards Program