Computer Forensics: Principles and Practices

For introductory and intermediate courses in computer forensics, digital investigations, or computer crime investigation

By applying information systems, computer security, and criminal justice principles and practices to crime investigations and other legal actions, this text teaches students how to use forensically-sound methodologies and software to acquire admissible electronic evidence (e-evidence) with coverage of computer and email forensics, cell phone and IM forensics, and PDA and Blackberry forensics.   

Contents in Brief

PART ONE: Admissibility of Electronic Evidence ........................1

1. Forensic Evidence and Crime Investigation ......................................3
2. Computer Forensics and Digital Detective Work ..............................38

PART TWO: Preparing for E-Evidence Collection

and Preservation ....................................................................79

1. Tools, Environments, Equipment, and Certifications ..........................81
2. Policies and Procedures..............................................................120
3. Data, PDA, and Cell Phone Forensics ..........................................157

PART THREE: Forensic Examination of Computers

and Digital and Electronic Media ......................................193

1. Operating Systems and Data Transmission Basics for Digital

Investigations ............................................................................195

1. Investigating Windows, Linux, and Graphics Files ........................236
2. E-Mail and Webmail Forensics ....................................................282

PART FOUR: Detecting Intrusions, Malware, and Fraud ........317

1. Internet and Network Forensics and Intrusion Detection ..................319
2. Tracking Down Those Who Intend to Do Harm on a Large Scale ....348
3. Fraud and Forensic Accounting Investigation ................................372

PART FIVE: Legal, Ethical, and Testimony Topics....................405

1. Federal Rules and Criminal Codes ..............................................407
2. Ethical and Professional Responsibility in Testimony ......................436

Appendix A: Online Resources ....................................................467

Appendix B: Government and Legal References ..............................472

Appendix C: Sample Legal Forms, Letters, and Motions ....................478

Appendix D: Summaries of Court Cases ........................................504

Glossary ..................................................................................508

References ................................................................................516

Index ......................................................................................523

For introductory and intermediate courses in computer forensics, digital investigations, or computer crime investigations

By applying information systems, computer security, and criminal justice principles and practices to crime investigations and other legal actions, this text teaches students how to use forensically-sound methodologies and software to acquire admissible electronic evidence (e-evidence) with coverage of computer and email forensics, cell phone and IM forensics, and PDA and Blackberry forensics. 

Q. Would you like comprehensive coverage of forensics and hands-on exercises that students can actually perform?

A: Computer Forensics: Principles and Practice covers how to investigate crime scenes, intrusions, and hacker attacks—as well as how to gather and analyze digital evidence to discover the truth about what happened—with a comprehensive understanding and hands-on use of one of the most widely-used computer forensics software tools—EnCase.

Unlike other books that frustrate students and faculty by requiring use of operating systems they do not have access to, this book does not require arcane equipment to learn how to use computer forensics software.

Q. Does your current text neglect certain subject areas?

A: Computer Forensics: Principles and Practices covers three key areas—computer technology, recognized investigative techniques, and legal issues. Without an understanding of these three areas, mistakes will be made that could have alarming consequences. with or tainted.

Q. Do you want students to develop the necessary expertise, ethical responsibility, and diverse skill set of a computer forensics investigator?

A. Students learn the technical expertise needed to gather, filter, and authenticate e-evidence for use in court or legal actions with knowledge of relevant laws regarding civil rights, search warrants, and rules of evidence.

Other Points of Differentiation

·        Introduction to digital investigations with concepts, terminology and issues, in addition to practical skills in multiple types of computer, Internet, and digital device forensics.

-       Provides students with a strong foundation in electronic evidence collection and handling, chain of custody, documentation, testifying as an expert witness, and surviving harsh cross-examination.

·        Solid coverage of forensics tools, techniques, and environments plus rules of evidence and privacy rights

Provides students with a comprehensive analysis of the role of e-evidence in            computer crimes, cyberterrorism, traditional and violent crimes, incident          responses, civil cases, fraud and information security verification

·        Coverage of often neglected subject areas—e.g. PDA forensics, cell phone forensics, email and Internet forensics; tracking down hackers and serial killers.

            - Introduces students to important forensics investigative issues that are often     overlooked in other texts.

·        End-of-chapter exercises, projects, and review questions.

- Enables students to apply their new knowledge and expertise.

·        Extensive extra features, practical applications and FYI’s throughout.

                  - Provides students with practical knowledge to help them understand their technical role, legal obligations, and ethical responsibilities.

·        Technical, Investigative, and Legal Glossary and Appendices

·        Multiple appendices with additional resources, forms, and checklists to manage and document the case life cycle involving e-evidence.