Contributing Authors |
|
ix | |
Preface |
|
xix | |
PART I LEGAL ISSUES |
|
|
1 Calibration Testing of Network Tap Devices |
|
|
3 | |
|
Barbara Endicott-Popovsky, Brian Chee and Deborah Frincke |
|
|
|
2 On the Legality of Analyzing Telephone Call Records |
|
|
21 | |
|
C. Swenson, C. Adams, A. Whitledge and S. Shenoi |
|
|
|
3 Survey of Law Enforcement Perceptions Regarding Digital Evidence |
|
|
41 | |
|
M. Rogers, K. Scarborough, K. Frakes and C. San Martin |
|
|
PART II INSIDER THREAT DETECTION |
|
|
4 Insider Threat Analysis Using Information-Centric Modeling |
|
|
55 | |
|
D. Ha, S. Upadhyaya, H. Ngo, S. Pramanik, R. Chinchani and S. Mathew |
|
|
|
5 An Integrated System for Insider Threat Detection |
|
|
75 | |
|
Daniel Ray and Phillip Bradford |
|
|
PART III ROOTKIT DETECTION |
|
|
6 Analysis of Tools for Detecting Rootkits and Hidden Processes |
|
|
89 | |
|
A. Todd, J. Benson, G. Peterson, T. Franz, M. Stevens and R. Raines |
|
|
|
7 A Method for Detecting Linux Kernel Module Rootkits |
|
|
107 | |
|
Doug Wampler and James Graham |
|
|
PART IV AUTHORSHIP ATTRIBUTION |
|
|
8 Future Trends in Authorship Attribution |
|
|
119 | |
|
|
|
9 The Keyboard Dilemma and Authorship Identification |
|
|
133 | |
|
|
PART V FORENSIC TECHNIQUES |
|
|
10 Factors Affecting One-Way Hashing of CD-R Media |
|
|
149 | |
|
Christopher Marberry and Philip Craiger |
|
|
|
11 Disk Drive I/O Commands and Write Blocking |
|
|
163 | |
|
James Lyle, Steven Mead and Kelsey Rider |
|
|
|
12 A New Process Model for Text String Searching |
|
|
179 | |
|
Nicole Beebe and Glenn Dietrich |
|
|
|
13 Detecting Steganography Using Multi-Class Classification |
|
|
193 | |
|
Benjamin Rodriguez and Gilbert Peterson |
|
|
|
14 Redacting Digital Information from Electronic Devices |
|
|
205 | |
|
A. Barclay, L. Watson, D. Greer, J. Hale and G. Manes |
|
|
PART VI FILE SYSTEM FORENSICS |
|
|
|
217 | |
|
Golden Richard III, Vassil Roussev and Lodovico Marziale |
|
|
|
16 File System Journal Forensics |
|
|
231 | |
|
Christopher Swenson, Raquel Phillips and Sujeet Shenoi |
|
|
PART VII NETWORK FORENSICS |
|
|
17 Using Search Engines to Acquire Network Forensic Evidence |
|
|
247 | |
|
Robert McGrew and Rayford Vaughn |
|
|
|
18 A Framework for Investigating Railroad Accidents |
|
|
255 | |
|
Mark Hartong, Rajni Goel and Duminda Wijeskera |
|
|
PART VIII PORTABLE ELECTRONIC DEVICE FORENSICS |
|
|
19 Forensic Analysis of Xbox Consoles |
|
|
269 | |
|
Paul Burke and Philip Craiger |
|
|
|
20 Super-Resolution Video Analysis for Forensic Investigations |
|
|
281 | |
|
Ashish Gehani and John Reif |
|
|
PART IX EVIDENCE ANALYSIS AND MANAGEMENT |
|
|
21 Specializing CRISP-DM for Evidence Mining |
|
|
303 | |
|
Jacobus Venter, Alta de Waal and Cornelius Willers |
|
|
|
22 Applying the Biba Integrity Model to Evidence Management |
|
|
317 | |
|
Kweku Arthur, Martin Olivier and Hein Venter |
|
|
PART X FORMAL METHODS |
|
|
23 Investigating Computer Attacks Using Attack Trees |
|
|
331 | |
|
Nayot Poolsapassit and Indrajit Ray |
|
|
|
24 Attack Patterns: A New Forensic and Design Tool |
|
|
345 | |
|
Eduardo Fernandez, Juan Pelaez and Maria Larrondo-Petrie |
|
|