Preface |
|
xv | |
Dedication |
|
xvii | |
About the Author |
|
xix | |
|
PART I Introduction to Forensics |
|
|
1 | (88) |
|
Chapter 1 Introduction to Forensics |
|
|
3 | (36) |
|
What Is Computer Forensics? |
|
|
4 | (1) |
|
Using Scientific Knowledge |
|
|
5 | (1) |
|
|
6 | (1) |
|
|
6 | (1) |
|
|
6 | (4) |
|
Understanding the Field of Digital Forensics |
|
|
10 | (1) |
|
What Is Digital Evidence? |
|
|
11 | (1) |
|
Scope-Related Challenges to System Forensics |
|
|
12 | (3) |
|
Types of Digital System Forensics Analysis |
|
|
15 | (1) |
|
|
16 | (1) |
|
Knowledge Needed for Computer Forensics Analysis |
|
|
17 | (1) |
|
|
17 | (3) |
|
|
20 | (2) |
|
|
22 | (1) |
|
|
23 | (3) |
|
Obscured Information and Anti-Forensics |
|
|
26 | (2) |
|
|
28 | (1) |
|
U.S. Laws Affecting Digital Forensics |
|
|
29 | (1) |
|
The Federal Privacy Act of 1974 |
|
|
29 | (1) |
|
The Privacy Protection Act of 1980 |
|
|
29 | (1) |
|
The Communications Assistance to Law Enforcement Act of 1994 |
|
|
29 | (1) |
|
Unlawful Access to Stored Communications: 18 U.S.C. § 2701 |
|
|
29 | (1) |
|
The Electronic Communications Privacy Act of 1986 |
|
|
30 | (1) |
|
The Computer Security Act of 1987 |
|
|
30 | (1) |
|
The Foreign Intelligence Surveillance Act of 1978 |
|
|
30 | (1) |
|
The Child Protection and Sexual Predator Punishment Act of 1998 |
|
|
30 | (1) |
|
The Children's Online Privacy Protection Act of 1998 |
|
|
30 | (1) |
|
The Communications Decency Act of 1996 |
|
|
31 | (1) |
|
The Telecommunications Act of 1996 |
|
|
31 | (1) |
|
The Wireless Communications and Public Safety Act of 1999 |
|
|
31 | (1) |
|
|
31 | (1) |
|
The Sarbanes-Oxley Act of 2002 |
|
|
31 | (1) |
|
18 USC 1030 Fraud and Related Activity in Connection with Computers |
|
|
31 | (1) |
|
18 USC 1020 Fraud and Related Activity in Connection with Access Devices |
|
|
31 | (1) |
|
The Digital Millennium Copyright Act (DMCA) |
|
|
31 | (1) |
|
18 USC § 1028A Identity Theft and Aggravated Identity Theft |
|
|
32 | (1) |
|
18 USC § 2251 Sexual Exploitation of Children |
|
|
32 | (1) |
|
|
32 | (1) |
|
|
33 | (1) |
|
|
33 | (1) |
|
|
34 | (1) |
|
The Regional Computer Forensics Laboratory Program |
|
|
35 | (1) |
|
|
35 | (1) |
|
|
35 | (1) |
|
|
36 | (1) |
|
|
36 | (3) |
|
Chapter 2 Overview of Computer Crime |
|
|
39 | (26) |
|
How Computer Crime Affects Forensics |
|
|
40 | (1) |
|
|
41 | (1) |
|
|
42 | (1) |
|
|
43 | (1) |
|
|
44 | (1) |
|
How Does This Crime Affect Forensics? |
|
|
45 | (1) |
|
|
45 | (1) |
|
Structured Query Language Injection |
|
|
45 | (2) |
|
|
47 | (1) |
|
|
48 | (2) |
|
|
50 | (1) |
|
|
50 | (1) |
|
Cyberstalking and Harassment |
|
|
51 | (1) |
|
|
52 | (2) |
|
|
54 | (1) |
|
|
54 | (1) |
|
|
55 | (1) |
|
Non-Access Computer Crimes |
|
|
55 | (1) |
|
|
56 | (2) |
|
|
58 | (2) |
|
|
60 | (1) |
|
|
61 | (1) |
|
How Does This Crime Affect Forensics? |
|
|
62 | (1) |
|
|
62 | (1) |
|
|
63 | (1) |
|
|
63 | (2) |
|
Chapter 3 Forensic Methods and Labs |
|
|
65 | (24) |
|
|
66 | (1) |
|
Handle Original Data as Little as Possible |
|
|
66 | (1) |
|
Comply with the Rules of Evidence |
|
|
66 | (2) |
|
Avoid Exceeding Your Knowledge |
|
|
68 | (1) |
|
|
69 | (1) |
|
Technical Information Collection Considerations |
|
|
70 | (1) |
|
Formal Forensic Approaches |
|
|
71 | (1) |
|
|
71 | (1) |
|
|
71 | (1) |
|
|
72 | (1) |
|
An Event-Based Digital Forensics Investigation Framework |
|
|
72 | (1) |
|
Documentation of Methodologies and Findings |
|
|
72 | (1) |
|
|
73 | (1) |
|
|
73 | (1) |
|
|
73 | (1) |
|
Evidence-Gathering Measures |
|
|
74 | (1) |
|
|
74 | (1) |
|
How to Set Up a Forensics Lab |
|
|
75 | (1) |
|
|
75 | (1) |
|
|
75 | (1) |
|
American Society of Crime Laboratory Directors |
|
|
76 | (1) |
|
Common Forensic Software Programs |
|
|
77 | (1) |
|
|
77 | (3) |
|
|
80 | (1) |
|
|
81 | (1) |
|
|
81 | (1) |
|
|
81 | (1) |
|
AnaDisk Disk Analysis Tool |
|
|
82 | (1) |
|
CopyQM Plus Disk Duplication Software |
|
|
82 | (1) |
|
|
82 | (1) |
|
|
83 | (1) |
|
|
83 | (2) |
|
EnCase Certified Examiner Certification |
|
|
85 | (1) |
|
AccessData Certified Examiner |
|
|
85 | (1) |
|
|
85 | (1) |
|
EC Council Certified Hacking Forensic Investigator |
|
|
85 | (1) |
|
|
85 | (1) |
|
|
86 | (1) |
|
|
86 | (1) |
|
|
86 | (1) |
|
|
87 | (2) |
|
PART II Forensics Tools, Techniques, and Methods |
|
|
89 | (102) |
|
Chapter 4 Collecting, Seizing, and Protecting Evidence |
|
|
91 | (28) |
|
|
92 | (1) |
|
Shutting Down the Computer |
|
|
92 | (3) |
|
Transporting the Computer System to a Secure Location |
|
|
95 | (1) |
|
|
95 | (3) |
|
Documenting the Hardware Configuration of the System |
|
|
98 | (1) |
|
Mathematically Authenticating Data on All Storage Devices |
|
|
98 | (1) |
|
|
99 | (1) |
|
|
99 | (1) |
|
Documenting Filenames, Dates, and Times |
|
|
100 | (1) |
|
Identifying File, Program, and Storage Anomalies |
|
|
100 | (1) |
|
Evidence-Gathering Measures |
|
|
101 | (1) |
|
|
102 | (3) |
|
|
105 | (1) |
|
|
105 | (1) |
|
|
106 | (1) |
|
Digital Audio Tape Drives |
|
|
107 | (1) |
|
Digital Linear Tape and Super DLT |
|
|
107 | (1) |
|
|
107 | (1) |
|
|
108 | (1) |
|
|
108 | (1) |
|
|
109 | (1) |
|
|
110 | (2) |
|
Imaging with the Forensic Toolkit |
|
|
112 | (3) |
|
|
115 | (1) |
|
|
116 | (1) |
|
|
117 | (1) |
|
|
117 | (1) |
|
|
118 | (1) |
|
|
118 | (1) |
|
Chapter 5 Understanding Techniques for Hiding and Scrambling Information |
|
|
119 | (32) |
|
|
120 | (2) |
|
|
122 | (1) |
|
|
122 | (1) |
|
|
122 | (1) |
|
More Advanced Steganography |
|
|
122 | (1) |
|
|
123 | (1) |
|
|
124 | (3) |
|
|
127 | (1) |
|
|
127 | (1) |
|
|
127 | (1) |
|
|
128 | (1) |
|
The History of Encryption |
|
|
128 | (7) |
|
|
135 | (8) |
|
|
143 | (3) |
|
Quantum Computing and Cryptography |
|
|
146 | (1) |
|
|
147 | (1) |
|
|
147 | (1) |
|
|
148 | (1) |
|
|
149 | (2) |
|
Chapter 6 Recovering Data |
|
|
151 | (22) |
|
|
151 | (1) |
|
File Systems and Hard Drives |
|
|
152 | (1) |
|
|
152 | (3) |
|
Forensically Scrubbing a File or Folder |
|
|
155 | (7) |
|
|
162 | (3) |
|
|
165 | (1) |
|
Recovering Information from Damaged Media |
|
|
166 | (1) |
|
Physical Damage Recovery Techniques |
|
|
167 | (1) |
|
Recovering Data After Logical Damage |
|
|
167 | (2) |
|
|
169 | (1) |
|
|
170 | (1) |
|
|
170 | (1) |
|
|
170 | (1) |
|
|
171 | (2) |
|
Chapter 7 Incident Response |
|
|
173 | (18) |
|
|
174 | (1) |
|
|
175 | (1) |
|
|
175 | (1) |
|
|
176 | (1) |
|
|
176 | (2) |
|
|
178 | (1) |
|
Common Vulnerability Scoring System |
|
|
178 | (2) |
|
|
180 | (1) |
|
|
180 | (1) |
|
|
181 | (1) |
|
|
181 | (1) |
|
|
181 | (1) |
|
|
182 | (1) |
|
The Post Recovery Follow-Up |
|
|
183 | (1) |
|
|
183 | (1) |
|
|
184 | (1) |
|
|
184 | (1) |
|
|
184 | (1) |
|
|
185 | (1) |
|
|
185 | (1) |
|
|
186 | (1) |
|
Adding Forensics to Incident Response |
|
|
187 | (1) |
|
|
187 | (1) |
|
|
188 | (1) |
|
|
188 | (1) |
|
|
188 | (1) |
|
|
189 | (1) |
|
|
189 | (2) |
|
PART III Branches of Digital Forensics |
|
|
191 | (17) |
|
Chapter 8 Windows Forensics |
|
|
193 | (30) |
|
|
194 | (1) |
|
|
194 | (2) |
|
|
196 | (1) |
|
|
196 | (1) |
|
|
197 | (2) |
|
|
199 | (1) |
|
|
200 | (4) |
|
|
204 | (1) |
|
|
204 | (1) |
|
|
204 | (2) |
|
|
206 | (1) |
|
|
206 | (1) |
|
|
206 | (1) |
|
|
207 | (2) |
Index.dat |
|
208 | (167) |
|
Windows Files and Permissions |
|
|
209 | (1) |
|
|
209 | (1) |
|
|
210 | (2) |
|
|
212 | (1) |
|
|
212 | (1) |
|
Tracking Word Documents in the Registry |
|
|
213 | (1) |
|
|
213 | (1) |
|
|
213 | (1) |
|
|
214 | (1) |
|
|
214 | (1) |
|
|
215 | (1) |
|
|
215 | (1) |
|
|
216 | (1) |
|
|
217 | (1) |
|
|
217 | (1) |
|
|
217 | (1) |
|
|
218 | (1) |
|
|
219 | (2) |
|
|
221 | (1) |
|
|
221 | (1) |
|
|
221 | (1) |
|
|
222 | (1) |
|
Chapter 9 Linux Forensics |
|
|
223 | (30) |
|
|
224 | (1) |
|
|
224 | (1) |
|
|
224 | (1) |
|
|
225 | (3) |
|
|
228 | (1) |
|
|
229 | (2) |
|
Logical Volume Management |
|
|
231 | (1) |
|
|
232 | (1) |
|
|
232 | (1) |
|
|
232 | (1) |
|
|
233 | (1) |
|
The Berkeley Fast File System |
|
|
233 | (1) |
|
|
233 | (1) |
|
|
233 | (1) |
|
The /var/log/kern.log Log |
|
|
233 | (1) |
|
|
233 | (1) |
|
|
234 | (1) |
|
|
234 | (1) |
|
The /var/log/apache2/* Log |
|
|
234 | (1) |
|
The /var/log/lighttpd/* Log |
|
|
234 | (1) |
|
The /var/log/apport. log Log |
|
|
234 | (1) |
|
|
235 | (1) |
|
|
235 | (1) |
|
|
235 | (1) |
|
|
235 | (1) |
|
|
235 | (1) |
|
|
236 | (1) |
|
|
236 | (1) |
|
|
236 | (1) |
|
|
237 | (1) |
|
|
237 | (1) |
|
|
237 | (1) |
|
|
237 | (1) |
|
|
237 | (1) |
|
|
237 | (1) |
|
|
238 | (1) |
|
|
238 | (1) |
|
|
239 | (1) |
|
Shell Commands for Forensics |
|
|
239 | (1) |
|
|
239 | (1) |
|
|
239 | (1) |
|
|
240 | (1) |
|
|
241 | (1) |
|
|
241 | (1) |
|
|
241 | (1) |
|
|
242 | (1) |
|
|
242 | (1) |
|
|
242 | (1) |
|
|
243 | (1) |
|
|
243 | (1) |
|
|
243 | (1) |
|
|
243 | (1) |
|
|
244 | (1) |
|
|
244 | (1) |
|
|
244 | (1) |
|
|
244 | (1) |
|
|
244 | (1) |
|
|
245 | (1) |
|
Can You Undelete in Linux? |
|
|
245 | (1) |
|
|
245 | (1) |
|
|
246 | (4) |
|
Forensics Tools for Linux |
|
|
250 | (1) |
|
|
250 | (1) |
|
|
251 | (1) |
|
|
251 | (1) |
|
|
251 | (1) |
|
|
252 | (1) |
|
|
252 | (1) |
|
|
252 | (1) |
|
Chapter 10 Mac OS Forensics |
|
|
253 | (18) |
|
|
254 | (1) |
|
|
254 | (3) |
|
|
257 | (2) |
|
|
259 | (1) |
|
|
259 | (1) |
|
|
260 | (1) |
|
|
260 | (1) |
|
The /var/spool/cups Folder |
|
|
260 | (1) |
|
The /private/var/audit Logs |
|
|
260 | (1) |
|
The /private/var/VM Folder |
|
|
260 | (1) |
|
The /Library/Receipts Folder |
|
|
260 | (1) |
|
/Library/Mobile Documents |
|
|
261 | (1) |
|
The /Users/<user>/.bash_history Log |
|
|
261 | (1) |
|
|
261 | (1) |
|
|
261 | (1) |
|
The /Users/<user>/Library/Preferences Folder |
|
|
261 | (1) |
|
|
261 | (1) |
|
|
261 | (1) |
|
|
262 | (1) |
|
The /Applications Directory |
|
|
262 | (1) |
|
|
262 | (1) |
|
|
262 | (1) |
|
The /Library/Preferences/SystemConfiguration/dom.apple.preferences.plist File |
|
|
262 | (1) |
|
Mac OS Forensic Techniques |
|
|
262 | (1) |
|
|
262 | (1) |
|
|
263 | (1) |
|
|
263 | (1) |
|
How to Examine an Apple Device |
|
|
264 | (1) |
|
|
264 | (1) |
|
|
265 | (1) |
|
Can You Undelete in Mac OS? |
|
|
266 | (2) |
|
|
268 | (2) |
|
|
270 | (1) |
|
|
270 | (1) |
|
|
270 | (1) |
|
Chapter 11 Email Forensics |
|
|
271 | (20) |
|
|
272 | (1) |
|
|
273 | (1) |
|
|
274 | (1) |
|
|
275 | (1) |
|
Getting Headers in Outlook 2019 |
|
|
276 | (1) |
|
Getting Headers from Yahoo! Email |
|
|
277 | (2) |
|
Getting Headers from Gmail |
|
|
279 | (1) |
|
|
280 | (1) |
|
|
281 | (1) |
|
|
282 | (1) |
|
|
283 | (1) |
|
|
284 | (1) |
|
|
284 | (1) |
|
|
285 | (1) |
|
The Fourth Amendment to the U.S. Constitution |
|
|
285 | (1) |
|
The Electronic Communications Privacy Act |
|
|
285 | (1) |
|
|
286 | (1) |
|
|
287 | (1) |
|
The Communication Assistance to Law Enforcement Act |
|
|
287 | (1) |
|
The Foreign Intelligence Surveillance Act |
|
|
287 | (1) |
|
|
288 | (1) |
|
|
288 | (1) |
|
|
288 | (1) |
|
|
289 | (2) |
|
Chapter 12 Mobile Forensics |
|
|
291 | (22) |
|
|
292 | (1) |
|
|
292 | (1) |
|
|
293 | (1) |
|
|
294 | (10) |
|
Evidence You Can Get from a Cell Phone |
|
|
304 | (1) |
|
|
305 | (1) |
|
|
306 | (1) |
|
|
306 | (1) |
|
Seizing Evidence from a Mobile Device |
|
|
306 | (2) |
|
|
308 | (1) |
|
|
309 | (2) |
|
|
311 | (1) |
|
|
311 | (1) |
|
|
312 | (1) |
|
|
312 | (1) |
|
|
313 | (1) |
|
Chapter 13 Network Basics |
|
|
313 | (30) |
|
IP Addresses and MAC Addresses |
|
|
314 | (4) |
|
Open Systems Interconnection Model |
|
|
318 | (3) |
|
|
321 | (1) |
|
|
321 | (1) |
|
|
321 | (4) |
|
|
325 | (3) |
|
Network Traffic Analysis Tools |
|
|
328 | (1) |
|
|
328 | (3) |
|
|
331 | (1) |
|
|
331 | (1) |
|
|
332 | (1) |
|
|
332 | (1) |
|
|
332 | (1) |
|
Using Log Files as Evidence |
|
|
332 | (1) |
|
|
333 | (1) |
|
|
334 | (1) |
|
|
335 | (1) |
|
|
336 | (1) |
|
|
336 | (2) |
|
|
338 | (1) |
|
Getting Evidence from the Router |
|
|
338 | (2) |
|
|
340 | (1) |
|
|
340 | (1) |
|
|
340 | (1) |
|
Stateful Packet Inspection |
|
|
340 | (1) |
|
|
340 | (1) |
|
|
341 | (1) |
|
|
341 | (1) |
|
|
342 | (1) |
|
Chapter 14 Memory Forensics |
|
|
343 | (18) |
|
How Computer Memory Works |
|
|
344 | (1) |
|
|
344 | (1) |
|
|
345 | (1) |
|
|
345 | (2) |
|
Analyzing Memory with Volatility |
|
|
347 | (5) |
|
Analyzing Memory with OSForensics |
|
|
352 | (1) |
|
|
352 | (2) |
|
|
354 | (1) |
|
|
355 | (1) |
|
|
355 | (1) |
|
|
356 | (1) |
|
|
356 | (1) |
|
|
356 | (1) |
|
|
356 | (1) |
|
Malware Hiding Techniques |
|
|
357 | (1) |
|
|
358 | (2) |
|
|
360 | (1) |
|
|
360 | (1) |
|
|
360 | (1) |
|
Chapter 15 Trends and Future Directions |
|
|
361 | (14) |
|
|
362 | (1) |
|
What Impact Does This Have on Forensics? |
|
|
363 | (1) |
|
|
363 | (1) |
|
|
364 | (3) |
|
|
367 | (4) |
|
Legal and Procedural Trends |
|
|
371 | (1) |
|
|
372 | (1) |
|
|
372 | (1) |
|
|
373 | (1) |
|
|
373 | (1) |
|
|
373 | (1) |
|
|
373 | (1) |
|
|
374 | (1) |
|
|
374 | (1) |
Appendix A Answer Key |
|
375 | (2) |
Appendix B Standard Acronyms |
|
377 | (4) |
Glossary of Key Terms |
|
381 | (6) |
Index |
|
387 | |