Michael W Graves

Digital Archaeology

The Art and Science of Digital Forensics

• Broschiertes Buch

Produktbeschreibung

The rapid proliferation of cyber crime -- including identity theft, network intrusion, piracy, and distribution of pornography -- is increasing the demand for digital forensics experts in both law enforcement and private investigation. Moreover, nearly 3/4 of conventional crimes now investigated in the US involve some form of computer search. Employment in digital forensics is expected to grow at 22%+ annually through 2018, and far more college students are now pursuing related majors. Unfortunately, most books on digital forensics are of inadequate quality, and many of the better books are quickly becoming outdated. Digital Archaeology solves the problem: expert practitioner Michael Graves has written the field’s most substantial reference.

Graves provides a solid understanding of the legal ramifications and most critical laws affecting digital forensics, including relevant case laws showing how courts have interpreted these laws. He covers each key tool and method investigators can use to reliably uncover hidden information in digital systems, demonstrating applications at work and the actual syntax of command-line utilities. You’ll find up-to-the-minute coverage of current licensing and certification requirements, as well as exclusive coverage of facilities management and a full chapter on the crucial, often-overlooked topic of “first response” to a digital crime scene.

Product Description
The Definitive, Up-to-Date Guide to Digital Forensics

The rapid proliferation of cyber crime is increasing the demand for digital forensics experts in both law enforcement and in the private sector. In Digital Archaeology, expert practitioner Michael Graves has written the most thorough, realistic, and up-to-date guide to the principles and techniques of modern digital forensics.

Graves begins by providing a solid understanding of the legal underpinnings of and critical laws affecting computer forensics, including key principles of evidence and case law. Next, he explains how to systematically and thoroughly investigate computer systems to unearth crimes or other misbehavior, and back it up with evidence that will stand up in court.

Drawing on the analogy of archaeological research, Graves explains each key tool and method investigators use to reliably uncover hidden information in digital systems. His detailed demonstrations often include the actual syntax of command-line utilities. Along the way, he presents exclusive coverage of facilities management, a full chapter on the crucial topic of first response to a digital crime scene, and up-to-the-minute coverage of investigating evidence in the cloud.

Graves concludes by presenting coverage of important professional and business issues associated with building a career in digital forensics, including current licensing and certification requirements.

Topics Covered Include

Acquiring and analyzing data in ways consistent with forensic procedure

Recovering and examining e-mail, Web, and networking activity

Investigating users’ behavior on mobile devices

Overcoming anti-forensics measures that seek to prevent data capture and analysis

Performing comprehensive electronic discovery in connection with lawsuits

Effectively managing cases and documenting the evidence you find

Planning and building your career in digital forensics

Digital Archaeology is a key resource for anyone preparing for a career as a professional investigator; for IT professionals who are sometimes called upon to assist in investigations; and for those seeking an explanation of the processes involved in preparing an effective defense, including how to avoid the legally indefensible destruction of digital evidence.

Features + Benefits

The most definitive and up-to-date practitioner’s guide to digital forensics

Fully covers key topics overlooked in competing books, such as the unique responsibilities of “first responders” to digital crime scenes

Includes a one-of-a-kind chapter on facilities management, and up-to-date coverage of licensing and certification

---

In Digital Archaeology, expert practitioner Michael Graves has written the most thorough, realistic, and up-to-date guide to the principles and techniques of modern digital forensics. He begins by providing a solid understanding of the legal underpinnings and critical laws affecting computer forensics, including key principles of evidence and case law. Next, he explains how to systematically and thoroughly investigate computer systems to unearth crimes or other misbehavior, and back it up with evidence that will stand up in court. Drawing on the analogy of archaeological research, Graves explains each key tool and method investigators use to reliably uncover hidden information in digital systems. Graves concludes by presenting coverage of important professional and business issues associated with building a career in digital forensics, including current licensing and certification requirements.

Produktdetails

• Verlag: Addison-Wesley
• Seitenzahl: 608
• Erscheinungstermin: 27. August 2013
• Englisch
• Abmessung: 231mm x 177mm x 35mm
• Gewicht: 934g
• ISBN-13: 9780321803900
• ISBN-10: 0321803906
• Artikelnr.: 36457596

Autorenporträt

Michael W. Graves has worked for more than fifteen years as a network specialist, security analyst, and forensic analyst. He worked as a contractor for the federal government on jobs involving digital investigations ranging from simple employee violations to potential national security threats, and participated in e-discovery for a major bank. Graves holds an M.S. in digital investigation from Champlain College, where he studied under pioneers Gary Kessler and Robert Simpson, among others. He also served several semesters as adjunct professor of computer science for the college.

Inhaltsangabe

Preface xiii
About the Author xxi
Chapter 1: The Anatomy of a Digital Investigation 1
A Basic Model for Investigators 2
Understanding the Scope of the Investigation 8
Identifying the Stakeholders 12
The Art of Documentation 13
Chapter Review 21
Chapter Exercises 21
References 22
Chapter 2: Laws Affecting Forensic Investigations 23
Constitutional Implications of Forensic Investigation 24
The Right to Privacy 29
The Expert Witness 31
Chapter Review 32
Chapter Exercises 32
References 33
Chapter 3: Search Warrants and Subpoenas 35
Distinguishing between Warrants and Subpoenas 36
What Is a Search and When Is It Legal? 37
Basic Elements of Obtaining a Warrant 40
The Plain View Doctrine 43
The Warrantless Search 44
Subpoenas 50
Chapter Review 51
Chapter Exercises 52
References 52
Chapter 4: Legislated Privacy Concerns 55
General Privacy 56
Financial Legislation 59
Privacy in Health Care and Education 62
Privileged Information 64
Chapter Review 67
Chapter Exercises 68
References 68
Chapter 5: The Admissibility of Evidence 71
What Makes Evidence Admissible? 71
Keeping Evidence Authentic 76
Defining the Scope of the Search 84
When the Constitution Doesn’t Apply 84
Chapter Review 89
Chapter Exercises 89
References 89
Chapter 6: First Response and the Digital Investigator 91
Forensics and Computer Science 91
Controlling the Scene of the Crime 96
Handling Evidence 100
Chapter Review 109
Chapter Exercises 109
References 110
Chapter 7: Data Acquisition 111
Order of Volatility 112
Memory and Running Processes 112
Acquiring Media 121
Chapter Review 128
Chapter Exercises 128
References 129
Chapter 8: Finding Lost Files 131
File Recovery 131
The Deleted File 141
Data Carving 145
Chapter Review 149
Chapter Exercises 150
References 150
Chapter 9: Document Analysis 151
File Identification 151
Understanding Metadata 157
Mining the Temporary Files 172
Identifying Alternate Hiding Places of Data 176
Chapter Review 183
Chapter Exercises 183
References 183
Chapter 10: E-mail Forensics 185
E-mail Technology 185
Information Stores 191
The Anatomy of an E-mail 196
An Approach to E-mail Analysis 203
Chapter Review 210
Chapter Exercises 211
References 211
Chapter 11: Web Forensics 213
Internet Addresses 213
Web Browsers 215
Web Servers 233
Proxy Servers 238
Chapter Review 244
Chapter Exercises 244
References 245
Chapter 12: Searching the Network 247
An Eagle’s Eye View 247
Initial Response 248
Proactive Collection of Evidence 250
Post-Incident Collection of Evidence 262
Router and Switch Forensics 268
Chapter Review 275
Chapter Exercises 275
References 276
Chapter 13: Excavating a Cloud 277
What Is Cloud Computing? 277
Shaping the Cloud 279
The Implications of Cloud Forensics 284
On Virtualization 291
Constitutional Issues 300
Chapter Review 303
Chapter Exercises 304
References 304
Chapter 14: Mobile Device Forensics 307
Challenges of Mobile Device Forensics 307
How Cell Phones Work 308
Data Storage on Cell Phones 313
Acquisition and Storage 317
Legal Aspects of Mobile Device Forensics 322
Chapter Review 324
Chapter Exercises 325
References 325
Chapter 15: Fighting Antiforensics 327
Artifact Destruction 328
Hiding Data on the System 336
Covert Data 347
Chapter Review 354
Chapter Exercises 355
References 355
Chapter 16: Litigation and Electronic Discovery 357
What Is E-Discovery? 358
A Roadmap of E-Discovery 358
Conclusion 377
Chapter Review 377
Chapter Exercises 377
References 378
Chapter 17: Case Management and Report Writing 379
Managing a Case 379
Writing Reports 389
Chapter Review 393
Chapter Exercises 394
References 394
Chapter 18: Tools of the Digital Investigator 395
Software Tools 395
Working with “Court-Approved” Tools 410
Hardware Tools 413
Nontechnical Tools 418
Chapter Review 421
Chapter Exercises 422
References 422
Chapter 19: Building a Forensic Workstation 423
What Is a Forensic Workstation? 424
Commercially Available Forensic Workstations 425
Building a Forensic Workstation From Scratch 429
Chapter Review 440
Chapter Exercises 440
References 440
Chapter 20: Licensing and Certification 441
Digital Forensic Certification 441
Vendor-Neutral Certification Programs 442
Vendor-Specific Certification Programs 449
Digital Forensic Licensing Requirements 452
Chapter Review 454
Chapter Exercises 454
References 454
Chapter 21: The Business of Digital Forensics 457
Starting a New Forensics Organization 458
Maintaining the Organization 466
Generating Revenue 478
Organizational Certification 481
Chapter Review 483
Chapter Exercises 483
References 483
Appendix A: Chapter Review Answers 485
Appendix B: Sample Forms 505
Glossary 511
Index 521