SitemapTable of ContentsBackCoverDigital Evidence and Computer Crime - Forensic Science, Computers and the Internet, Second EditionIntroductionReliability of Digital EvidenceThe Need for StandardizationRoadmap to the BookDisclaimerPart 1: Digital InvestigationChapter 1: Digital Evidence and Computer Crime1.1 Digital Evidence1.2 Increasing Awareness of Digital Evidence1.3 Challenging Aspects of Digital Evidence1.4 Following the Cybertrail1.5 Challenging Aspects of the Cybertrail1.6 Forensic Science and Digital Evidence1.7 SummaryReferencesCasesChapter 2: History and Terminology of Computer Crime Investigation2.1 Brief History of Computer Crime Investigation2.2 Evolution of Investigative Tools2.3 Language of Computer Crime Investigation2.4 SummaryReferencesCasesChapter 3: Technology and LawPart A Technology and Law - A Us Perspective3A.1 Jurisdiction3A.2 Pornography and Obscenity3A.3 Privacy3A.4 Copyrights and the " Theft " of Digital Intellectual PropertyPart B Computer Misuse in AmericaPart C Technology and Criminal Law - A European Perspective3C.1 Overview of Criminal Offenses3C.2 Search and Seizure3C.3 Jurisdiction and Extradition3C.4 Penalties3C.5 Privacy3C.6 SummaryUnited States Perspective BibliographyLegislationReferencesEuropean Perspective Bibliography/Suggested Further ReadingLegislationReferencesChapter 4: The Investigative Process4.1 The Role of Digital Evidence4.2 Investigative Methodology4.3 SummaryReferencesCasesChapter 5: Investigative Reconstruction with Digital Evidence5.1 Equivocal Forensic Analysis5.2 Victimology5.3 Crime Scene Characteristics5.4 Evidence Dynamics and the Introduction of Error5.5 Reporting5.6 SummaryReferencesCasesChapter 6: Modus Operandi, Motive, and Technology6.1 Axes to Pathological Criminals, and Other Unintended Consequences6.2 Modus Operandi6.3 Technology and Modus Operandi6.4 Motive and Technology6.5 Current Technologies6.6 SummaryReferencesChapter 7: Digital Evidence in the Courtroom7.1 Admissibility - Warrants7.2 Authenticity and Reliability7.3 Casey''s Certainty Scale7.4 Best Evidence7.5 Direct versus Circumstantial Evidence7.6 Hearsay7.7 Scientific Evidence7.8 Presenting Digital Evidence7.9 SummaryReferencesCasesPart 2: ComputersChapter 8: Computer Basics for Digital Investigators8.2 Basic Operation of Computers8.3 Representation of Data8.4 Storage Media and Data Hiding8.5 File Systems and Location of Data8.6 Overview of Encryption8.7 SummaryReferencesCasesChapter 9: Applying Forensic Science to Computers9.1 Authorization and Preparation9.2 Identification9.3 Documentation9.4 Collection and Preservation9.5 Examination and Analysis9.6 Reconstruction9.7 Reporting9.8 SummaryReferencesCasesChapter 10: Forensic Examination of Windows Systems10.1 Windows Evidence Acquisition Boot Disk10.2 File Systems10.3 Overview of Digital Evidence Processing Tools10.4 Data Recovery10.5 Log Files10.6 File System Traces10.7 Registry10.8 Internet Traces10.9 Program Analysis10.10 SummaryReferencesCasesChapter 11: Forensic Examination of Unix Systems11.1 Unix Evidence Acquisition Boot Disk11.2 File Systems11.3 Overview of Digital Evidence Processing Tools11.4 Data Recovery11.5 Log Files11.6 File System Traces11.7 Internet Traces11.8 SummaryReferencesChapter 12: Forensic Examination of Macintosh Systems12.2 Overview of Digital Evidence Processing Tools12.3 Data Recovery12.4 File System Traces12.5 Internet Traces12.6 SummaryChapter 13: Forensic Examination of Handheld Devices13.1 Overview of Handheld Devices13.2 Collection and Examination of Handheld Devices13.3 Dealing with Password Protection and Encryption13.4 Related Sources of Digital Evidence13.5 SummaryReferencesCasesPart 3: NetworksChapter 14: Network Basics for Digital Investigators14.1 A Brief History of Computer Networks14.2 Technical Overview of Networks14.3 Network Technologies14.4 Connecting Networks using Internet Protocols14.5 SummaryReferencesCasesChapter 15: Applying Forensic Science to Networks15.1 Preparation and Authorization15.2 Identification15.3 Documentation, Collection, and Preservation15.4 Filtering and Data Reduction15.5 Class/Individual Characteristics and Evaluation of Source15.6 Evidence Recovery15.7 Investigative Reconstruction15.8 Reporting Results15.9 SummaryReferencesCasesChapter 16: Digital Evidence on Physical and Data-Link Layers16.1 Ethernet16.2 Linking the Data-Link and Network Layers - Encapsulation16.3 Ethernet versus ATM Networks16.4 Documentation, Collection, and Preservation16.5 Analysis Tools and Techniques16.6 SummaryReferencesChapter 17: Digital Evidence at the Network and Transport Layers17.1 TCP/IP17.2 Setting up a Network17.3 TCP/IP Related Digital Evidence17.4 SummaryReferencesChapter 18: Digital Evidence on the Internet18.1 Role of the Internet in Criminal Investigations18.2 Internet Services: Legitimate versus Criminal Uses18.3 Using the Internet as an Investigative Tool18.4 Online Anonymity and Self-Protection18.5 E-Mail Forgery and Tracking18.6 Usenet Forgery and Tracking18.7 Searching and Tracking on IRC18.8 SummaryReferencesCasesPart 4: Investigating Computer CrimeChapter 19: Investigating Computer Intrusions19.1 How Computer Intruders Operate19.2 Investigating Intrusions19.3 Investigative Reconstruction19.4 Detailed Case Example19.5 SummaryReferencesChapter 20: Sex Offenders on the Internet20.1 Window to the World20.2 Legal Considerations20.3 Identifying and Processing Digital Evidence20.4 Investigating Online Sexual Offenders20.5 Investigative Reconstruction20.6 SummaryReferencesCasesChapter 21: Cyberstalking21.1 How Cyberstalkers Operate21.2 Investigating Cyberstalking21.3 Cyberstalking Case Example21.4 SummaryReferencesChapter 22: Digital Evidence as Alibi22.1 Investigating an Alibi22.2 Time as Alibi22.3 Location as Alibi22.4 SummaryPart 5: GuidelinesChapter 23: Digital Evidence Handling Guidelines23.1 Identification or Seizure23.2 PreservationChapter 24: Digital Evidence Examination Guidelines24.1 Preparation24.2 Processing24.3 Identify and Process Special Files24.4 SummaryReferencesBibliographyCASESGlossaryD-MN-ST-WAuthor IndexIndexIndex_CIndex_DIndex_FIndex_GIndex_HIndex_JIndex_KIndex_LIndex_MIndex_OIndex_PIndex_QIndex_RIndex_SIndex_TIndex_UIndex_VIndex_WSubject IndexIndex_AIndex_BIndex_CIndex_DIndex_EIndex_FIndex_GIndex_HIndex_IIndex_JIndex_KIndex_LIndex_MIndex_NIndex_OIndex_PIndex_QIndex_RIndex_SIndex_TIndex_UIndex_VIndex_WIndex_XIndex_YIndex_ZList of FiguresList of TablesList of Case Examples