Digital Evidence and Computer Crime Forensic Science, Computers and The Internet 2nd Ed [Electronic resources] نسخه متنی

Part 1 (Chapters 1–7). Chapter 1 provides an overview. Chapter 2 (History and Terminology) provides relevant background, history, and terminology. Chapter 3 (Technology and Law) discusses legal issues that arise in computer related investigations, comparing US and European law. Chapter 4 (Investigative Process) discusses a systematic approach to investigating a crime based on the scientific method, providing a context for the remainder of this book. Chapter 5 (Investigative Reconstruction) describes how to use digital evidence to reconstruct events and learn more about the victim and the offender in a crime. Chapter 6 (Technology, MO, and Motive) is a discussion of the relationship between technology and the people who use it to commit crime. Understanding criminal motivation and behavior is key to assessing risks (will criminal activity escalate?), developing and interviewing suspects (who to look for and what to say to them), and focusing investigations (where to look and what to look for). Chapter 7 (Digital Evidence in Court) provides an overview of issues that arise in court relating to digital evidence.

Part 2 of this book (Chapters 8–13) begins by introducing basic Forensic Science concepts in the context of a single computer. Learning how to deal with individual computers is crucial because even when networks are involved, it is usually necessary to collect digital evidence stored on computers. Case examples and guidelines are provided to help apply the knowledge in this text to investigations. The remainder of Part 2 deals with specific kinds of computers and ends with a discussion of overcoming password protection and encryption on these systems.

Part 3 (Chapters 14–18) covers computer networks, focusing specifically on the Internet. A bottom-up approach is used to describe computer networks, Part 4 of this book (Chapters 19–22) focuses on specific types of investigations starting with Computer Intrusions in Chapter 19. Tools and techniques specific to this type of investigation are presented and detailed case examples are used to demonstrate key points. Chapter 20 covers investigations of Cyberstalking. Chapter 21 details Sexual Predators on the Internet and Chapter 22 discusses computers as alibi.

Part 5 is a short segment that provides guidelines for handling and processing digital evidence. This text does not cover forensic image, video and audio analysis. For information about image/video/audio enhancement and other aspects of this kind of analysis, see Electronic Evidence by Gruber (Gruber 1995).

The Forensic Science concepts described early on in relation to a single computer are carried through to each layer of the Internet. Seeing concepts from Forensic Science applied in a variety of contexts will help the reader generalize the systematic approach to processing and analyzing digital evidence. Once generalized, this systematic approach can be applied to situations not specifically discussed in this text. In place of the CD-ROM in the first edition of this book, an interactive Web site (www.disclosedigital.com) provides practical exercises based on actual cases to demonstrate key aspects of investigating computer related crimes and to help the reader apply the concepts in this book to his/her own investigations. This Web site epitomizes a general educational model that others can replicate or borrow from to create inexpensive, educational resources to assist investigators.