A Practical Guide to Computer Forensics Investigations

Introduction

The Scope of Computer Forensics

• Introduction
• Types of Computer Forensics Evidence Recovered
• What Skills Must a Computer Forensics Investigator Possess?
• The Importance of Computer Forensics
• A History of Computer Forensics
• Training and Education
• Summary
• Assessment

Windows Operating and File Systems

• Introduction
• Physical and Logical Storage
• File Conversion and Numbering Formats
• Operating Systems
• Windows Registry
• Microsoft Windows Features
• Summary
• Assessment

Handling Computer Hardware

• Introduction
• Hard Disk Drives
• Cloning a PATA or SATA Hard Disk
• Removable Memory
• Summary
• Assessment
• References

Acquiring Evidence in a Computer Forensics Lab

• Introduction
• Lab Requirements
• Private Sector Computer Forensics Laboratories
• Computer Forensics Laboratory Requirements
• Extracting Evidence from a Device
• Skimmers
• Summary
• Assessment

Online Investigations

• Introduction
• Working Undercover
• Website Evidence
• Background Searches on a Suspect
• Online Crime
• Capturing Online Communications
• Summary
• Assessment

Documenting the Investigation

• Introduction
• Obtaining Evidence from a Service Provider
• Documenting a Crime Scene
• Seizing Evidence
• Documenting the Evidence
• Using Tools to Document an Investigation
• Writing Reports
• Using Expert Witnesses at Trial
• Summary
• Assessment

Admissibility of Digital Evidence

• Introduction
• History and Structure of the United States Legal System
• Evidence Admissibility
• Constitutional Law
• When Computer Forensics Goes Wrong
• Structure of the Legal System in the European Union (E.U.)
• Structure of the Legal System in Asia
• Summary
• Assessment

Network Forensics

• Introduction
• The Tools of the Trade
• Networking Devices
• Understanding the OSI Model
• Advanced Persistent Threats
• Investigating a Network Attack
• Summary
• Assessment

Mobile Forensics

• Introduction
• The Cellular Network
• Handset Specifications
• Mobile Operating Systems
• Standard Operating Procedures for Handling Handset Evidence
• Handset Forensics
• Manual Cellphone Examinations
• Global Satellite Service Providers
• Legal Considerations
• Other Mobile Devices
• Summary
• Assessment

Photograph Forensics

• Introduction
• Understanding Digital Photography
• Examining Picture Files
• Evidence Admissibility
• Case Studies
• Summary
• Assessment

Mac Forensics

• Introduction
• A Brief History
• Macintosh File Systems
• Forensic Examinations of a Mac
• Macintosh Operating Systems
• Apple Mobile Devices
• Case Studies
• Summary
• Assessment

Case Studies

• Introduction
• Zacharias Moussaoui
• BTK (Bind Torture Kill) Killer
• Cyberbullying
• Sports
• Summary
• Assessment
• Assessment of Cases by Judges