Digital Evidence and Computer Crime

Forensic Science, Computers, and the Internet

Eoghan Casey

• Verlag: Academic Press
• Jahr: 2011
• ISBN:
  9780080921488
• Auflage: 3
• Thema: Informatik
• Thema: Informationstechnologie

Digital Evidence and Computer Crime, Third Edition, provides the knowledge necessary to uncover and use digital evidence effectively in any kind of investigation.

It offers a thorough explanation of how computer networks function, how they can be involved in crimes, and how they can be used as a source of evidence. In particular, it addresses the abuse of computer networks as well as privacy and security issues on computer networks.

This updated edition is organized into five parts. Part 1 is about digital forensics and covers topics ranging from the use of digital evidence in the courtroom to cybercrime law. Part 2 explores topics such as how digital investigations are conducted, handling a digital crime scene, and investigative reconstruction with digital evidence. Part 3 deals with apprehending offenders, whereas Part 4 focuses on the use of computers in digital investigation. The book concludes with Part 5, which includes the application of forensic science to networks.

New to this edition are updated information on dedicated to networked Windows, Unix, and Macintosh computers, as well as Personal Digital Assistants; coverage of developments in related technology and tools; updated language for search warrant and coverage of legal developments in the US impacting computer forensics; and discussion of legislation from other countries to provide international scope. There are detailed case examples that demonstrate key concepts and give students a practical/applied understanding of the topics, along with ancillary materials that include an Instructor's Manual and PowerPoint slides.

This book will prove valuable to computer forensic students and professionals, lawyers, law enforcement, and government agencies (IRS, FBI, CIA, CCIPS, etc.).

• Named The 2011 Best Digital Forensics Book by InfoSec Reviews
• Provides a thorough explanation of how computers & networks function, how they can be involved in crimes, and how they can be used as evidence
• Features coverage of the abuse of computer networks and privacy and security issues on computer networks

Subject Index

Note: Page numbers followed by f indicates a figure and t indicates a table.

10Base5 Ethernet, 714, 716t

10BaseT Ethernet, 715, 715f, 716t, 723

100BaseT Ethernet, 715, 716t, 723

1000BaseT Ethernet, 715, 716t

A

AAFS. See American Academy of Forensic Sciences (AAFS)

Abuse phase, computer intrusions, 372, 373t

Access Control Lists (ACLs), 519, 545

Access crimes, state cybercrime law, 103–105

Access points (APs)

IEEE 802.11, 616

MAC address sources, 725

network setup, 750

wireless network example, 616f

Accuracy

and admissibility, 61

best evidence, 64

business records, 68

and certainty, 68

dates and times, 522

evidence reliability, 61

forensic examination, 215

hypothesis formation/evaluation, 203

preconceived theories, 54

preservation, 210

and preservation, 474–485

temporal analysis, 506

verification, 197, 201

witness statements, 308

Accusation

case/incident resolution process, 50f

false, 73, 303

forensic examination, 214

investigation scaffolding, 197–198

investigative process model, 193f

security breach investigation, 221

ACDSee, 160, 491, 491f

Acknowledgment (ACK) bit, 747

ACLs. See Access Control Lists (ACLs)

ACPO Guide. See The Good Practice Guide for Computer Based Evidence (ACPO Guide)

Active state data, example, 607t

Actus reus

definition, 125

fraud offenses, 155

hacking, 134, 138

online grooming offenses, 168

system interference, 143

Adam Walsh Child Protection and Safety Act, 336

Address Resolution Protocol (ARP)

with ATM, 722

data-link/network layer linking, 719–721

e-mail harassment case, 726

MAC address sources, 725

purpose, 610

TCP/IP-related evidence, 765

Address Resolution Protocol (ARP) table, 720

Ad hoc network, 613

Admissibility

Best Evidence Rule, 64

bulletin boards example, 65

business records, 66–68

chat logs case, 61

consensual searches, 58

courtroom basics, 56–68

...