Dedication

Preface

Acknowledgments

About the Author

About the Technical Editor

Chapter 1. Introduction

Introduction

What is Forensic Science?

What is Digital Forensics?

Uses of Digital Forensics

Locard's Exchange Principle

Scientific Method

Organizations of Note

Role of the Forensic Examiner in the Judicial System

Summary

REFERENCES

Chapter 2. Key Technical Concepts

Introduction

Bits, Bytes, and Numbering Schemes

File Extensions and File Signatures

Storage and Memory

Computing Environments

Data Types

File Systems

Allocated and Unallocated Space

How Magnetic Hard Drives Store Data

Basic Computer Function—Putting it All Together

Summary

REFERENCES

Chapter 3. Labs and Tools

Introduction

Forensic Laboratories

Policies and Procedures

Quality Assurance

Digital Forensic Tools

Accreditation

Summary

REFERENCES

Chapter 4. Collecting Evidence

Introduction

Crime Scenes and Collecting Evidence

Documenting the Scene

Chain of Custody

Cloning

Live System versus Dead System

Hashing

Final Report

Summary

REFERENCES

Chapter 5. Windows System Artifacts

Introduction

Deleted Data

Hibernation File (Hiberfile.Sys)

Registry

Print Spooling

Recycle Bin

Metadata

Thumbnail Cache

Most Recently Used (MRU)

Restore Points and Shadow Copy

Prefetch

Link Files

Summary

REFERENCES

Chapter 6. Antiforensics

Introduction

Hiding Data

Password Attacks

Steganography

Data Destruction

Summary

REFERENCES

Chapter 7. Legal

Introduction

The Fourth Amendment

Criminal Law—Searches Without a Warrant

Searching with a Warrant

Electronic Discovery (eDiscovery)

Expert Testimony

Summary

REFERENCES

Chapter 8. Internet and E-Mail

Introduction

Internet Overview

Web Browsers—Internet Explorer

E-Mail

Social Networking Sites

Summary

REFERENCES

Chapter 9. Network Forensics

Introduction

Network Fundamentals

Network Security Tools

Network Attacks

Incident Response

Network Evidence and Investigations

Summary

REFERENCES

Chapter 10. Mobile Device Forensics

Introduction

Cellular Networks

Operating Systems

Cell Phone Evidence

Cell Phone Forensic Tools

Global Positioning Systems (GPS)

Summary

REFERENCES

Chapter 11. Looking Ahead

Introduction

Standards and Controls

Cloud Forensics (Finding/Identifying Potential Evidence Stored In the Cloud)

Solid State Drives (SSD)

Speed of Change

Summary

REFERENCES

Index