Computer Forensics For Dummies (For Dummies (Computer/Tech))

Uncover a digital trail of e-evidence by using the helpful, easy-to-understand information in Computer Forensics For Dummies ! Professional and armchair investigators alike can learn the basics of computer forensics, from digging out electronic evidence to solving the case. You won’t need a computer science degree to master e-discovery. Find and filter data in mobile devices, e-mail, and other Web-based technologies. You’ll learn all about e-mail and Web-based forensics, mobile forensics, passwords and encryption, and other e-evidence found through VoIP, voicemail, legacy mainframes, and databases. You’ll discover how to use the latest forensic software, tools, and equipment to find the answers that you’re looking for in record time. When you understand how data is stored, encrypted, and recovered, you’ll be able to protect your personal privacy as well. By the time you finish reading this book, you’ll know how to: Prepare for and conduct computer forensics investigations Find and filter data Protect personal privacy Transfer evidence without contaminating it Anticipate legal loopholes and opponents’ methods Handle passwords and encrypted data Work with the courts and win the case Plus, Computer Forensics for Dummies includes lists of things that everyone interested in computer forensics should know, do, and build. Discover how to get qualified for a career in computer forensics, what to do to be a great investigator and expert witness, and how to build a forensics lab or toolkit. Note: CD-ROM/DVD and other supplementary materials are not included as part of eBook file. Computer Forensics For Dummies 3 About the Authors 7 Dedication 9 Authors’ Acknowledgments 11 Contents at a Glance 13 Table of Contents 15 Introduction 24 Who Should Read This Book? 24 About This Book 25 How to Use This Book 26 What You Don’t Need to Read 26 Foolish Assumptions 26 How This Book Is Organized 27 About the Web Site and Blog 28 Icons Used in This Book 29 Where to Go from Here 29 Part I: Digging Out and Documenting Electronic Evidence 30 Chapter 1: Knowing What Your Digital Devices Create, Capture, and Pack Away — Until Revelation Day 32 Living and Working in a Recorded World 33 Giving the Third Degree to Computers, Electronics, and the Internet 36 Answering the Big Questions 37 Examining Investigative Methods 43 Revealing Investigation Results 44 Chapter 2: Suiting Up for a Lawsuit or Criminal Investigation 46 Deciphering the Legal Codes 47 Managing E-Discovery 51 Conducting the Investigation in Good Faith 57 Deciding Who’s Paying the Bill 58 Chapter 3: Getting Authorized to Search and Seize 62 Getting Authority: Never Start Without It 63 Criminal Cases: Papering Your Behind (CYA) 66 Civil Cases: Verifying Company Policy 73 Chapter 4: Documenting and Managing the Crime Scene 78 Obsessing over Documentation 79 Directing the Scene 82 Managing Evidence Behind the Yellow Tape 86 Stepping Through the Scene 89 Part II: Preparing to Crack the Case 94 Chapter 5: Minding and Finding the Loopholes 96 Deciding to Take On a Client 97 Determining Whether You Can Help the Case 102 Passing the Court’s Standard As a Reliable Witness 105 Going Forward with the Case 107 Keeping a Tight Forensic Defense 112 Chapter 6: Acquiring and Authenticating E-Evidence 118 Acquiring E-Evidence Properly 118 Step 1: Determine the Type of Media You’re Working With 120 Step 2: Find the Right Tool 124 Step 3: Transfer Data 128 Step 4: Authenticate the Preserved Data 136 Step 5: Make a Duplicate of the Duplicate 139 Chapter 7: Examining E-Evidence 140 The Art of Scientific Inquiry 141 Gearing Up for Challenges 142 Getting a Handle on Search Terms 145 Challenging Your Results: Plants and Frames and Being in the Wrong Place 151 Finding No Evidence 153 Reporting Your Analysis 154 Chapter 8: Extracting Hidden Data 158 Recognizing Attempts to Blind the Investigator 159 Defeating Algorithms, Hashes, and Keys 166 Finding Out-of-Sight Bytes 168 Cracking Passwords 169 Decrypting the Encrypted 172 Part III: Doing Computer Forensics Investigations 174 Chapter 9: E-Mail and Web Forensics 176 Opening Pandora’s Box of E-Mail 177 Scoping Out E-Mail Architecture 180 Seeing the E-Mail Forensics Perspective 183 Examining Client-Based E-Mail 186 Investigating Web-Based Mail 190 Searching Browser Files 193 Looking through Instant Messages 196 Chapter 10: Data Forensics 198 Delving into Data Storage 199 Finding Digital Cavities Where Data Hides 208 Extracting Data 219 Rebuilding Extracted Data 222 Chapter 11: Document Forensics 224 Finding Evidential Material in Documents: Metadata 225 Honing In on CAM (Create, Access, Modify) Facts 230 Discovering Documents 231 Chapter 12: Mobile Forensics 242 Keeping Up with Data on the Move 243 Making a Device Seizure 248 Cutting-Edge Cellular Extractions 255 Chapter 13: Network Forensics 264 Mobilizing Network Forensic Power 265 Identifying Network Components 265 Saving Network Data 271 Re-Creating an Event from Traffic 276 Looking at Network Forensic Tools 282 Discovering Network Forensic Vendors 286 Chapter 14: Investigating X-Files: eXotic Forensics 288 Taking a Closer Look at Answering Machines 289 Examining Video Surveillance Systems 289 Cracking Home Security Systems 290 Tracking Automobiles 291 Extracting Information from Radio Frequency Identification (RFID) 293 Examining Copiers 295 Taking a Look On the Horizon 296 Part IV: Succeeding in Court 298 Chapter 15: Holding Up Your End at Pretrial 300 Pretrial Motions 301 Handling Pretrial Hearings 303 Giving a Deposition 304 Chapter 16: Winning a Case Before You Go to Court 310 Working Around Wrong Moves 311 Responding to Opposing Experts 312 Chapter 17: Standing Your Ground in Court 318 Making Good on Deliverables 319 Understanding Barroom Brawls in the Courtroom 320 Presenting E-Evidence to Persuade 327 Communicating to the Court 329 Part V: The Part of Tens 334 Chapter 18: Ten Ways to Get Qualified and Prepped for Success 336 The Front Ten: Certifications 336 The Back Ten: Journals and Education 339 Chapter 19: Ten Tactics of an Excellent Investigator and a Dangerous Expert Witness 342 Stick to Finding and Telling the Truth 343 Don’t Fall for Counsel’s Tricks in Court 343 Be Irrefutable 344 Submit a Descriptive, Complete Bill 344 Prepare a Clear, Complete Report 345 Understand Nonverbal Cues 345 Look ’Em Straight in the Eye 346 Dress for Your Role As a Professional 346 Stay Certified and Up-to-Date 346 Know When to Say No 347 Chapter 20: Ten Cool Tools for Computer Forensics 348 Computer Forensic Software Tools 348 Computer Forensic Hardware 350 Computer Forensic Laboratories 351 Glossary 354 Index 368 A guide to the basics of computer forensics covers such topics as acquiring and examining e-evidence, extracting hidden data, filtering data, handling passwords and encrypted data, and exhibiting evidence in court-- source other than Library of Congress