Handbook of Digital Evidence: Reliable Forensic Computing

Digital evidence is increasingly critical in an age of widespread Internet use, consumer-based email, digital contracts, digital correspondence, digitized business processes and records and digitized government. One needs to prove what went wrong in or near a computer-- whether a major crime, a dispute about a failed contract to deliver goods or services, a minor dispute within a business, or just an accident that generates legal proceedings or an insurance claim. The challenge is how to capture that evidence in ways that meet the needs of the legal system and also convince judges and juries lacking computer expertise. The problems of "digital evidence" are not the exclusive preserve of elite cyber-sleuths chasing hackers across the Internet. Anyone who uses a computer, relies on computer data, designs computer systems, or advises those who do needs to understand where and how much evidence can be located, how it should be preserved free from contamination, how it may best be analyzed, and how to present it in statements, affidavits, and court. The "Handbook of Digital Evidence and Forensics" will provide coverage of: *some basic principles about forensic science--its obligations, disciplines, professional practices, etc. *the application and development of these principles to specific types of computer-derived evidence (such as documents, database records, data from disks and other storage media, and data intercepted in transmission) *specific procedures and techniques for safe acquisition, analysis and presentation of particular types of evidence *presentation skills for written and oral evidence TOC:PART I PRINCIPLES: *Digital evidence: a short history *Legal 1= Reliability-Admissibility and Weight-a primer *Legal rights and dutiesof investigators *Principles of forensic activity *Practical 1= approaches PART II STORED DATA: *PCs-evidence from hard disks*Operating systems *Mainframe systems *Windows 9x/ME-evidence from*Windows NT/2000/XP-evidence from *Linux-evidence from *Applications-evidence from *Particular applications INTERNET EVIDENCE: *Internetevidence-the user dimension *Internet evidence-the ISP dimensionNETWORK EVIDENCE: *Internal networks-evidence from servers *Intranets*Internal networks-evidence in transmission *Complex systems 1= NONSTANDARD 'COMPUTERS': *Organizers-evidence from solid-state memory*ATMs, POS and other specialist recording, measuring, weighing andcounting devices *Telecommunications records *Digital signatures,digital certificates, EDI records *Electronic publishing managementsystems *Digital video PART III INVESTIGATIONS: *Planninginvestigations *Preserving evidence *Evidence analysis *Encryption*Author forensics-showing authorship of text by computer-aidedanalysis of style *Software forensics-showing authorship of code by