Introduction xxxvii
CHAPTER 1: THE SCOPE OF DIGITAL FORENSICS
Popular Myths about Computer Forensics
Types of Digital Forensic Evidence Recovered
What Skills Must a Digital Forensics Investigator Possess?
The Importance of Digital Forensics
Job Opportunities
A History of Digital Forensics
Training and Education
Summary
Key Terms
Assessment
CHAPTER 2: WINDOWS OPERATING AND FILE SYSTEMS
Physical and Logical Storage
Paging
File Conversion and Numbering Formats
Operating Systems
Windows Registry
Microsoft Office
Microsoft Windows Features
Summary
Key Terms
Assessment
CHAPTER 3: HANDLING COMPUTER HARDWARE
Hard Disk Drives
Cloning a PATA or SATA Hard Disk
Removable Memory
Summary
Key Terms
Assessment
Reference
CHAPTER 4: ACQUIRING EVIDENCE IN A COMPUTER FORENSICS LAB
Lab Requirements
Private-Sector Computer Forensics Laboratories
Computer Forensics Laboratory Requirements
Extracting Evidence from a Device
Skimmers
Steganography
Summary
Key Terms
Assessment
CHAPTER 5: ONLINE INVESTIGATIONS
Working Undercover
Dark Web Investigations
Virtual Currencies
Website Evidence
Background Searches on a Suspect
Online Crime
Capturing Online Communications
Edge Web Browser
Summary
Key Terms
Assessment
CHAPTER 6: DOCUMENTING THE INVESTIGATION
Obtaining Evidence from a Service Provider
Documenting a Crime Scene
Seizing Evidence
Documenting the Evidence
Using Tools to Document an Investigation
Writing Reports
Using Expert Witnesses at Trial
Summary
Key Terms
Assessment
CHAPTER 7: ADMISSIBILITY OF DIGITAL EVIDENCE
History and Structure of the United States Legal System
Evidence Admissibility
Constitutional Law
When Computer Forensics Goes Wrong
Structure of the Legal System in the European Union (E.U.)
Privacy Legislation in Asia
Summary
Key Terms
Assessment
CHAPTER 8: NETWORK FORENSICS AND INCIDENT RESPONSE
The Tools of the Trade
Networking Devices
Understanding the OSI Model
Introduction to VoIP
Incident Response (IR)
STIX, TAXII, and Cybox
Advanced Persistent Threats
Investigating a Network Attack
Summary
Key Terms
Assessment
CHAPTER 9: MOBILE FORENSICS
The Cellular Network
Handset Specifications
Mobile Operating Systems
Standard Operating Procedures for Handling Handset Evidence
Handset Forensics
Manual Cellphone Examinations
Global Satellite Service Providers
Legal Considerations
Other Mobile Devices
Documenting the Investigation
Summary
Key Terms
Assessment
CHAPTER 10: MOBILE APP INVESTIGATIONS
Static Versus Dynamic Analysis
Dating Apps
Rideshare Apps
Communication Apps
Summary
Key Terms
Assessment
CHAPTER 11: PHOTOGRAPH FORENSICS
National Center for Missing and Exploited Children (NCMEC)
Project VIC
Case Studies
Understanding Digital Photography
Examining Picture Files
Evidence Admissibility
Case Studies
Summary
Key Terms
Assessment
CHAPTER 12: MAC FORENSICS
A Brief History
Apple Wi-Fi Devices
Macintosh File Systems
Macintosh Operating Systems
Apple Mobile Devices
Performing a Mac Forensics Examination
Case Studies
Summary
Key Terms
Assessment
CHAPTER 13: CASE STUDIES
Silk Road
Las Vegas Massacre
Zacharias Moussaoui
BTK (Bind Torture Kill) Serial Killer
Cyberbullying
Sports
Summary
Key Terms
Assessment
Assignment
CHAPTER 14: INTERNET OF THINGS (IOT) FORENSICS AND EMERGENT TECHNOLOGIES
5G
Wi-Fi 6
Wi-Fi Mesh Networks
Shodan
Mirai Botnet
Cryptocurrency Mining
Alexa
Micro-Chipping
Fitness Trackers
Apple Watch
Action Cameras
Police Safety
Police Vehicles
Vehicle Forensics
Low-Tech Solution for High-Tech Seizures
Summary
Key Terms
Assessment
Answer Key