Digital Forensics

Description

The definitive text for students of digital forensics, as well as professionals looking to deepen their understanding of an increasingly critical field

Written by faculty members and associates of the world-renowned Norwegian Information Security Laboratory (NisLab) at the Norwegian University of Science and Technology (NTNU), this textbook takes a scientific approach to digital forensics ideallysuited for university courses in digital forensics and information security. Each chapter was written by an accomplished expert in his or her field, many of them with extensive experience in law enforcement and industry. The author team comprises experts in digital forensics, cybercrime law, information security and related areas.  

Digital forensics is a key competency in meeting the growing risks of cybercrime, as well as for criminal investigation generally. Considering the astonishing pace at which new information technology – and new ways of exploiting information technology – isbrought on line, researchers and practitioners regularly face new technical challenges, forcing them to continuously upgrade their investigatory skills. Designed to prepare the next generation to rise to those challenges, the material contained in Digital Forensics has been tested and refined by use in both graduate and undergraduate programs and subjected to formal evaluations for more than ten years.

• Encompassesallaspects of thefield, includingmethodological, scientific, technical and legal matters
• Basedonthelatestresearch, itprovides novel insightsforstudents, includinganinformed look at thefuture of digital forensics
• Includes test questionsfrom actual exam sets, multiplechoicequestionssuitablefor online use and numerousvisuals, illustrations and case exampleimages
• Features real-wordexamples and scenarios, includingcourt cases and technicalproblems, as well as a richlibrary of academicreferences and references to online media

Digital Forensics is anexcellent introductory text for programs in computer science and computer engineering and for master degree programs in military and police education. It is also a valuable reference for legal practitioners, police officers, investigators, and forensic practitioners seeking to gain a deeper understanding of digital forensics and cybercrime.

Table of Contents

Preface

List of Figures

List of Tables

List of Examples

List of Definitions

List of Abbreviations

1 Introduction 1

1.1 Forensic Science 1

1.2 Digital Forensics 4

1.3 Digital Evidence 7

1.4 Further Reading 9

1.5 Chapter Overview 10

1.6 Comments on Citation And Notation 11

2 The Digital Forensics Process 11

2.1 Introduction 12

2.2 The Identification Phase 16

2.3 The Collection Phase 24

2.4 The Examination Phase 35

2.5 The Analysis Phase 42

2.6 The Presentation Phase 47

2.7 Summary 50

2.8 Exercises 51

3 Cybercrime Law 54

3.1 Introduction 54

3.2 The International Legal Framework of Cybercrime Law 57

3.3 Digital Crime – Substantive Criminal Law 79

3.4 Investigation Methods for Collecting Digital Evidence 99

3.5 International Cooperation in Order to Collect Digital Evidence 113

3.6 Summary 119

3.7 Exercises 120

4 Digital Forensic Readiness 122

4.1 Introduction 122

4.2 Definition 122

4.3 Law Enforcement vs. Enterprise Digital Forensic Readiness 123

4.4 Why? – Rationale for Digital Forensic Readiness 124

4.5 Frameworks, Standards and Methodologies 129

4.6 Becoming “Digital Forensic” Ready 132

4.7 Enterprise Digital Forensic Readiness 133

4.8 Considerations for Law Enforcement 152

4.9 Summary 152

4.10 Exercises 153

5 Computer Forensics 154

5.1 Introduction 154

5.2 Evidence Collection 155

5.3 Examination 160

5.4 Analysis 198

5.5 Summary 201

5.6 Exercises 202

6 Mobile and Embedded Forensics 204

6.1 Introduction 205

6.2 Collection Phase 223

6.3 Examination Phase 260

6.4 Reverse Engineering and Analysis of Applications 281

6.5 Summary 285

6.6 Exercises 286

7 Internet Forensics 288

7.1 Introduction 288

7.2 Computer Networking 289

7.3 Layers of Network Abstraction 290

7.4 The Internet 291

7.5 Tracing Information on The Internet 302

7.6 Collection Phase - Local Acquisition 308

7.7 Collection Phase – Network Acquisition 312

7.8 Collection Phase - Remote Acquisition 314

7.9 Other Considerations 318

7.10 The Examination and Analysis Phases 320

7.11 Summary 326

7.12 Exercises 326

8 Challenges in Digital Forensics 328

8.1 Computational Forensics 328

8.2 Automation and Standardization 331

8.3 Research Agenda 332

8.4 Summary 332

9 Educational Guide 334

9.1 Teacher’s Guide 334

9.2 Student´S Guide 335

9.3 Summary 339

About The Authors 340

Index 354

Author Information

ANDRÉ ÅRNES, PhD is Senior Vice President and Chief Security Office of Telenor Group and an Associate Professor on the faculty of the Norwegian Information Security Laboratory (NisLab) at the Norwegian University of Technology and Science (NTNU). An experienced cyber security expert, Dr. Årnes has extensive experience both as a security leader in a global corporation and as a computer crime special investigator in law enforcement.