Computer and Information Security Handbook, 3rd Edition

Chapter 40

Cyber Forensics

Scott R. Ellis     kCura Corporation, Chicago, IL, United States

Abstract

Electronic evidence and information gathering have become central issues in an increasing number of conflicts and crimes. Electronic or cyber evidence used to mean the regular printout from a computer, and a great deal of cyber exhibits in court are just that. But for many years, law enforcement officers have been seizing data media and computers themselves, because they have become smaller and more ubiquitous. Investigators have generated their own printouts, sometimes using the original application program, sometimes specialist analytic and examination tools. More recently, investigators found ways to collect evidence from remote computers to which ...