book

Digital Forensics for Legal Professionals

by Larry Daniel, Lars Daniel

October 2011

Intermediate to advanced

368 pages

9h 15m

English

Syngress

Read now

Unlock full access

Cover image
Table of Contents
Front-matter
Copyright
Preface
Dedication
About the Authors
About the Tech Editors
Chapter 1. Digital Evidence Is Everywhere
1.1. What is digital forensics?1.2. What is digital evidence?1.3. How digital evidence is created and stored
Chapter 2. Overview of Digital Forensics
2.1. Digital forensics2.2. A little computer history2.3. A brief history of computer forensics2.4. Computer forensics becomes digital forensics

Chapter 3. Digital Forensics
3.1. The subdisciplines3.2. Computer forensics
Chapter 4. The Foundations of Digital Forensics
4.1. Who establishes best practices?4.2. Who should be following best practices?4.3. Summary of best practices4.4. What really happens in many cases
Chapter 5. Overview of Digital Forensics Tools
5.1. What makes a tool forensically sound?5.2. Who performs tool testing?5.3. Computer forensics tools: An overview5.4. Classes of forensics tools5.5. Mobile device forensics tools
Chapter 6. Digital Forensics at Work in the Legal System
6.1. Mitigation6.2. Pre-trial motions6.3. Trial preparation6.4. Example trial questions6.5. Trial phase
Chapter 7. Why Do I Need an Expert?
7.1. Why hire a digital forensics expert?7.2. When to hire a digital forensics expert
Chapter 8. The Difference between Computer Experts and Digital Forensics Experts
8.1. The computer expert8.2. The digital forensics expert8.3. A side-by-side comparison8.4. Investigation of digital evidence
Chapter 9. Selecting a Digital Forensics Expert
9.1. What is an expert?9.2. Locating and selecting an expert9.3. Certifications9.4. Training, education, and experience9.5. The right forensic tools
Chapter 10. What to Expect from an Expert
10.1. General expectations10.2. Where to begin?10.3. The examination10.4. Court preparation10.5. Expert advice
Chapter 11. Approaches by Different Types of Examiners
11.1. Standards11.2. Training and experience11.3. Impact on examinations11.4. Ethics11.5. The approach to an examination
Chapter 12. Spotting a Problem Expert
12.1. Beyond the window dressings
Chapter 13. Qualifying an Expert in Court
13.1. Qualifying an expert13.2. Qualifying experts in court
Chapter 14. Overview of Digital Evidence Discovery
14.1. Discovery motions in civil and criminal cases
Chapter 15. Discovery of Digital Evidence in Criminal Cases
15.1. Sources of digital evidence15.2. Building the motion
Chapter 16. Discovery of Digital Evidence in Civil Cases
16.1. Rules governing civil discovery16.2. Electronic discovery in particular16.3. Time is of the essence16.4. Getting to the particulars16.5. Getting the electronic evidence
Chapter 17. Discovery of Computers and Storage Media
17.1. An example of a simple consent to search agreement17.2. Example of a simple order for expedited discovery17.3. Example of an order for expedited discovery and temporary restraining order
Chapter 18. Discovery of Video Evidence
18.1. Common issues with video evidence18.2. Collecting video evidence18.3. Example discovery language for video evidence
Chapter 19. Discovery of Audio Evidence
19.1. Common issues with audio evidence19.2. Example discovery language for audio evidence
Chapter 20. Discovery of Social Media Evidence
20.1. Legal issues in social media discovery20.2. Finding custodian of records contact information20.3. Facebook example20.4. Google information20.5. Online e-mail accounts
Chapter 21. Discovery in Child Pornography Cases
21.1. The Adam Walsh Child Protection and Safety Act of 200621.2. The discovery process
Chapter 22. Discovery of Internet Service Provider Records
22.1. Internet service provider records or IP addresses22.2. Example language for web-based e-mail addresses22.3. What to expect from an internet service provider (ISP) subpoena
Chapter 23. Discovery of Global Positioning System Evidence
23.1. GPS tracking evidence overview23.2. Discovery of GPS evidence
Chapter 24. Discovery of Call Detail Records
24.1. Discovery issues in cellular evidence24.2. Example language for call detail records
Chapter 25. Obtaining Expert Funding in Indigent Cases
25.1. Justifying extraordinary expenses25.2. Example language for an ex parte motion for expert funds
Chapter 26. Hash Values
26.1. Hash values26.2. How hash values are used in digital forensics
Chapter 27. Metadata
27.1. The purpose of metadata27.2. Common types of metadata
Chapter 28. Thumbnails and the Thumbnail Cache
28.1. Thumbnails and the thumbnail cache28.2. How thumbnails and the thumbnail cache work28.3. Thumbnails and the thumbnail cache as evidence
Chapter 29. Deleted Data
29.1. How data is stored on a hard drive29.2. Deleted file recovery29.3. Evidence of data destruction
Chapter 30. Computer Time Artifacts (MAC Times)
30.1. Computer file system time stamps30.2. Fundamental Issues in forensic analysis of timeline30.3. Created, modified, accessed30.4. The bottom line
Chapter 31. Internet History (Web and Browser Caching)
31.1. What is web caching?31.2. How Internet browser (web) caching works31.3. Internet (web) caching as evidence31.4. What if the Internet cache is cleared by the user?
Chapter 32. Windows Shortcut Files (Link Files)
32.1. The purpose of link files, how they are created, and how they work32.2. How link files can be of evidentiary value32.3. Link files as evidence
Chapter 33. Cellular System Evidence and Call Detail Records
33.1. An overview of the cellular phone system33.2. How cell phones work33.3. Call detail records33.4. Call detail records as evidence of cell phone location33.5. Enhanced 911 wireless location services33.6. The E911 system overview33.7. Emergency situations: Real-time cell phone tracking
Chapter 34. E-mail Evidence
34.1. E-mail as evidence34.2. E-mail storage and access: Where is it?34.3. Web mail
Chapter 35. Social Media
35.1. Common forms of social networking (social media)35.2. Evidence out in the open35.3. Convenience versus security35.4. The allure of anonymity35.5. Social media as evidence35.6. Getting information from online services
Chapter 36. Peer-to-Peer Networks and File Sharing
36.1. What is peer-to-peer file sharing?36.2. How it works36.3. Privacy and security issues with peer-to-peer file sharing36.4. Peer-to-peer network evidence
Chapter 37. Cell Phones
37.1. The fragile nature of cellular evidence37.2. Forensic acquisition methods for cellular phones37.3. Subscriber identity module (SIM) cards37.4. Cell phone backup files37.5. Advanced cell phone data analytics37.6. The future of cell phone forensics
Chapter 38. Video and Photo Evidence
38.1. The most critical steps in the forensic examination of video and photo evidence38.2. Using video and photo evidence in cases
Chapter 39. Databases
39.1. Databases in everyday life39.2. What is a database?39.3. Database files as evidence39.4. Database recovery39.5. Data as evidence
Chapter 40. Accounting Systems and Financial Software
40.1. Accounting and money management programs40.2. Personal money management software40.3. Business accounting software40.4. Getting the evidence40.5. Types of evidence from financial software40.6. Batch files as evidence40.7. Other sources of financial evidence
Chapter 41. Multiplayer Online Games
41.1. The culture of Massively Multiplayer Online Role Playing Games (MMORPGs)41.2. MMORPG data as evidence
Chapter 42. Global Positioning Systems
42.1. An overview of global positioning systems42.2. An overview of the NAVSTAR Global Positioning System42.3. How GPS works42.4. Types of GPS evidence42.5. Collection of evidence from GPS devices42.6. Interpretation of GPS evidence
Index

Content preview from Digital Forensics for Legal Professionals

Chapter 26. Hash Values

The Verification Standard

Information in this chapter:

• Hash values

• How hash values are used in digital forensics

Hash values play an important role in digital forensics, especially in verifying that a forensic image of digital evidence is exactly the same as the original; a digital fingerprint, if you will. When asked on the witness stand, any examiner should be able to show that he or she took the proper steps to verify the evidence collected using hash values for verification of the forensic copy against the original evidence.

But to ignore the benefit of hash values in a case beyond simply verifying evidence does them a great disservice. If a particular file is of interest in your case, hash values can be used to find ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781597496438

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Digital Forensics for Legal Professionals

by Larry Daniel, Lars Daniel

Information in this chapter:

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.