Handbook of Information Security: Information Warfare, Social, Legal, and International Issues and Security Foundations, Volume 2

Computer Forensics Procedures and Methods

J. Philip Craiger, National Center for Forensic Science and University of Central Florida

Introduction

Computer Forensics Tools

Forensic Server

Sound Computer Forensic Practice

Arriving at the Scene: Initial Response

Creating a Forensic Image

Verifying Image Integrity

Imaging Over a Network

Sterilizing Forensic Media

Analysis of a Forensic Image

Drive Geometry

Mounting the Image

Reducing Our Search Space

Searching a Forensic Image

I Know What You Did with Your Computer Last Summer...

Physical Analysis

Behavioral Time Lines: What Happened and When?

Collecting Evidence from Live Systems

Volatile Evidence

Log Files as Digital Evidence

Reducing the Potential for Evidence Contamination

Commercial Tools

Conclusion

Glossary

Cross References

References

Further Reading

INTRODUCTION

Computer forensics involves the preservation, identification, extraction, and documentation of computer evidence stored in the form of magnetically, optically, or electronically stored media. It is a relatively new science that is becoming increasingly important as criminals aggressively expand the use of technology in their enterprise of illegal activities. Computer forensic techniques are not as advanced as those of the more mature and mainstream forensics techniques used by law enforcement, such as blood typing, ballistics, fingerprinting, and DNA testing. Its immaturity is partly attributable to fast-paced changes in computer technology and the fact that it is a multidisciplinary ...