Managing Information Security, 2nd Edition

Chapter 9

Cyber Forensics

Scott R. Ellis,    kCura Corporation

Electronic evidence and information gathering have become central issues in an increasing number of conflicts and crimes. Electronic or cyber evidence used to mean the regular print-out from a computer—and a great deal of cyber exhibits in court are just that. But, for many years, law enforcement officers have been seizing data media and computers themselves, as they have become smaller and more ubiquitous. In the very recent past, investigators generated their own print-outs, sometimes using the original application program, sometimes specialist analytic and examination tools. More recently, investigators have found ways of collecting evidence from remote computers to which they ...