Hardcover

ISBN 10: 0123742684 ISBN 13: 9780123742681

Publisher: Academic Press, 2011

Digital Evidence and Computer Crime, Third Edition, provides the knowledge necessary to uncover and use digital evidence effectively in any kind of investigation.

It offers a thorough explanation of how computer networks function, how they can be involved in crimes, and how they can be used as a source of evidence. In particular, it addresses the abuse of computer networks as well as privacy and security issues on computer networks.

This updated edition is organized into five parts. Part 1 is about digital forensics and covers topics ranging from the use of digital evidence in the courtroom to cybercrime law. Part 2 explores topics such as how digital investigations are conducted, handling a digital crime scene, and investigative reconstruction with digital evidence. Part 3 deals with apprehending offenders, whereas Part 4 focuses on the use of computers in digital investigation. The book concludes with Part 5, which includes the application of forensic science to networks.

New to this edition are updated information on dedicated to networked Windows, Unix, and Macintosh computers, as well as Personal Digital Assistants; coverage of developments in related technology and tools; updated language for search warrant and coverage of legal developments in the US impacting computer forensics; and discussion of legislation from other countries to provide international scope. There are detailed case examples that demonstrate key concepts and give students a practical/applied understanding of the topics, along with ancillary materials that include an Instructor's Manual and PowerPoint slides.

This book will prove valuable to computer forensic students and professionals, lawyers, law enforcement, and government agencies (IRS, FBI, CIA, CCIPS, etc.).

• Named The 2011 Best Digital Forensics Book by InfoSec Reviews
• Provides a thorough explanation of how computers & networks function, how they can be involved in crimes, and how they can be used as evidence
• Features coverage of the abuse of computer networks and privacy and security issues on computer networks

Review:

Practitioner's Tips from Digital Evidence and Computer Crime's Chapter on Digital Evidence in the Courtroom

• In practice, many searches are conducted with consent. One of the biggest problems with consensual searches is that digital investigators must cease the search when the owner withdraws consent. However, digital investigators may be able to use the evidence gathered from a consensual search to establish probable cause and obtain a search warrant.
• Once a search warrant is obtained, there is generally a limited amount of time to execute the search. Therefore, it is prudent to obtain a search warrant only after sufficient preparations have been made to perform the search in the allotted time period. Any evidence obtained under an expired search warrant may not be admissible.
• Many digital investigators use the terminology “is consistent with” inappropriately to mean that an item of digital evidence might have been due to a certain action or event. For many people, to say that something is consistent with something else means that the two things are identical, without any differences. To avoid confusion, digital investigators are encouraged only to state that something is consistent with something else if the two things are the same and to otherwise use the terminology “is compatible with.”
• Given the complexity of modern computer systems, it is not unusual for digital investigators to encounter unexpected and undocumented behaviors during a forensic analysis of digital evidence. Such behaviors can cause unwary digital investigators to reach incorrect conclusions that can have a significant impact on a case, sometimes leading to false accusations. Thorough testing with as similar an environment to the original as possible can help avoid such mistakes and resolve differences in interpretation of digital evidence. Provided digital investigators can replicate the actions that led to the digital evidence in question, they can generally agree on what the evidence means. When it is not possible to replicate the exact environment or digital evidence under examination, digital investigators may need to rely on their understanding of the systems involved, which is where differences of opinion can arise.
• Careful use of language is needed to present digital evidence and associated conclusions as precisely as possible. Imprecise use of language in an expert report can give decision makers the wrong impression or create confusion. Therefore, digital investigators should carefully consider the level of certainty in their conclusions and should qualify their findings and conclusions appropriately.

Read a sample chapter on genesis and migration from Digital Evidence and Computer Crime

From the Back Cover:

Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet, Third Edition

by Eoghan Casey cmdLabs, Baltimore, Maryland, USA

Technical Editor Brent E. Turvey, Forensic Solutions LLC, Sitka, Alaska, USA

Contributors:  Susan W. Brenner (University of Dayton School of Law), Bert-Jaap Koops (Tilburg University, Netherlands), Tessa Robinson (Law Library, Dublin, Ireland), Bradley Schatz (Schatz Forensic Pty. Ltd., Queensland), Terrance Maguire (cmdLabs), Monique M. Ferraro (Technology Forensics, LLC, Connecticut), Michael McGrath, Christopher Daywalt (cmdLabs)

Digital evidence - evidence that is stored on or transmitted by computers - can play a major role in any investigation, including homicide, child exploitation, computer intrusions and corporate malfeasance. The scope of computer crime has expanded further with the proliferation of networks, embedded systems, mobile devices and industrial control systems. Digital evidence from these systems can help establish when events occurred, where victims and suspects were, with whom they communicated, and may even show their intent to commit a crime.

Despite the ubiquity of computer-facilitated crime, few people are well-versed in the technical, investigative and legal issues related to digital evidence. As a result, digital evidence is often overlooked, collected incorrectly or analyzed ineffectively.

Digital Evidence and Computer Crime, Third Edition is completely updated, providing the knowledge necessary to uncover and use digital evidence effectively in any kind of investigation. The first and second editions introduced thousands of practitioners to this field, and this third edition expands on the material presented in previous editions to help digital forensic practitioners further develop their skills. The textbook teaches digital investigation and forensic methodologies, how computers and networks function, how they can be involved in crimes, and how they can be used as a source of evidence. This book is suitable for incident responders, forensic analysts, police and lawyers. Case examples and practitioner's tips are provided throughout each chapter to emphasize important concepts.

New chapters include coverage of:

·  Handling digital crime scenes ·  Investigating violent crimes ·  Applying the scientific method to digital investigations ·  Legal issues from both the U.S. and European perspectives

ISBN:  978-0-12-374268-1