Digital Forensics

The definitive text for students of digital forensics, as well as professionals looking to deepen their understanding of an increasingly critical field Written by faculty members and associates of the world-renowned Norwegian Information Security Laboratory (NisLab) at the Norwegian University of Science and Technology (NTNU), this textbook takes a scientific approach to digital forensics ideally suited for university courses in digital forensics and information security. Each chapter was written by an accomplished expert in his or her field, many of them with extensive experience in law enforcement and industry. The author team comprises experts in digital forensics, cybercrime law, information security and related areas. Digital forensics is a key competency in meeting the growing risks of cybercrime, as well as for criminal investigation generally. Considering the astonishing pace at which new information technology and new ways of exploiting information technology is brought on line, researchers and practitioners regularly face new technical challenges, forcing them to continuously upgrade their investigatory skills. Designed to prepare the next generation to rise to those challenges, the material contained in Digital Forensics has been tested and refined by use in both graduate and undergraduate programs and subjected to formal evaluations for more than ten years. * Encompasses all aspects of the field, including methodological, scientific, technical and legal matters * Based on the latest research, it provides novel insights for students, including an informed look at the future of digital forensics * Includes test questions from actual exam sets, multiple choice questions suitable for online use and numerous visuals, illustrations and case example images * Features real-word examples and scenarios, including court cases and technical problems, as well as a rich library of academic references and references to online media Digital Forensics is an excellent introductory text for programs in computer science and computer engineering and for master degree programs in military and police education. It is also a valuable reference for legal practitioners, police officers, investigators, and forensic practitioners seeking to gain a deeper understanding of digital forensics and cybercrime.

Table of Contents:
Preface List of Figures List of Tables List of Examples List of Definitions List of Abbreviations 1 Introduction 1 1.1 Forensic Science 1 1.2 Digital Forensics 4 1.3 Digital Evidence 7 1.4 Further Reading 9 1.5 Chapter Overview 10 1.6 Comments on Citation And Notation 11 2 The Digital Forensics Process 11 2.1 Introduction 12 2.2 The Identification Phase 16 2.3 The Collection Phase 24 2.4 The Examination Phase 35 2.5 The Analysis Phase 42 2.6 The Presentation Phase 47 2.7 Summary 50 2.8 Exercises 51 3 Cybercrime Law 54 3.1 Introduction 54 3.2 The International Legal Framework of Cybercrime Law 57 3.3 Digital Crime Substantive Criminal Law 79 3.4 Investigation Methods for Collecting Digital Evidence 99 3.5 International Cooperation in Order to Collect Digital Evidence 113 3.6 Summary 119 3.7 Exercises 120 4 Digital Forensic Readiness 122 4.1 Introduction 122 4.2 Definition 122 4.3 Law Enforcement vs. Enterprise Digital Forensic Readiness 123 4.4 Why? Rationale for Digital Forensic Readiness 124 4.5 Frameworks, Standards and Methodologies 129 4.6 Becoming Digital Forensic Ready 132 4.7 Enterprise Digital Forensic Readiness 133 4.8 Considerations for Law Enforcement 152 4.9 Summary 152 4.10 Exercises 153 5 Computer Forensics 154 5.1 Introduction 154 5.2 Evidence Collection 155 5.3 Examination 160 5.4 Analysis 198 5.5 Summary 201 5.6 Exercises 202 6 Mobile and Embedded Forensics 204 6.1 Introduction 205 6.2 Collection Phase 223 6.3 Examination Phase 260 6.4 Reverse Engineering and Analysis of Applications 281 6.5 Summary 285 6.6 Exercises 286 7 Internet Forensics 288 7.1 Introduction 288 7.2 Computer Networking 289 7.3 Layers of Network Abstraction 290 7.4 The Internet 291 7.5 Tracing Information on The Internet 302 7.6 Collection Phase - Local Acquisition 308 7.7 Collection Phase Network Acquisition 312 7.8 Collection Phase - Remote Acquisition 314 7.9 Other Considerations 318 7.10 The Examination and Analysis Phases 320 7.11 Summary 326 7.12 Exercises 326 8 Challenges in Digital Forensics 328 8.1 Computational Forensics 328 8.2 Automation and Standardization 331 8.3 Research Agenda 332 8.4 Summary 332 9 Educational Guide 334 9.1 Teacher s Guide 334 9.2 Student'S Guide 335 9.3 Summary 339 About The Authors 340 Index 354

About the Author :
ANDRE ARNES, PhD is Senior Vice President and Chief Security Office of Telenor Group and an Associate Professor on the faculty of the Norwegian Information Security Laboratory (NisLab) at the Norwegian University of Technology and Science (NTNU). An experienced cyber security expert, Dr. Arnes has extensive experience both as a security leader in a global corporation and as a computer crime special investigator in law enforcement.