Table of Contents

Acknowledgments

Chapter 1: Introduction

What is forensic science?

What is digital forensics?

Uses of digital forensics

The digital forensics process

Locard’s exchange principle

Scientific method

Organizations of note

Role of the forensic examiner in the judicial system

Chapter 2: Key technical concepts

Bits, bytes, and numbering schemes

File extensions and file signatures

Storage and memory

Computing environments

Allocated and unallocated space

How magnetic hard drives store data

Chapter 3: Labs and tools

Forensic laboratories

Policies and procedures

Quality assurance

Digital forensic tools

Additional resources

Chapter 4: Collecting evidence

Crime scenes and collecting evidence

Documenting the scene

Chain of custody

Live system versus dead system

Chapter 5: Windows system artifacts

Hibernation file (hiberfile.sys)

Thumbnail cache

Most recently used

Restore points and shadow copy

Chapter 6: Anti-forensics

Password attacks

Additional resources

Data destruction

Chapter 7: Legal

The fourth amendment

Criminal law—searches without a warrant

Searching with a warrant

Electronic discovery

Expert testimony

Additional resources

Chapter 8: Internet and e-mail

Internet overview

Additional resources

Web browsers—Internet Explorer

Social networking sites

Additional resources

Chapter 9: Network forensics

Network fundamentals

Network security tools

Network attacks

Incident response

Network evidence and investigations

Additional resources

Chapter 10: Mobile device forensics

Cellular networks

Operating systems

Cell phone evidence

Cell phone forensic tools

Global positioning systems

Chapter 11: Looking ahead: challenges and concerns

Standards and controls

Cloud forensics

Additional resources

Solid state drives

Speed of change

Additional resources