Digital Archaeology

Michael W. Graves has worked for more than fifteen years as a network specialist, security analyst, and forensic analyst. He worked as a contractor for the federal government on jobs involving digital investigations ranging from simple employee violations to potential national security threats, and participated in e-discovery for a major bank. Graves holds an M.S. in digital investigation from Champlain College, where he studied under pioneers Gary Kessler and Robert Simpson, among others. He also served several semesters as adjunct professor of computer science for the college.

• Preface xiiiAbout the Author xxiChapter 1: The Anatomy of a Digital Investigation 1A Basic Model for Investigators 2Understanding the Scope of the Investigation 8Identifying the Stakeholders 12The Art of Documentation 13Chapter Review 21Chapter Exercises 21References 22Chapter 2: Laws Affecting Forensic Investigations 23Constitutional Implications of Forensic Investigation 24The Right to Privacy 29The Expert Witness 31Chapter Review 32Chapter Exercises 32References 33Chapter 3: Search Warrants and Subpoenas 35Distinguishing between Warrants and Subpoenas 36What Is a Search and When Is It Legal? 37Basic Elements of Obtaining a Warrant 40The Plain View Doctrine 43The Warrantless Search 44Subpoenas 50Chapter Review 51Chapter Exercises 52References 52Chapter 4: Legislated Privacy Concerns 55General Privacy 56Financial Legislation 59Privacy in Health Care and Education 62Privileged Information 64Chapter Review 67Chapter Exercises 68References 68Chapter 5: The Admissibility of Evidence 71What Makes Evidence Admissible? 71Keeping Evidence Authentic 76Defining the Scope of the Search 84When the Constitution Doesn’t Apply 84Chapter Review 89Chapter Exercises 89References 89Chapter 6: First Response and the Digital Investigator 91Forensics and Computer Science 91Controlling the Scene of the Crime 96Handling Evidence 100Chapter Review 109Chapter Exercises 109References 110Chapter 7: Data Acquisition 111Order of Volatility 112Memory and Running Processes 112Acquiring Media 121Chapter Review 128Chapter Exercises 128References 129Chapter 8: Finding Lost Files 131File Recovery 131The Deleted File 141Data Carving 145Chapter Review 149Chapter Exercises 150References 150Chapter 9: Document Analysis 151File Identification 151Understanding Metadata 157Mining the Temporary Files 172Identifying Alternate Hiding Places of Data 176Chapter Review 183Chapter Exercises 183References 183Chapter 10: E-mail Forensics 185E-mail Technology 185Information Stores 191The Anatomy of an E-mail 196An Approach to E-mail Analysis 203Chapter Review 210Chapter Exercises 211References 211Chapter 11: Web Forensics 213Internet Addresses 213Web Browsers 215Web Servers 233Proxy Servers 238Chapter Review 244Chapter Exercises 244References 245Chapter 12: Searching the Network 247An Eagle’s Eye View 247Initial Response 248Proactive Collection of Evidence 250Post-Incident Collection of Evidence 262Router and Switch Forensics 268Chapter Review 275Chapter Exercises 275References 276Chapter 13: Excavating a Cloud 277What Is Cloud Computing? 277Shaping the Cloud 279The Implications of Cloud Forensics 284On Virtualization 291Constitutional Issues 300Chapter Review 303Chapter Exercises 304References 304Chapter 14: Mobile Device Forensics 307Challenges of Mobile Device Forensics 307How Cell Phones Work 308Data Storage on Cell Phones 313Acquisition and Storage 317Legal Aspects of Mobile Device Forensics 322Chapter Review 324Chapter Exercises 325References 325Chapter 15: Fighting Antiforensics 327Artifact Destruction 328Hiding Data on the System 336Covert Data 347Chapter Review 354Chapter Exercises 355References 355Chapter 16: Litigation and Electronic Discovery 357What Is E-Discovery? 358A Roadmap of E-Discovery 358Conclusion 377Chapter Review 377Chapter Exercises 377References 378Chapter 17: Case Management and Report Writing 379Managing a Case 379Writing Reports 389Chapter Review 393Chapter Exercises 394References 394Chapter 18: Tools of the Digital Investigator 395Software Tools 395Working with “Court-Approved” Tools 410Hardware Tools 413Nontechnical Tools 418Chapter Review 421Chapter Exercises 422References 422Chapter 19: Building a Forensic Workstation 423What Is a Forensic Workstation? 424Commercially Available Forensic Workstations 425Building a Forensic Workstation From Scratch 429Chapter Review 440Chapter Exercises 440References 440Chapter 20: Licensing and Certification 441Digital Forensic Certification 441Vendor-Neutral Certification Programs 442Vendor-Specific Certification Programs 449Digital Forensic Licensing Requirements 452Chapter Review 454Chapter Exercises 454References 454Chapter 21: The Business of Digital Forensics 457Starting a New Forensics Organization 458Maintaining the Organization 466Generating Revenue 478Organizational Certification 481Chapter Review 483Chapter Exercises 483References 483Appendix A: Chapter Review Answers 485Appendix B: Sample Forms 505Glossary 511Index 521

"For those looking for an introductory text on the topic of digital forensics, Digital Archaeology: The Art and Science of Digital Forensics is an excellent read. Its comprehensive overview of the entire topic, combined with the author's excellent writing skills and experience, make the book a worthwhile reference." -- Ben Rothke, CISSP - information security manager