The vast majority of modern criminal investigations involve some element of digital evidence, from mobile phones, computers, CCTV and other devices. Digital Forensics: Digital Evidence in Criminal Investigations provides the reader with a better understanding of how digital evidence complements “traditional” scientific evidence and examines how it can be used more effectively and efficiently in a range of investigations. Taking a new approach to the topic, this book presents digital evidence as an adjunct to other types of evidence and discusses how it can be deployed effectively in support of investigations. The book provides investigators/SSMs/other managers with sufficient contextual and technical information to be able to make more effective use of digital evidence sources in support of a range of investigations. In particular, it considers the roles played by digital devices in society and hence in criminal activities. From this, it examines the role and nature of evidential data which may be recoverable from a range of devices, considering issues relating to reliability and usefulness of those data. Includes worked case examples, test questions and review quizzes to enhance student understandingSolutions provided in an accompanying websiteIncludes numerous case studies throughout to highlight how digital evidence is handled at the crime scene and what can happen when procedures are carried out incorrectlyConsiders digital evidence in a broader context alongside other scientific evidenceDiscusses the role of digital devices in criminal activities and provides methods for the evaluation and prioritizing of evidence sourcesIncludes discussion of the issues surrounding modern digital evidence examinations, for example; volume of material and its complexityClear overview of all types of digital evidence Digital Forensics: Digital Evidence in Criminal Investigations is an invaluable text for undergraduate students taking either general forensic science courses where digital forensics may be a module or a dedicated computer/digital forensics degree course. The book is also a useful overview of the subject for postgraduate students and forensic practitioners.
Angus McKenzie Marshall, Senior Lecturer in Forensic Science, School of Science & Technology, University of Teesside, Middlesbrough, UK.
Preface viiAcknowledgments xiList of Tables xiiList of Figures xiii1 Introduction 11.1 Key developments 11.2 Digital devices in society 51.3 Technology and culture 61.4 Comment 72 Evidential Potential of Digital Devices 92.1 Closed vs. open systems 102.2 Evaluating digital evidence potential 173 Device Handling 193.1 Seizure issues 213.2 Device identification 313.3 Networked devices 363.4 Contamination 404 Examination Principles 434.1 Previewing 434.2 Imaging 474.3 Continuity and hashing 484.4 Evidence locations 495 Evidence Creation 555.1 A seven-element security model 565.2 A developmental model of digital systems 605.3 Knowing 615.4 Unknowing 635.5 Audit and logs 686 Evidence Interpretation 696.1 Data content 696.2 Data context 837 Internet Activity 857.1 A little bit of history 857.2 The ISO/OSI model 867.3 The internet protocol suite 907.4 DNS 947.5 Internet applications 968 Mobile Devices 1098.1 Mobile phones and PDAs 1098.2 GPS 1168.3 Other personal technology 1189 Intelligence 1199.1 Device usage 1199.2 Profiling and cyberprofiling 1219.3 Evaluating online crime: automating the model 1249.4 Application of the formula to case studies 1269.5 From success estimates to profiling 1299.6 Comments 12910 Case Studies and Examples 13110.1 Introduction 13110.2 Copyright violation 13110.3 Missing person and murder 13310.4 The view of a defence witness 137Appendix A The “Aircraft Carrier” PC 141Appendix B Additional Resources 145B.1 Hard disc and storage laboratory tools 145B.2 Mobile phone/PDA tools 146B.3 Live CDs 146B.4 Recommended reading 146Appendix C SIM Card Data Report 149References 157Index 161
?This book presents digital evidence as an adjunct to other types of evidence and discusses how it can be deployed effectively in support of investigations.? (Reviews, May 2009)