Computer Forensics: An Essential Guide for Accountants, Lawyers, and Managers

177 Pages·2007·0.86 MB·English

by  Michael Sheetz

C F
OMPUTER ORENSICS

C F
OMPUTER ORENSICS
A E G
N SSENTIAL UIDE FOR
A , L ,
CCOUNTANTS AWYERS AND
M
ANAGERS
M S
ICHAEL HEETZ
JOHNWILEY&SONS,INC.
Thisbookisprintedonacid-freepaper.
Copyright2007byJohnWiley&Sons,Inc.Allrightsreserved.
PublishedbyJohnWiley&Sons,Inc.,Hoboken,NewJersey.
PublishedsimultaneouslyinCanada.
Nopartofthispublicationmaybereproduced,storedinaretrievalsystem,ortransmittedinanyform
orbyanymeans,electronic,mechanical,photocopying,recording,scanning,orotherwise,exceptas
permittedunderSection107or108ofthe1976UnitedStatesCopyrightAct,withouteithertheprior
writtenpermissionofthePublisher,orauthorizationthroughpaymentoftheappropriateper-copyfeeto
theCopyrightClearanceCenter,Inc.,222RosewoodDrive,Danvers,MA01923,978-750-8400,fax
978-646-8600,oronthewebatwww.copyright.com.RequeststothePublisherforpermissionshouldbe
addressedtothePermissionsDepartment,JohnWiley&Sons,Inc.,111RiverStreet,Hoboken,NJ
07030,[phone],fax[phone].
LimitofLiability/DisclaimerofWarranty:Whilethepublisherandauthorhaveusedtheirbesteffortsin
preparingthisbook,theymakenorepresentationsorwarrantieswithrespecttotheaccuracyor
completenessofthecontentsofthisbookandspecificallydisclaimanyimpliedwarrantiesof
merchantabilityorfitnessforaparticularpurpose.Nowarrantymaybecreatedorextendedbysales
representativesorwrittensalesmaterials.Theadviceandstrategiescontainedhereinmaynotbesuitable
foryoursituation.Youshouldconsultwithaprofessionalwhereappropriate.Neitherthepublishernor
authorshallbeliableforanylossofprofitoranyothercommercialdamages,includingbutnotlimited
tospecial,incidental,consequential,orotherdamages.
ForgeneralinformationonourotherproductsandservicespleasecontactourCustomerCare
DepartmentwithintheU.S.at877-762-2974,outsidetheU.S.at317-572-3993,orfax317-572-4002.
Wileyalsopublishesitsbooksinavarietyofelectronicformats.Somecontentthatappearsinprint,
however,maynotbeavailableinelectronicformat.
FormoreinformationaboutWileyproducts,visitourWebsiteathttp://www.wiley.com.
LibraryofCongressCataloging-in-PublicationData:
Sheetz,Michael.
Computerforensics:anessentialguideforaccountants,lawyers,andmanagers/MichaelSheetz.
p.cm.
Includesindex.
ISBN:978-0-471-78932-1 (cloth)
1.Computercrimes–Investigation.I.Title.
HV8079.C65S442007
363.25–dc22
2006030331
PrintedintheUnitedStatesofAmerica.
10987654321
This book is dedicated to my mother and father, whose love and
encouragement have given me the confidence to dare to dream, and to
the memory of my grandfather, Benjamin Franklin Sheetz. His love of
the written word lives on in me.

C
ONTENTS
Introduction xi
Acknowledgments xvii
1 A Definition of Computer Forensics 1
Introduction 1
ForensicScience 2
HistoryofComputerForensics 2
WorldWideWeb 5
HackerCommunity 6
Conclusion 10
Notes 11
SuggestedReading 12
2 Basics of Computer Forensic Concepts 13
Introduction 13
UnderstandingDigitalEvidence 14
Input 15
Storage 15
Processing 16
WhatComputerDataIs 17
Output 23
Conclusion 24
Notes 24
SuggestedReading 24
3 Preservation and Collection of Digital Evidence 25
Introduction 25
RulesofEvidence 26
Preservation 27
Collection 30
Conclusion 36
Note 37
SuggestedReading 37
vii
viii CONTENTS
4 Analysis of Digital Evidence 38
Introduction 38
ForensicAnalysis 39
Conclusion 50
Notes 50
SuggestedReading 51
5 Reporting and Rendering the Opinion 52
Introduction 52
PreparingtheReport 53
Presentation 57
TrialProcess 57
Conclusion 64
SuggestedReading 65
6 Computer Attacks 66
HackersandPhreakzOhMy 66
Hackers:UnauthorizedUseandTrespassing 66
WirelessHacking 71
Malware 75
AttacksfromtheInside 79
Conclusion 85
Notes 86
SuggestedReading 87
7 Computers as Tools for Evil 88
Introduction 88
ComputersandCrime 88
IdentityTheft 89
Concealment 96
AuctionFraudandRetailCons 97
CounterfeitingandForgery 100
Prostitution 100
SecuritiesFraud 101
Conclusion 105
Notes 105
CONTENTS ix
8 Computer Tools and the Forensic Examination 108
Introduction 108
AssumingControloftheCase 109
UnderstandingtheCase 109
EvaluatingtheEvidence 110
Examiningthe‘‘Live’’System 110
CollectingDatafromaDeadSystem 116
ImagingtheDrive 118
DataExtraction 120
DataAnalysis 122
Conclusion 125
Notes 126
9 Presenting Digital Evidence in Court 127
Introduction 127
Evidence 128
TypesofEvidence 129
ExpertWitnesses 131
LegalRequirementsofEvidence 132
SearchandSeizure 137
Conclusion 142
Notes 143
Index 145